International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) You can also receive updates via:

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

21:17 [Pub][ePrint] Enhancing Location Privacy for Electric Vehicles (at the right time), by Joseph Liu and Man Ho Au and Willy Susilo and Jianying Zhou

  An electric vehicle is a promising and futuristic automobile propelled by electric motor(s), using electrical energy stored in batteries or another energy storage device. Due to the need of battery recharging, the cars will be required to visit recharging infrastructure very frequently. This may disclose the users\' private information, such as their location, which may expose users\' privacy. In this paper, we provide mechanisms to enhance location privacy of electric vehicles at the right time, by proposing an anonymous payment system

with privacy protection support. Our technique further allows traceability in the case where the cars are stolen.

21:17 [Pub][ePrint]


21:17 [Pub][ePrint] Construction of New Classes of Knapsack Type Public Key Cryptosystem Using Uniform Secret Sequence, K(II)$\\Sigma\\Pi$PKC, Constructed Based on Maximum Length Code, by Masao KASAHARA

  In this paper, we present a new class of knapsack type PKC referred to as K(II)$\\Sigma\\Pi$PKC.

In K(II)$\\Sigma\\Pi$PKC, Bob randomly constructs a very small subset of Alice\'s set of public key whose order is very large,

under the condition that the coding rate $\\rho$ satisfies $0.01 < \\rho < 0.5$.

In K(II)$\\Sigma\\Pi$PKC, no secret sequence such as super-increasing sequence or shifted-odd sequence but the sequence whose component is constructed by a product of the same number of many prime numbers of the same size, is used.

We show that K(II)$\\Sigma\\Pi$PKC is secure against the attacks such as LLL algorithm, Shamir\'s attack etc. , because a subset of Alice\'s public keys

is chosen entirely in a probabilistic manner at the sending end.

We also show that K(II)$\\Sigma\\Pi$PKC can be used as a member of the class of common key cryptosystems because the list

of the subset randomly chosen by Bob can be used as a common key between Bob and Alice,

provided that the conditions given in this paper are strictly observed,

without notifying Alice of his secret key through a particular secret channel.

21:17 [Pub][ePrint]


21:17 [Pub][ePrint] Edwards model of elliptic curves defined over any fields, by Oumar DIAO and Emmanuel FOUOTSA

  In this paper, we present a generalization of Edwards model for elliptic curve which is defined over any field and in particular for field of characteristic 2. This model generalize the well known Edwards model of \\cite{Edw07} over characteristic zero field, moreover it define an ordinary elliptic curve over binary fields.

For this, we use the theory of theta functions and an intermediate model embed in $\\mathbb{P}^3$ that we call a level $4$-theta model. We then present an arithmetic of this level $4$-theta model and of our Edwards model using Riemann relations of theta functions. The group laws are complete, i.e. none exceptional case for adding a pair of points; their are also unified, i.e. formulas using for addition and for doubling are the same. Over binary fields we have very efficient arithmetics on ordinary elliptic curve, but over odd field our explicit addition laws are not competitives. Nevertheless, we give efficient differential addition laws on level $4$-theta model and on Edwards model defined over any fields.

21:17 [Pub][ePrint] Algebraic Differential Fault Attacks on LED using a Single Fault Injection, by Xinjie Zhao and Shize Guo and Fan Zhang and Tao Wang and Zhijie Shi and Keke Ji

  This paper proposes a new fault attack technique on the LED block

cipher using a single fault injection by combining algebraic

side-channel attack (ASCA) and differential fault attack (DFA). We

name it as algebraic differential fault attack (ADFA). Firstly, a

boolean equation set is constructed for LED using algebraic

techniques. Then, the fault differences of the S-Box inputs in the

last round of LED are deduced by DFA and represented using algebraic

equations by the multiple deductions-based ASCA (MDASCA) technique

proposed in COSADE 2012. Finally, the key is recovered by solving

the equation set with the CryptoMiniSat solver. We show that, as to

ADFA on LED under the single nibble-based fault model, the 64-bit

key can be recovered within one minute on a common PC with a success

rate of 79\\%, which is more efficient than previous work. We modify

the CryptoMiniSat solver to count and output multiple solutions for

the key, and conduct ADFA to calculate the reduced key search space

for DFA. The key search space of LED is reduced to $2^6 \\sim

2^{17}$, which is different from previous work. We also successfully

extend ADFA on LED to other fault models using a single fault

injection, such as byte based fault model and nibble based diagonal

fault model, where traditional DFAs are difficult to work. The

results show that ADFA is an efficient and generic fault analysis

technique which significantly improves DFA.

21:17 [Pub][ePrint] Oblivious Transfer with Hidden Access Control from Attribute-Based Encryption, by Jan Camenisch and Maria Dubovitskaya and Robert R. Enderlein and Gregory Neven

  The notion of oblivious transfer with hidden access control policies (HACOT) was recently proposed by Camenisch et al.~(Public-Key Cryptography~2011).

This primitive allows a user to anonymously query a database where each record is protected by a hidden attribute-based access control policy.

At each query, the user either learns the value of a single record if the attributes in his key satisfy the policy, or the mere fact that his

attributes do not satisfy the policy.

The database, even when colluding with the key issuer, learns nothing about the identity of the user, the index or the access policy of the record, or whether access was granted or denied.

At the same time, the database can keep an eye on the overall access frequency to prevent the data from being ``crawled\'\'.

In this paper, we present a new HACOT scheme which is more efficient and offers more expressive policies

than the scheme presented by Camenisch et al.

