*16:17* [Pub][ePrint]
What is the Effective Key Length for a Block Cipher: an Attack on Every Block Cipher, by Jialin Huang and Xuejia Lai
Recently, several important block ciphers are considered tobe broken by the bruteforce-like cryptanalysis, with a time complexity

faster than exhaustive key search by going over the entire key space but performing less than a full encryption for each possible key. Motivated by this observation, we describe a meet-in-the-middle attack that can always be successfully mounted against any practical block ciphers with success probability one. The data complexity of this attack is the smallest according to the unicity distance. The time complexity can be written as $2^k(1-\\epsilon)$ where $\\epsilon > 0$ for all block ciphers. Previously, the security bound that is commonly accepted is the length k of the given master key. From our result we point out that actually this k-bit security is always overestimated and can never be reached due to the inevitable key bits loss. No amount of clever design can prevent it, but increments of the number of rounds can reduce this key loss as much as possible. We give more insight in the problem of the upper bound of eective key bits in block ciphers, and show a more accurate bound. A suggestion about the relation between the key size and block size is given. That is, when the number of rounds is xed, it is better to take a key size equal to the block size. Moreover, eective key bits of many well-known block ciphers are calculated and analyzed, which also conrm their lower security margin than thought before.

*19:17* [Pub][ePrint]
PRE- Stronger Security Notion and Efficient Construction with New Property, by Jiang Zhang \\and Zhenfeng Zhang \\and Yu Chen
In a proxy re-encryption (PRE) scheme, a proxy is given a re-encryption key and has the ability to translate a ciphertext under one key into a ciphertext of the same message under a different key, without learning anything about the message encrypted under either key. PREs have been widely used in many exciting applications, such as email forwarding and law enforcement. Based on a good observation on the applications of PREs, we find that a PRE receiver needs an ability, just like what is provided by public-key encryption with non-interactive opening, to non-interactively and efficiently convince third parties of what he obtains from a particular (transformed) ciphertext, while still keeping the security of his secret key and other ciphertexts.To meet such a practical requirement, we first introduce proxy re-encryption with non-interactive opening (PRENO), and formally

define the notions of security against \\textit{chosen ciphertext

attacks} (CCA) and \\textit{proof soundness}. Our security model is natural and strong since we allow the CCA adversary to adaptively choose public keys for malicious users (i.e., a chosen key model), and a scheme secure in previous models (i.e., knowledge of secret key models) is not necessarily secure in our model. Then, we present an efficient PRENO scheme which satisfies our security notions based on the decisional bilinear Diffie-Hellman (DBDH) assumption in the standard model. Compared with two previous PRE schemes, our scheme is competitive in several aspects. First, its CCA security is proved in a strong security model under a well-studied assumption in the standard model. Second, it has a good overall performance in terms of ciphertext length and computational cost. Third, it first provides non-interactive opening for PRE schemes.

*19:17* [Pub][ePrint]
False Negative probabilities in Tardos codes, by Antonino Simone and Boris Skoric
Forensic watermarking is the application of digital watermarks for the purpose of tracing unauthorized redistribution of content.

The most powerful type of attack on watermarks is the

collusion attack, in which multiple users compare their differently

watermarked versions of the same content.

Collusion-resistant codes have been developed against these attacks.

One of the most famous such codes is the Tardos code.

It has the asymptotically optimal property that it can resist c

attackers with a code of length proportional to c^2.

Determining error rates for the Tardos code and its various

extensions and generalizations turns out to be a nontrivial problem.

In recent work we developed an approach called the

Convolution and Series Expansion (CSE) method to accurately compute

false positive accusation probabilities.

In this paper we extend the CSE method in order to make it possible

to compute false negative accusation probabilities as well.

*19:17* [Pub][ePrint]
Construction of Differential Characteristics in ARX Designs -- Application to Skein, by Gaetan Leurent
In this paper, we study differential attacks against ARX schemes. Webuild upon the generalized characteristics of de Cannière and Rechberger

and the multi-bit constraints of Leurent. We describe a more efficient

way to propagate multi-bit constraints, that allows us to use the

complete set of 2^32 2.5-bit constraints, instead of the reduced sets

used by Leurent.

As a result, we are able to build complex non-linear differential

characteristics for reduced versions of the hash function Skein. We

present several characteristics for use in various attack scenarios;

this results in attacks with a relatively low complexity, in relatively

strong settings. In particular, we show practical free-start and

semi-free-start collision attacks for 20 rounds and 12 rounds of

Skein-256, respectively.

To the best of our knowledge, these are the first examples of complex

differential trails are build for pure ARX designs. We believe this is

an important work to assess the security of ARX designs against

differential cryptanalysis. Our improved tools will be publicly available

with the final version of this paper.

*19:17* [Pub][ePrint]
Expressive Black-box Traceable Ciphertext-Policy Attribute-Based Encryption, by Zhen Liu and Zhenfu Cao and Duncan S. Wong
In a Ciphertext-Policy Attribute-Based Encryption (CP-ABE) system, decryption privileges are defined over attributes that could be shared by multiple users. If some of the users leak their decryption privileges to the public or to some third party, say for profit gain, a conventional CP-ABE has no tracing mechanism for finding these malicious users out. There are two levels of traceability for tackling this problem: (1) given a well-formed decryption key, a \\emph{White-Box} tracing algorithm can find out the original key owner; and (2) given a decryption-device while the underlying decryption algorithm or key may not be given, a \\emph{Black-Box} tracing algorithm, which treats the decryption-device as an oracle, can find out at least one of the malicious users whose keys have been used for constructing the decryption-device. In this paper we propose the first \\emph{Expressive Black-box Traceable CP-ABE} system which has two main merits: (1) it supports fully collusion-resistant black-box traceability, that is, an adversary is allowed to access an arbitrary number of keys of its own choice when building the decryption-device, and (2) it is highly expressive, that is, the system supports policies expressed in any monotonic access structures. In addition, the traceability of this new system is public, that no secret input is required and no authority needs to be called in, instead, anyone can run the tracing algorithm. We show that the system is secure against adaptive adversaries in the standard model, and is efficient, that when compared with the expressive (non-traceable) CP-ABE due to Lewko et al. in Eurocrypt 2010, our new system \\emph{adds} fully collusion-resistant black-box traceability with the price of adding only $O(\\sqrt{\\cal K})$ elements into the ciphertext and public key, rather than increasing the sizes linearly with ${\\cal K}$, which is the number of users in the system.