International Association for Cryptologic Research

# IACR News Central

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

2012-08-18
06:17 [Pub][ePrint]

Direct Anonymous Attestation (DAA) is one of the most complex cryptographic protocols deployed in practice.

It allows an embedded secure processor known as a Trusted Platform Module (TPM) to attest to the configuration of its host computer without violating the owner\'s privacy.

DAA has been standardized by the Trusted Computing Group.

The security of the DAA standard and all existing schemes is analyzed in the random oracle model.

We provide the first constructions of DAA in the standard model, that is, without relying on random oracles.

As a building block for our schemes, we construct the first efficient standard-model signatures of knowledge, which have many applications beyond DAA.

2012-08-17
05:12 [Job][New]

Japan Advanced Institute of Science and Technology (JAIST) invites applicants to a five-year term assistant professor position in SCHOOL OF INFORMATION SCIENCE. The appointee is expected to start her/his academic and educational activities in JAIST on April 1st, 2013.

A primary objective of this position is to promote international research and development activities in Cryptology and Information Security, where candidates have to be highly competent in conducting research work.

Applicants have to hold Ph.D degree, and be qualified for high scientific activities through participating in international research initiatives. The salary is automatically decided depending on your experiences and age (Typical example of annual income is about 4,000,000 to 5,000,000 yen per year (including tax)). Security group in JAIST can research by making full use of the advanced parallel computer system.

2012-08-16
20:55 [Event][New]

Submission: 7 October 2012
From December 2 to December 2

07:59 [Event][New]

Submission: 8 September 2012
From February 25 to February 27
Location: Cape Town, South Africa

07:59 [Event][New]

Submission: 27 August 2012
From January 29 to February 1

07:58 [Job][New]

Topic: Lattice-based cryptography

Supervisor: Prof. Steven Galbraith

Duration: Approx 18-24 months

Salary: Approx NZ$55,000-70,000 (US$ 44K-56K) depending on the experience of the candidate and other factors

Start date: Preferably between November 2012-March 2013

Application process:

There is no formal application process. If you are interested in learning more about the position then please send a copy of your CV by email to s.galbraith (at) math.auckland.ac.nz , preferably before September 8, 2012.

Project Details:

The project will be on the security and implementation of lattice-based cryptosystems. The specific topic of the research will depend on the technical skills and experience of the successful candidate. Some possible projects might include:

• development and analysis of algorithms for lattice problems

• development and security analysis of lattice-based cryptosystems

• efficient software and/or hardware implementation of lattice systems

The successful applicant will have (or be very near to completion) a PhD in mathematics/computer science/engineering and a research track record in at least one of the following areas:

• theoretical cryptography

• computational number theory and lattices

• software/hardware implementation of cryptographic systems.

The University of Auckland is New Zealand\'s leading university and is the highest ranked New Zealand university in the major rankings of world universities.

The Mathematics Department is the strongest mathematics department in New Zealand and is situated on the main City Campus, located in the heart of Auckland.

The city of Auckland is a wonderful place to live, with a harbour setting, great sailing, mag

2012-08-14
09:17 [Pub][ePrint]

\\emph{Succinct arguments of knowledge} are computationally-sound proofs of knowledge for NP where the verifier\'s running time is independent of the time complexity $t$ of the nondeterministic NP machine $M$ that decides the given language.

Existing succinct argument constructions are, typically, based on techniques that combine cryptographic hashing and probabilistically-checkable proofs (PCPs). Yet, even when instantiating these constructions with state-of-the-art PCPs, the prover needs $\\Omega(t)$ space in order to run in quasilinear time (i.e., time $t \\poly(k)$), regardless of the space complexity $s$ of the machine $M$.

We say that a succinct argument is \\emph{complexity preserving} if the prover runs in time $t \\poly(k)$ and space $s \\poly(k)$ and the verifier runs in time $|x| \\poly(k)$ when proving and verifying that a $t$-time $s$-space random-access machine nondeterministically accepts an input $x$. Do complexity-preserving succinct arguments exist? To study this question, we investigate the alternative approach of constructing succinct arguments based on multi-prover interactive proofs (MIPs) and stronger cryptographic techniques:

(1) We construct a one-round succinct MIP of knowledge, where each prover runs in time $t \\polylog(t)$ and space $s \\polylog(t)$ and the verifier runs in time $|x| \\polylog(t)$.

(2) We show how to transform any one-round MIP protocol to a succinct four-message argument (with a single prover), while preserving the time and space efficiency of the original MIP protocol; using our MIP protocol, this transformation yields a complexity-preserving four-message succinct argument.

As a main tool for our transformation, we define and construct a \\emph{succinct multi-function commitment} that (a) allows the sender to commit to a vector of functions in time and space complexity that are essentially the same as those needed for a single evaluation of the functions, and (b) ensures that the receiver\'s running time is essentially independent of the function. The scheme is based on fully-homomorphic encryption (and no additional assumptions are needed for our succinct argument).

