*21:17*[Pub][ePrint]

Get an update on changes of the IACR web-page here. For questions, contact *newsletter (at) iacr.org*.
You can also receive updates via:

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

In Financial Cryptography 2013, Bringer, Chabanne

and Patey proposed two biometric authentication schemes between

a prover and a verifier where the verifier has biometric

data of the users in plain form. The protocols are based on secure

computation of Hamming distance in the two-party setting. Their

first scheme uses Oblivious Transfer (OT) and provides security

in the semi-honest model. The other scheme uses Committed

Oblivious Transfer (COT) and is claimed to provide full security

in the malicious case.

In this paper, we show that their protocol against malicious

adversaries is not actually secure. We propose a generic attack

where the Hamming distance can be minimized without knowledge

of the real input of the user. Namely, any attacker can

impersonate any legitimate user without prior knowledge. We

propose an enhanced version of their protocol where this attack

is eliminated. We provide a simulation based proof of the security

of our modified protocol. In addition, for efficiency concerns, the

modified version also utilizes Verifiable Oblivious Transfer (VOT)

instead of COT. The use of VOT does not reduce the security of

the protocol but improves the efficiency significantly.

2014-06-25

Name: Elisa Gorla

Topic: Lifting properties from the general hyperplane section of a projective scheme

Category:(no category)

2014-06-23

We consider the notion of a non-interactive key exchange (NIKE). A NIKE scheme allows a party \\(A\\) to compute a common shared key with another party \\(B\\) from \\(B\\)\'s public key and \\(A\\)\'s secret key alone. This computation requires no interaction between \\(A\\) and \\(B\\), a feature which distinguishes NIKE from regular (i.e., interactive) key exchange not only quantitatively, but also qualitatively.

Our first contribution is a formalization of NIKE protocols as ideal

functionalities in the Universal Composability (UC) framework.

As we will argue, existing NIKE definitions (all of which are game-based) do not support a modular analysis either of NIKE schemes themselves, or of the use of NIKE schemes. We provide a simple and natural UC-based NIKE definition that allows for a modular analysis both of NIKE schemes and their use in larger protocols.

We proceed to investigate the properties of our new definition, and in

particular its relation to existing game-based NIKE definitions. We find that

(a) game-based NIKE security is equivalent to UC-based NIKE security

against \\emph{static} corruptions, and

(b) UC-NIKE security against adaptive corruptions cannot be achieved

without additional assumptions (but \\emph{can} be achieved in the random oracle model).

Our results suggest that our UC-based NIKE definition is a useful and simple abstraction of non-interactive key exchange.

Applications of elliptic curve cryptography to anonymity, privacy and

censorship circumvention call for methods to represent uniformly random

points on elliptic curves as uniformly random bit strings, so that, for

example, ECC network traffic can masquerade as random traffic.

At ACM CCS 2013, Bernstein et al. proposed an efficient approach,

called ``Elligator,\'\' to solving this problem for arbitrary elliptic

curve-based cryptographic protocols, based on the use of efficiently

invertible maps to elliptic curves. Unfortunately, such invertible maps

are only known to exist for certain classes of curves, excluding in

particular curves of prime order and curves over binary fields. A variant

of this approach, ``Elligator Squared,\'\' was later proposed by Tibouchi

(FC 2014) supporting not necessarily injective encodings to elliptic

curves (and hence a much larger class of curves), but, although some

rough efficiency estimates were provided, it was not clear how an actual

implementation of that approach would perform in practice.

In this paper, we show that Elligator Squared can indeed be implemented

very efficiently with a suitable choice of curve encodings. More

precisely, we consider the binary curve setting (which was not discussed

in Tibouchi\'s paper), and implement the Elligator Squared bit string

representation algorithm based on a suitably optimized version of the

Shallue--van de Woestijne characteristic 2 encoding, which we show can

be computed using only multiplications, trace and half-trace

computations, and a few inversions.

On the fast binary curve of Oliveira et al. (CHES 2013), our

implementation runs in an average of only 22850 Haswell cycles, making

uniform bit string representations possible for a very reasonable

overhead---much smaller even than Elligator on Edwards curves.

As a side contribution, we also compare implementations of Elligator and

Elligator Squared on a curve supported by Elligator, namely

Curve25519. We find that generating a random point and its uniform

bitstring representation is around 35-40% faster with Elligator for

protocols using a fixed base point (such as static ECDH), but 30-35%

faster with Elligator Squared in the case of a variable base point

(such as ElGamal encryption). Both are significantly slower

than our binary curve implementation.