International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) You can also receive updates via:

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

15:16 [Job][New] Full-Time PhD Position in Cryptographic Protocol Design, University of Twente, The Netherlands


The Centre for Telematics and Information Technology (CTIT) at the University of Twente invites applications for a 4-year PhD position in cryptographic protocol design.

In the course of the PhD project, the PhD student will deal with cryptographic concepts such as Homomorphic Encryption, Functional Encryption, and Secure Multiparty Computation. The research focus of the project is on the design and evaluation of new cryptographic protocols for specific application scenarios.

The PhD candidate will be expected to do active and internationally visible research which will be supervised by Dr. Andreas Peter from the Services, Cybersecurity and Safety Group of the University of Twente. The PhD candidate will be appointed for a period of four years, at the end of which he/she must have completed a PhD thesis. During this period, the PhD student has the opportunity to broaden his/her knowledge by joining international exchange programs, to participate in national and international conferences and workshops, and to visit other research institutes and universities worldwide.

Successful candidates must hold an outstanding M.Sc. degree (or equivalent) from the university study of Computer Science, Mathematics, or similar, obtained within the last two years. The topic of the master thesis should ideally have relevance to cryptography. Applications from students that are about to finish their master thesis will be accepted as well. Further requirements include excellent skills in the English language, firm knowledge in cryptography and basic programming skills. Early experiences with scientific publications are of advantage.

The position will be closed as soon as a suitable candidate is found. Applications must include:

  • CV and academic transcript (with grades)
  • motivation letter (including a description of prior

08:40 [Event][New] Cryptography Summer School

  From July 21 to July 24
Location: Bucharest, Romania
More Information:

08:34 [Event][New] AsiaCCS'15: 10th ACM Symposium on Information, Computer and Communications Security

  Submission: 26 October 2014
Notification: 22 December 2014
From April 14 to April 17
Location: Singapore, Singapore
More Information:

08:06 [Event][New] FSE 2015: 22nd International Workshop on Fast Software Encryption

  Submission: 7 November 2014
Notification: 16 January 2015
From March 8 to March 11
Location: İstanbul, Turkey
More Information:

18:17 [Pub][ePrint] On Key Recovery Attacks against Existing Somewhat Homomorphic Encryption Schemes, by Massimo Chenal and Qiang Tang

  In his seminal paper at STOC 2009, Gentry left it as a future work to investigate (somewhat) homomorphic encryption schemes with IND-CCA1 security. At SAC 2011, Loftus et al. showed an IND-CCA1 attack against the somewhat homomorphic encryption scheme presented by Gentry and Halevi at Eurocrypt 2011. At ISPEC 2012, Zhang, Plantard and Susilo showed an IND-CCA1 attack against the somewhat homomorphic encryption scheme developed by van Dijk et al. at Eurocrypt 2010. Both attacks recover the secret key of the encryption schemes.

In this paper, we continue this line of research and show that most existing somewhat homomorphic encryption schemes are not IND-CCA1 secure. In fact, we show that these schemes suffer from key recovery attacks (stronger than a typical IND-CCA1 attack), which allow an adversary to recover the private keys through a number of decryption oracle queries. The schemes, that we study in detail, include those by Brakerski and Vaikuntanathan at Crypto 2011 and FOCS 2011, and that by Gentry, Sahai and Waters at Crypto 2013. We also develop a key recovery attack that applies to the somewhat homomorphic encryption scheme by van Dijk et al., and our attack is more efficient and conceptually simpler than the one developed by Zhang et al.. Our key recovery attacks also apply to the scheme by Brakerski, Gentry and Vaikuntanathan at ITCS 2012, and we also describe a key recovery attack for the scheme developed by Brakerski at Crypto 2012.

18:17 [Pub][ePrint] On Decomposition of an NFSR into a Cascade Connection of Two Smaller, by Tian Tian and Wen-Feng Qi

  Nonlinear feedback shift registers (NFSRs) are an important type of sequence generators used for building stream ciphers. The shift register used in Grain, one of eSTREAM finalists, is a cascade connection of two NFSRs, which is also known as nonlinear product-feedback shift registers proposed in 1970. This paper provides a series of algorithms to decompose a given NFSR into a cascade connection of two smaller NFSRs. By decomposing an NFSR into a cascade connection of two smaller NFSRs, some properties regarding cycle structure of the original NFSR could be known.