We construct our HACOT protocol based on a hidden ciphertext-policy attribute-based encryption (HP-ABE) scheme by Nishide et al.:

users are issued HACOT decryption keys based on HP-ABE attributes and HACOT records are encrypted under HP-ABE policies.

However, as we will see, this simple approach does not work and we need to extend the Nishide et al.\\

scheme as follows.

First, we add protocols that allows users to verify that the public key of the issuer and ciphertexts are correctly formed.

Second, we reserve one attribute and give the corresponding decryption key only to the database.

Thereby users can no longer decrypt records by themselves but require the help of the database.

Third, we provide a joint decryption protocol between the user and the database, so that the

database does not learn which ciphertext is decrypted.

The latter will also allow one to optionally add revocation of the users\' access.

We prove our construction secure by a reduction to the security of Nishide et al.\'s scheme, the Symmetric External Diffie-Hellman (SXDH) and Simultaneous Flexible Pairing (SFP) assumptions.

21:17 [Pub][ePrint] A Differential Fault Attack on Grain-128a using MACs, by Subhadeep Banik and Subhamoy Maitra and Santanu Sarkar

  The $32$-bit MAC of Grain-128a is a linear combination of the first 64 and then the alternative keystream bits. In this paper we describe a successful differential fault attack on Grain-128a, in which we recover the secret key by observing the correct and faulty MACs of certain chosen messages. The attack works due to certain properties of the Boolean functions and corresponding choices of the taps from the LFSR. We present methods to identify the fault locations and then construct set of linear equations to obtain the contents of the LFSR and the NFSR. Our attack requires less than $2^{11}$ fault injections

and invocations of less than $2^{12}$ MAC generation routines.

21:17 [Pub][ePrint] A Note for the Ideal Order-Preserving Encryption Object and Generalized Order-Preserving Encryption, by Liangliang Xiao and I-Ling Yen

  Order-preserving encryption (OPE) preserves the order of data in their ciphertexts and, hence, allows range search on the encrypted data without needing to decrypt them. Security analysis of OPE schemes is very important because OPE is not a perfect encryption algorithm (the ciphertexts leak the ordering information of the plaintexts). Most of the existing security analysis for the OPE schemes are informal: they are either based on author-defined attacks or experiments. The authors in \\cite{Bol09} initiate the cryptographic study of the OPE scheme. They define the security notion POPF-CCA to qualify the security of OPE. In POPF-CCA, the ``ideal\" OPE object is defined where the encryption function is uniformly randomly selected from all order-preserving functions (generally the ``ideal\" OPE object is not computationally feasible), and a (constructed) ``real\" OPE scheme is secure under POPF-CCA if it is computationally indistinguishable from the ideal object. In other words, although the ``ideal\" OPE object is not computationally feasible, it is used as the security goal, and a (constructed) ``real\" OPE scheme is secure if it is as secure as the ``ideal\" OPE object. Such approach conceives the assumption (but not clearly stated and proved) that the ``ideal\" OPE object is the most secure OPE. But the correctness of the assumption is an easily ignored problem.

In this paper, we investigate the security of the OPE in more depth. We first give example to show that the ``ideal\" OPE object may not always be the most secure OPE. It indicates that we need to use the ``ideal\" encryption object more cautiously in the security analysis of OPE. Additionally we extend the concept of OPE to generalized OPE (GOPE). Unlike OPE, the ciphertexts of GOPE may not be numbers, but GOPE still enables the comparisons on the encrypted data without needing to decrypt them. We present two GOPEs in polynomial-sized and superpolynomial-sized domains that satisfy stronger notions of security than that of the ideal OPE object, respectively.

21:17 [Pub][ePrint] SipHash: a fast short-input PRF, by Jean-Philippe Aumasson and Daniel J. Bernstein

  SipHash is a family of pseudorandom functions optimized for short inputs. Target applications include network traffic authentication and hash-table lookups protected against hash-flooding denial-of-service attacks. SipHash is simpler than MACs based on universal hashing, and faster on short inputs. Compared to dedicated designs for hash-table lookup, SipHash has well-defined security goals and competitive performance. For example, SipHash processes a 16-byte input with a fresh key in 140 cycles on an AMD FX-8150 processor, which is much faster than state-of-the-art MACs. We propose that hash tables switch to SipHash as a hash function.

21:17 [Pub][ePrint] On Hashing Graphs, by Ashish Kundu, Elisa Bertino

  Collision resistant one-way hashing schemes are the basic building blocks of almost all crypto-systems. Use of graph-structured data models are on the rise -- in graph databases, representation of biological and healthcare data as well as in modeling systems for representing system topologies. Therefore, the problem of hashing graphs with respect to crypto-systems needs to be studied and addressed. The traditional Merkle Hash technique cannot be applied as it is because graphs are more complex data structures than trees. In this paper, we make the following contributions: (1) we define the formal security model of hashing schemes for graphs, (2) we define the formal security model of leakage-free hashing schemes for graphs, (3) we describe a hashing scheme for hashing directed and undirected graphs that uses Merkle hash technique, (4) and a hashing scheme that uses structural information instead of Merkle hash technique, (5) we define leakage-free hashing schemes for graphs. Our constructions use graph traversal techniques and are highly efficient with respect to updates to graphs: they require as little as two (O(1)) hash values to be updated to refresh the hash of the graph, while the Merkle Hash Technique and Search DAG schemes for trees and DAGs respectively require as many as O(|V|) and O(|V|+|E|).