*16:17* [Pub][ePrint]
Honey Encryption: Security Beyond the Brute-Force Bound, by Ari Juels and Thomas Ristenpart
We introduce {\\em honey encryption} (HE), a simple, general approach to encrypting messages using low min-entropy keys such as passwords. HE is designed to produce a ciphertext which, when decrypted with any of a number of {\\em incorrect} keys, yields plausible-looking but bogus plaintexts called {\\em honey messages}. A key benefit of HE is that it provides security in cases where too little entropy is available to withstand brute-force attacks that try every key; in this sense, HE provides security beyond conventional brute-force bounds. HE can also provide a hedge against partial disclosure of high min-entropy keys. HE significantly improves security in a number of practical settings. To showcase this improvement, we build concrete HE schemes for password-based encryption of RSA secret keys and credit card numbers. The key challenges are development of appropriate instances of a new type of randomized message encoding scheme called a {\\em distribution-transforming encoder} (DTE), and analyses of the expected maximum loading of bins in various kinds of balls-and-bins games.

*01:17* [Pub][ePrint]
On the Effective Prevention of TLS Man-In-The-Middle Attacks in Web Applications, by Nikolaos Karapanos and Srdjan Capkun
In this paper we consider TLS MITM attacks in the context of web applications, where the attacker\'s goal is to impersonate the user to the legitimate server, and thus gain access to the user\'s online account. We describe in detail why the recently proposed TLS Channel ID-based client authentication, as well as client web authentication in general, cannot fully prevent such attacks. We then leverage TLS Channel ID-based authentication and combine it with the concept of sender invariance to create a novel mechanism that we call SISCA: Server Invariance with Strong Client Authentication. SISCA resists user impersonation via TLS MITM attacks even if the attacker has obtained the private key of the legitimate server. We analyze our proposal and show how it can be integrated in today\'s web infrastructure.

*22:17* [Pub][ePrint]
The Multiple Number Field Sieve for Medium and High Characteristic Finite Fields, by Razvan Barbulescu and Cécile Pierrot
In this paper, we study the discrete logarithm problem in medium andhigh characteristic finite fields. We propose a variant of the Number Field Sieve (NFS) based on numerous number fields. Our improved algorithm computes discrete logarithms in $\\mathbb{F}_{p^n}$ for the whole range of applicability of NFS and lowers the asymptotic complexity from $L_{p^n}(1/3, (128/9)^{1/3})$ to $L_{p^n}(1/3, (2^{13} /3^6)^{1/3})$ in the medium characteristic case, and from $L_{p^n} (1/3, (64/9)^{1/3})$ to $L_{p^n}(1/3,((92 + 26\\sqrt{13})/27))^{1/3})$ in the high characteristic case.

*22:17* [Pub][ePrint]
Outsourcing Private RAM Computation, by Craig Gentry and Shai Halevi and Mariana Raykova and Daniel Wichs
We construct the first schemes that allow a client to privately outsource arbitrary program executions to a remote server while ensuring that: (I) the client\'s work is small and essentially independent of the complexity of the computation being outsourced, and (II) the server\'s work is only proportional to the run-time of the computation on a random access machine (RAM), rather than its potentially much larger circuit size. Furthermore, our solutions are non-interactive and have the structure of reusable garbled RAM programs, addressing an open question of Lu and Ostrovsky (Eurocrypt 2013). We also construct schemes for an augmented variant of the above scenario, where the client can initially outsource a large private and persistent database to the server, and later outsource arbitrary program executions with read/write access to this database.Our solutions are built from non-reusable garbled RAM in conjunction with new types of reusable garbled circuits that are more efficient than prior solutions but only satisfy weaker security. For the basic setting without a persistent database, we can instantiate the required reusable garbled circuits using indistinguishability obfuscation. For the more complex setting with a persistent database we need stronger notions of obfuscation. Our basic solution also requires the client to perform a one-time preprocessing step to garble a program at the cost of its RAM run-time, and we can avoid this cost using stronger notions of obfuscation. It remains an open problem to instantiate these new types of reusable garbled circuits under weaker assumptions, possibly avoiding obfuscation altogether.

*04:17* [Pub][ePrint]
Statistical Concurrent Non-Malleable Zero Knowledge, by Claudio Orlandi and Rafail Ostrovsky and Vanishree Rao and Amit Sahai and Ivan Visconti
The notion of Zero Knowledge introduced by Goldwasser, Micali, and Rackoff in STOC 1985 is fundamental in Cryptography. Motivated by conceptual and practical reasons, this notion has been explored under stronger definitions. We will consider the following two main strengthened notions.-- Statistical Zero Knowledge: here the zero-knowledge property will last forever, even in case in future the adversary will have unlimited power.

-- Concurrent Non-Malleable Zero Knowledge: here the zero-knowledge property is combined with non-transferability and the adversary fails in mounting a concurrent man-in-the-middle attack aiming at transferring zero-knowledge proofs/arguments.

Besides the well-known importance of both notions, it is still unknown whether one can design a zero-knowledge protocol that satisfies both notions simultaneously.

In this work we shed light on this question in a very strong sense. We show a {\\em statistical concurrent non-malleable} zero-knowledge argument system for NP with a {\\em black-box} simulator-extractor.