*06:17* [Pub][ePrint]
Key Wrapping with a Fixed Permutation, by Dmitry Khovratovich
We present an efficient key wrapping scheme that uses a single wide permutation and does not rely on block ciphers. The scheme is capable of wrapping keys up to 1400 bits long and processing arbitrarily long headers. Our scheme easily delivers the security level of 128 bits or higher with the master key of the same length. The permutation can be taken from the sponge hash functions such as SHA-3 (Keccak), Quark, Photon, Spongent.We also present a simple proof of security within the concept of Deterministic Authenticated Encryption (DAE) introduced by Rogaway and

Shrimpton. We extend the setting by allowing the adversary to query the permutation and following the indifferentiability setting in the security proof of the sponge construction.

*00:17* [Pub][ePrint]
Rethinking Definitions of Security for Session Key Agreement, by Wesley George and Charles Rackoff
We consider session key agreement (SKA) protocols operating in a public key infrastructure, with pre-specified peers, that take no session ID as input, and output only a session key. Despite much work on SKA, we argue that there is no good definition of security for this (very natural) protocol syntax. The difficulty is that in this setting the adversary may not be able to tell which processes share a key, and thus which session keys may be revealed without trivializing the security condition.We consider security against adversaries that control all network traffic, can register arbitrary public keys, and can retrieve session keys. We do not attempt to mitigate damage from hardware failures, such as session-state compromise, as we aim to improve our understanding of this simpler setting. We give two natural but substantially different game based definitions of security and prove that they are equivalent. Such proofs are rare for SKA. The bulk of this proof consists of showing that, for secure protocols, only compatible processes can be made to share a key. This property is very natural but surprisingly subtle. For comparison, we give a version of our definition in which processes output session IDs and we give strong theorems relating these two types of definitions.

*00:17* [Pub][ePrint]
Limitations of the Meta-Reduction Technique: The Case of Schnorr Signatures, by Marc Fischlin and Nils Fleischhacker
We revisit the security of Fiat-Shamir signatures in the non-programmable random oracle model. The well-known proof by Pointcheval and Stern for such signature schemes (Journal of Cryptology, 2000) relies on the ability to re-program the random oracle, and it has been unknown if this property is inherent. Pailler and Vergnaud (Asiacrypt 2005) gave some first evidence of the hardness by showing via meta-reduction techniques that algebraic reductions cannot succeed in reducing key-only attacks against unforgeability to the discrete-log assumptions. We also use meta-reductions to show that the security of Schnorr signatures cannot be proven equivalent to the discrete logarithm problem without programming the random oracle. Our result also holds under the one-more discrete logarithm assumption but applies to a large class of reductions, we call *single-instance* reductions, subsuming those used in previous proofs of security in the (programmable) random oracle model. In contrast to algebraic reductions, our class allows arbitrary operations, but can only invoke a single resettable adversary instance, making our class incomparable to algebraic reductions.Our main result, however, is about meta-reductions and the question if this technique can be used to further strengthen the separations above. Our answer is negative. We present, to the best of our knowledge for the first time, limitations of the meta-reduction technique in the sense that finding a meta-reduction for general reductions is most likely infeasible. In fact, we prove that finding a meta-reduction against a potential reduction is equivalent to finding a ``meta-meta-reduction\'\' against the strong existential unforgeability of the signature scheme. This means that the existence of a meta-reduction implies that the scheme must be insecure (against a slightly stronger attack) in the first place.

*09:54* [Job][New]
PhD students and Postdocs in Symmetric Crypto, *DTU, Copenhagen, Denmark*
The cryptology section at the department of applied mathematics and computer science at the Technical University of Denmark (DTU Compute) is looking for up to two Post-Docs and two Ph.D. students in the area of symmetric cryptology.For more information please contact Christian Rechberger (crec (at) dtu.dk).

*22:17* [Pub][ePrint]
How to Hide Circuits in MPC: An Efficient Framework for Private Function Evaluation, by Payman Mohassel and Saeed Sadeghian
We revisit the problem of general-purpose \\emph{private function evaluation} (PFE) wherein a single party $P_1$ holds a circuit $\\C$, while each $P_i$ for $1 \\le i \\leq n$ holds a private input $x_i$, and the goal is for a subset (or all) of the parties to learn $\\C(x_1, \\ldots, x_n)$ but nothing else. We put forth a general framework for designing PFE where the task of hiding the circuit and securely evaluating its gates are addressed independently: First, we reduce the task of hiding the circuit topology to oblivious evaluation of a mapping that encodes the topology of the circuit, which we refer to as \\emph{oblivious extended permutation} (OEP) since the mapping is a generalization of the permutation mapping. Second, we design a subprotocol for private evaluation of a single gate (PFE for one gate), which we refer to as \\emph{private gate evaluation} (PGE). Finally, we show how to naturally combine the two components to obtain efficient and secure PFE.We apply our framework to several well-known general-purpose MPC constructions, in each case, obtaining the most efficient PFE construction to date, for the considered setting. Similar to the previous work we only consider semi-honest adversaries in this paper.

\\begin{itemize} \\item In the \\emph{multiparty} case with dishonest majority, we apply our techniques to the seminal GMW protocol~\\cite{GMW87} and obtain the first general-purpose PFE with \\emph{linear complexity} in the circuit size.

\\item In the \\emph{two-party} case, we transform Yao\'s garbled circuit protocol~\\cite{yao86} into a constant-round two-party PFE. Depending on the instantiation of the underlying subprotocol, we either obtain a two-party PFE with linear complexity that improves on the only other work with similar asymptotic efficiency (Katz and Malka, ASIACRYPT 2011), or a two-party PFE that provides the best concrete efficiency to date despite not being linear.

\\item The above two constructions are for boolean circuits. In case of \\emph{arithmetic circuits}, we obtain the first PFE with linear complexity based on any additively homomorphic encryption scheme. \\end{itemize}

Though each construction uses different techniques, a common feature in all three is that the overhead of hiding the circuit $\\C$ is essentially equal to the cost of running the OEP protocol on a vector of size $|\\C|$. As a result, to improve efficiency, one can focus on lowering the cost of the underlying OEP protocol. OEP can be instantiated using a singly homomorphic encryption or any general-purpose MPC but we introduce a new construction that we show is significantly more efficient than these alternatives, in practice. The main building block in our OEP construction is an efficient protocol for \\emph{oblivious switching network evaluation} (OSN), a generalization of the previously studied oblivious shuffling problem which is of independent interest. Our results noticeably improve efficiency of the previous solutions to oblivious shuffling, yielding a factor of 25 or more gain in computation and communication.