International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) You can also receive updates via:

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

21:17 [Pub][ePrint] Security in $O(2^n)$ for the Xor of Two Random Permutations\\\\ -- Proof with the standard $H$ technique--, by Jacques Patarin

  Xoring two permutations is a very simple way to construct pseudorandom functions from pseudorandom permutations. In~\\cite{P08a}, it is proved that we have security against CPA-2 attacks when $m \\ll O(2^n)$, where $m$ is the number of queries and $n$ is the number of bits of the inputs

and outputs of the bijections. In this paper, we will obtain similar (but slightly different) results by using the

``standard H technique\'\' instead of the ``$H_{\\sigma}$ technique\'\'. It will be interesting to

compare the two techniques, their similarities and the differences between the proofs and the


20:44 [PhD][New] Martin M. Lauridsen: Lightweight Cryptography

  Name: Martin M. Lauridsen
Topic: Lightweight Cryptography
Category: secret-key cryptography

20:43 [PhD][New] Hao Chen

  Name: Hao Chen

20:42 [PhD][New] Christian Rechberger

  Name: Christian Rechberger

18:55 [Job][New] 1 post-doc and 2 PhD posotions , University of Luxembourg

  PhD and Post-doc Positions in Computer Security

The University of Luxembourg in collaboration with the Luxembourg Government (CTIE) will start a new research project “Supporting e-Democracy” for which we have two PhD candidates and one Research Associate (post-doc) positions available. The positions are within the APSIA (Applied Security and Information Assurance) ( research group led by Prof. Dr. P.Y. Ryan.

The successful candidates will be working in an exciting, international and multicultural environment in the heart of Europe.

Project Description

The successful candidates will be working within the research project “Supporting e-Democracy”, collaboration between the University of Luxembourg and the Luxembourg Government (CTIE).

The research will focus on (a) design and security analysis of accurate and robust communication systems in specific electoral systems (b) design of reliable and secure computer assisted counting of paper ballots, (c) design and analysis of verifiable, computer assisted voting systems and a broader e-democracy platform.

Candidates Profile

The candidates are expected to have:

• A previous degree in computer science or related subject;

• A proven (theoretical and practical) interest in security;

• Knowledge of Network and System security;

• Fluent written and oral English skills;


The candidates must apply online at the following addresses:

PhD positions (open until July 31st, 2013):

Research Associate position (open until June 20th, 2013):

For further inquiries, please contact Prof. Dr. Peter Y. A. Ryan

15:17 [Pub][ePrint] Ideal-Cipher (Ir)reducibility for Blockcipher-Based Hash Functions, by Paul Baecher and Pooya Farshim and Marc Fischlin and Martijn Stam

  Preneel et al.~(Crypto 1993) assessed 64 possible ways to construct a compression function out of a blockcipher. They conjectured that 12 out of these 64 so-called PGV constructions achieve optimal security bounds for collision resistance and preimage resistance. This was proven by Black et al.~(Journal of Cryptology, 2010), if one assumes that the blockcipher is ideal. This result, however, does not apply to ``non-ideal\'\' blockciphers such as AES. To alleviate this problem, we revisit the PGV constructions in light of the recently proposed idea of random-oracle reducibility (Baecher and Fischlin, Crypto 2011). We say that the blockcipher in one of the 12 secure PGV constructions reduces to the one in another construction, if \\emph{any} secure instantiation of the cipher, ideal or not, for one construction also makes the other secure. This notion allows us to relate the underlying assumptions on blockciphers in different constructions, and show that the requirements on the blockcipher for one case are not more demanding than those for the other. It turns out that this approach divides the 12 secure constructions into two groups of equal size, where within each group a blockcipher making one construction secure also makes all others secure. Across the groups this is provably not the case, showing that the sets of ``good\'\' blockciphers for each group are qualitatively distinct. We also relate the ideal ciphers in the PGV constructions with those in double-block-length hash functions such as Tandem-DM, Abreast-DM, and Hirose-DM. Here, our results show that, besides achieving better bounds, the double-block-length hash functions rely on weaker assumptions on the blockciphers to achieve collision and everywhere preimage resistance.

15:17 [Pub][ePrint] Time-Optimal Interactive Proofs for Circuit Evaluation, by Justin Thaler

  Several research teams have recently been working toward the development of practical general-purpose protocols for verifiable computation. These protocols enable a computationally weak verifier to offload computations to a powerful but untrusted prover, while providing the verifier with a guarantee that the prover performed the requested computations correctly. Despite substantial progress, existing implementations require further improvements before they become practical for most settings. The main bottleneck is typically the extra effort required by the prover to return an answer with a guarantee of correctness, compared to returning an answer with no guarantee.