(3) In addition, we revisit the problem of \\emph{non-interactive} succinct arguments of knowledge (SNARKs), where known impossibilities prevent solutions based on black-box reductions to standard assumptions. We formulate a natural (but non-standard) variant of homomorphic encryption having a \\emph{homomorphism-extraction property}. We show that this primitive essentially allows to squash our interactive protocol, while again preserving time and space efficiency, thereby obtaining a complexity-preserving SNARK. We further show that this variant is, in fact, implied by the existence of (complexity-preserving) SNARKs.

09:17 [Pub][ePrint]

Protocol for fair exchange of digital signatures is essential in many applications including contract signing, electronic commerce, or even peer-to-peer file sharing. In such a protocol, two parties, Alice and Bob, would like to exchange digital signatures on some messages in a fair way. It is known that a trusted arbitrator is necessary in the realization of such a protocol.

We identify that in some scenarios, it is required that prior to the completion of the protocol, no observer should be able to tell whether Alice and Bob are conducting such an exchange. Consider the following scenario in which Apple engages Intel in an exchange protocol to sign a contract that terminates their OEM agreement. The information would be of value to a third party (such as the stock broker, or other OEM companies). If the protocol transcript can serve as an evidence that such a communication is in progress, any observer of this communication, including the employees of both companies, would be tempted to capture the transcript and sell it to outsiders.

We introduce a new notion called \\emph{perfect ambiguous optimistic fair exchange} (PAOFE), which is particularly suitable to the above scenario. PAOFE fulfils all traditional requirements of cryptographic fair exchange of digital signatures and, in addition, guarantees that the communication transcript cannot be used as a proof to convince others that the protocol is in progress. Specifically, we formalize the notion of PAOFE and present a rigorous security model in the multi-user setting under the chosen-key attack. We also present a generic construction of PAOFE from existing cryptographic primitives and prove that our proposal is secure with respect to our definition in the standard model.

09:17 [Pub][ePrint]

Deterministic public key encryption (D-PKE) provides an alternative to randomized public key encryption in various scenarios (e.g. search on encrypted data) where the latter exhibits inherent drawbacks. In CRYPTO\'11, Brakerski and Segev formalized a framework for studying the security of deterministic public key encryption schemes with respect to auxiliary inputs. A trivial requirement is that the plaintext should not be efficiently recoverable from the auxiliary inputs.

In this paper, we present an efficient deterministic public key encryption scheme in the auxiliary-input setting from lattices. The public key size, ciphertext size and ciphertext expansion factor are improved compared with the scheme proposed by Brakerski and Segev. Our scheme is also secure even in the multi-user setting where related messages may be encrypted under multiple public keys. In addition, the security of our scheme is based on the hardness of the learning with errors (LWE) problem which remains hard even for quantum algorithms.

Furthermore, we consider deterministic identity-based public key encryption (D-IBE) in the auxiliary-input setting.

The only known D-IBE scheme (without considering auxiliary inputs) in the standard model was proposed by Bellare et al. in EUROCRYPT\'12. However, this scheme is only secure in the selective security setting, and Bellare et al. identified it as an open problem to construct adaptively secure D-IBE schemes. The second contribution of this work is to propose a D-IBE scheme from lattices that is adaptively secure.

2012-08-13
15:17 [Pub][ePrint]

We propose a protocol to transfer a one-time-pad (in a probabilistic manner) from Alice to Bob, over a public channel. The proposed protocol is unique because Bob merely acts as the receiver of the pad (secret key), i.e. Bob does not need to send any message back to Alice unless he detects eavesdropping. Such a secure transfer of one-time-pad, over public channel, is not possible in classical cryptography and in quantum cryptography all previous protocols require Bob to send almost as many messages back to Alice as she does to Bob, to establish a key.

15:17 [Pub][ePrint]

When Alice and Bob want to securely evaluate a function of their shared inputs, they typically first express the function as a (boolean or arithmetic) circuit and then securely evaluate that circuit, gate-by-gate. In other words, a secure protocol for evaluating $f$ is typically obtained in a {\\em non-black-box-way} from $f$ itself. Consequently, secure computation protocols have high overhead (in communication \\& computation) that is directly linked to the circuit-description complexity of $f$.

In other settings throughout cryptography, black-box constructions invariably lead to better practical efficiency than comparable non-black-box constructions. Could secure computation protocols similarly be made more practical by eliminating their dependence on a circuit representation of the target function? Or, in other words, {\\em must one know the code of $f$ to securely evaluate $f$?}

In this work we initiate the theoretical study of this question. We show the following:

1. A complete characterization of the 2-party tasks which admit such security against semi-honest adversaries. The characterization is inspired by notions of {\\em autoreducibility} from computational complexity theory. From this characterization, we show a class of pseudorandom functions that {\\em cannot} be securely evaluated (when one party holds the seed and the other holds the input) without knowing\'\' the code of the function in question. On the positive side, we show a class of functions (related to blind signatures) that can indeed be securely computed without knowing\'\' the code of the function.

2. Sufficient conditions for such security against malicious adversaries, also based on autoreducibility. We show that it is not possible to prove membership in the image of a one-way function in zero-knowledge, without knowing\'\' the code of the one-way function.