18:17 [Pub][ePrint] Constrained Verifiable Random Functions, by Georg Fuchsbauer

  We extend the notion of verifiable random functions (VRF) to constrained VRFs, which generalize the concept of constrained pseudorandom functions, put forward by Boneh and Waters (Asiacrypt\'13), and independently by Kiayias et al. (CCS\'13) and Boyle et al. (PKC\'14), who call them delegatable PRFs and functional PRFs, respectively. In a standard VRF the secret key $\\sk$ allows one to evaluate a pseudorandom function at any point of its domain; in addition, it enables computation of a non-interactive proof that the function value was computed correctly. In a constrained VRF from the key $\\sk$ one can derive constrained keys $\\sk_S$ for subsets $S$ of the domain, which allow computation of function values and proofs only at points in $S$.

After formally defining constrained VRFs, we derive instantiations from the multilinear-maps-based constrained PRFs by Boneh and Waters, yielding a VRF with constrained keys for any set that can be decided by a polynomial-size circuit. Our VRFs have the same function values as the Boneh-Waters PRFs and are proved secure under the same hardness assumption, showing that verifiability comes at no cost. Constrained (functional) VRFs were stated as an open problem by Boyle et al.

15:17 [Pub][ePrint] Indifferentiability Results and Proofs for Some Popular Cryptographic Constructions, by Jaiganesh Balasundaram

  The notion of indifferentiability, which is a stronger version of the classic notion of indistinguishability, was introduced by Maurer, Renner, and Holenstein in 2003. Indifferentiability, among other things, gives us a way of ``securely replacing\" a random oracle of one type by a random oracle of a different type. Most indifferentiability proofs in the literature are very complicated, which makes them difficult to verify and in some cases, has even resulted in them being erroneous. In this paper, we use a simple yet rigorous proof technique for proving indifferentiability theorems. This technique is a generalization of the indistinguishability proof technique used by Bernstein in to prove the security of the Cipher Block Chaining (CBC) construction. We use this technique to prove the indifferentiability result for a very simple construction which processes just two blocks of input. This construction can be viewed as bearing close resemblance to the so called Sponge construction, on which the winner of SHA-3 competition is based. Also as a warm up, we prove the indistinguishability result for this construction using the coupling argument from probability theory. We also prove the non-indifferentiability result for the CBC construction and some of its standard variants, and survey the indifferentiability and non-indifferentiability results for the Merkle-Damg{\\aa}rd (MD) construction, some of its standard variants, and the Feistel construction, from the literature.

15:17 [Pub][ePrint] Differential Power Analysis of a McEliece Cryptosystem, by Cong Chen and Thomas Eisenbarth and Ingo von Maurich and Rainer Steinwandt

  This work presents the first differential power analysis of an implementation of the McEliece cryptosystem. Target of this side-channel attack is a state-of-the-art FPGA implementation of the efficient QC-MDPC McEliece decryption operation as presented at DATE 2014. The presented cryptanalysis succeeds to recover the complete secret key after a few observed decryptions. It consists of a combination of a differential leakage analysis during the syndrome computation followed by an algebraic step that exploits the relation between the public and private key.

09:17 [Pub][ePrint] Groups With Two Generators Having Unsolvable Word Problem And Presentations of Mihailova Subgroups, by Xiaofeng Wang and Chen Xu and Guo Li and Hanling Lin

  A presentation of a group with two generators having unsolvable word problem and an explicit countable presentation of Mihailova subgroup of F_2×F_2 with finite number of generators are given. Where Mihailova subgroup of F_2×F_2 enjoys the unsolvable subgroup membership problem.One then can use the presentation to create entities\' private key in a public key cryptsystem.

09:17 [Pub][ePrint] Leakage-Resilient Signatures with Graceful Degradation, by Jesper Buus Nielsen and Daniele Venturi and Angela Zottarel

  We investigate new models and constructions which allow

leakage-resilient signatures secure against existential forgeries,

where the signature is much shorter than the leakage bound.

Current models of leakage-resilient signatures against existential

forgeries demand that the adversary cannot produce a new valid

message/signature pair $(m, \\sigma)$ even after receiving some

$\\lambda$ bits of leakage on the signing key. If $\\vert \\sigma \\vert

\\le \\lambda$, then the adversary can just choose to leak a valid

signature $\\sigma$, and hence signatures must be larger than the

allowed leakage, which is impractical as the goal often is to have

large signing keys to allow a lot of leakage.

We propose a new notion of leakage-resilient signatures against

existential forgeries where we demand that the adversary cannot

produce $n = \\lfloor \\lambda / \\vert \\sigma \\vert \\rfloor + 1$

distinct valid message/signature pairs

$(m_1, \\sigma_1), \\ldots, (m_n, \\sigma_n)$ after receiving

$\\lambda$ bits of leakage. If $\\lambda =

0$, this is the usual notion of existential unforgeability. If $1