We describe a refinement of a powerful interactive proof protocol due to Goldwasser, Kalai, and Rothblum. Cormode, Mitzenmacher, and Thaler show how to implement the prover in this protocol in time $O(S \\log S)$, where $S$ is the size of an arithmetic circuit computing the function of interest. Our refinements apply to circuits with sufficiently ``regular\'\' wiring patterns; for these circuits, we bring the runtime of the prover down to $O(S)$. That is, our prover can evaluate the circuit with a guarantee of correctness, with only a constant-factor blowup in work compared to evaluating the circuit with no guarantee.

We argue that our refinements capture a large class of circuits, and we complement our theoretical results with experiments on problems such as matrix multiplication and determining the number of distinct elements in a data stream. Experimentally, our refinements yield a 200x speedup for the prover over the implementation of Cormode et al., and our prover is less than 10x slower than a C++ program that simply evaluates the circuit. Along the way, we describe a special-purpose protocol for matrix multiplication that is of interest in its own right.

Our final contribution is the design of an interactive proof protocol targeted at general data parallel computation. Compared to prior work, this protocol can more efficiently verify complicated computations as long as that computation is applied independently to many different pieces of data.

15:17 [Pub][ePrint] Constrained Pseudorandom Functions and Their Applications, by Dan Boneh and Brent Waters

  We put forward a new notion of pseudorandom functions (PRFs) we call

constrained PRFs. In a standard PRF there is a master key k that enables one to evaluate the function at all points in the domain of the

function. In a constrained PRF it is possible to derive constrained keys kS from the master key k. A constrained key kS enables the

evaluation of the PRF at a certain subset S of the domain and

nowhere else. We present a formal framework for this concept and show

that constrained PRFs can be used to construct powerful primitives such as identity-based key exchange and an optimal private broadcast

encryption system. We then construct constrained PRFs for several natural set systems needed for these applications. We conclude with several open problems relating to this new concept.

15:17 [Pub][ePrint] Profiling DPA: Efficacy and efficiency trade-offs, by Carolyn Whitnall and Elisabeth Oswald

  Linear regression-based methods have been proposed as efficient means of characterising device leakage in the training phases of profiled side-channel attacks. Empirical comparisons between these and the `classical\' approach to template building have confirmed the reduction in profiling complexity to achieve the same attack-phase success, but have focused on a narrow range of leakage scenarios which are especially favourable to simple (i.e.\\ efficiently estimated) model specifications. In this contribution we evaluate---from a theoretic perspective as much as possible---the performance of linear regression-based templating in a variety of realistic leakage scenarios as the complexity of the model specification varies. We are particularly interested in complexity trade-offs between the number of training samples needed for profiling and the number of attack samples needed for successful DPA: over-simplified models will be cheaper to estimate but DPA using such a degraded model will require more data to recover the key. However, they can still offer substantial improvements over non-profiling strategies relying on the Hamming weight power model, and so represent a meaningful middle-ground between `no\' prior information and `full\' prior information.

15:17 [Pub][ePrint] Programmable Hash Functions in the Multilinear Setting, by Eduarda S.V. Freire and Dennis Hofheinz and Kenneth G. Paterson and Christoph Striecks

  We adapt the concept of a programmable hash function (PHF, Crypto 2008) to a setting in which a multilinear map is available. This enables new PHFs with previously unachieved parameters.

To demonstrate their usefulness, we show how our (standard-model) PHFs can replace random oracles in several well-known cryptographic constructions. Namely, we obtain standard-model versions of the Boneh-Franklin identity-based encryption scheme, the Boneh-Lynn-Shacham signature scheme, and the Sakai-Ohgishi-Kasahara identity-based non-interactive key exchange (ID-NIKE) scheme. The ID-NIKE scheme is the first scheme of its kind in the standard model.

Our abstraction also allows to derive hierarchical versions of the above schemes in settings with multilinear maps. This in particular yields simple and efficient hierarchical generalizations of the BF, BLS, and SOK schemes. In the case of hierarchical ID-NIKE, ours is the first such scheme with full security, in either the random oracle model or the standard model.

While our constructions are formulated with respect to a generic multilinear map, we also outline the necessary adaptations required for the recent ``noisy\'\' multilinear map candidate due to Garg, Gentry, and Halevi.

15:17 [Pub][ePrint] New Attacks against Transformation-Based Privacy-Preserving Linear Programming, by Peeter Laud and Alisa Pankova

  In this paper we demonstrate a number of attacks against proposed protocols for privacy-preserving linear programming, based on publishing and solving a transformed version of the problem instance. Our attacks exploit the geometric structure of the problem, which has

mostly been overlooked in the previous analyses and is largely preserved by the proposed transformations. The attacks are efficient in practice and cast serious doubt to the viability of transformation-based approaches in general.