International Association for Cryptologic Research

# IACR News Central

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

2014-11-10
07:17 [Pub][ePrint]

In a functional encryption (FE) scheme, the owner of the secret key can generate restricted decryption keys that allow users to learn specific functions of the encrypted messages and nothing else. In many known constructions of FE schemes, such a notion of security is guaranteed only for messages that are fixed ahead of time (i.e., before the adversary even interacts with the system). This is called selective security, which is too restrictive for many realistic applications. Achieving adaptive security (also called full security), where security is guaranteed even for messages that are adaptively chosen at any point in time, seems significantly more challenging. The handful of known fully-secure schemes are based on specifically tailored techniques that rely on strong assumptions (such as obfuscation assumptions or multilinear maps assumptions).

In this paper we show that any sufficiently expressive selectively-secure FE scheme can be transformed into a fully secure one without introducing any additional assumptions. We present a direct black-box transformation, making novel use of hybrid encryption, a classical technique that was originally introduced for improving the efficiency of encryption schemes, combined with a new technique we call the Trojan Method. This method allows to embed a secret execution thread in the functional keys of the underlying scheme, which will only be activated within the proof of security of the resulting scheme.As another application of the Trojan Method, we show how to construct functional encryption schemes for arbitrary circuits starting from ones for shallow circuits (NC1 or even TC0).

07:17 [Pub][ePrint]

We propose a public-key authentication and encryption application that secures the messages between Tap-Card-Pay application, Tap-Card-Pay Systems Corporation, customers, and merchants allowing the customer to complete transactions without requiring the customer to input sensitive information. With authentication and encryption, the application transfers the credit card information from the smartphone\'s near field communication device onto the merchant webpage. Security weaknesses are also presented to show how to attack this design.

07:17 [Pub][ePrint]

We experiment with the block cipher proposed by Hoang, Morris, and Rogaway. The cipher is based on swap-or-not shuffle, and we call it the Shuffle Block Cipher. We show how the cipher can be translated into SMT-LIB v2 format, suitable for automated solving by SMT solvers. We compare performance of various SMT solvers on the encryption and known plaintext attack problems. Simple cryptanalysis of the Shuffle Block Cipher with artificially small parameters indicate that this approach cannot be used to attack \"real instances\" of the cipher.

07:17 [Pub][ePrint]

Rank estimation algorithms allow analyzing the computational security of cryptographic keys for which adversaries have obtained partial information thanks to leakage or cryptanalysis. They are particularly useful in side-channel security evaluations, where the key is known by the evaluator but not reachable with exhaustive search. A first instance of such algorithms has been proposed at Eurocrypt 2013. In this paper, we propose a new tool for rank estimation that is conceptually simpler and much more efficient than this previous proposal. It allows approximating the key rank of (128-bit, 256-bit) symmetric keys with very tight bounds (i.e. with less than one bit of error), almost instantaneously and with limited memory. It also scales nicely to larger (e.g. asymmetric) key sizes, for which the previous algorithm was hardly applicable.

07:17 [Pub][ePrint]

This paper shows, assuming standard heuristics regarding the number-field sieve, that a \"batch NFS\" circuit of area L^{1.181...+o(1)} factors L^{0.5+o(1)} separate B-bit RSA keys in time L^{1.022...+o(1)}. Here L=exp((log 2^B)^{1/3}(log log 2^B)^{2/3}). The circuit\'s area-time product (price-performance ratio) is just L^{1.704...+o(1)} per key. For comparison, the best area-time product known for a single key is L^{1.976...+o(1)}.

This paper also introduces new \"early-abort\" heuristics implying that \"early-abort ECM\" improves the performance of batch NFS by a superpolynomial factor, specifically exp((c+o(1))(log 2^B)^{1/6}(log log 2^B)^{5/6}) where c is a positive constant.

2014-11-07
20:58 [Event][New]

Submission: 9 February 2015
From June 30 to July 1
Location: Brisbane, Australia

17:32 [Job][New]

i_SW is looking for a Staff Scientist with a background in mathematics and cryptography to support a DARPA program focused on program obfuscation to protect DoD assets. Candidate will provide Scientific, Engineering and Technical Assistance (SETA) support to assist in the management and evaluation of the research underlying this effort. Candidate should have experience planning and developing technical projects of a research and development (R&D) nature, concerned with unique or controversial problems which have an important effect on major Department of Defense programs.

This work will be collaborative with DARPA and i_SW corporation located in Arlington, VA

Required Skills

• Demonstrated skill in successfully performing technical assignments including conducting research in problem areas of considerable scope and complexity requiring unconventional or novel approaches and sophisticated research techniques, risk analysis and resolution, tracking technical milestones, and report preparations

• Research focus on the theoretical sides of cryptography

• Demonstrated skill in conceiving, planning, and conducting research in problem areas of considerable scope and complexity requiring unconventional or novel approaches and sophisticated research techniques.

• Demonstrated the ability to independently conduct the appropriate analyses to offer recommendations, solutions, and alternatives to resolve R&D issues, concerns, problems, or methods.

Applicants must be US Citizens in order to obtain security clearances.

Education

MS/PhD Math or Computer Science

Some post-graduate work in mathematics and cryptography preferred.

2014-11-06
19:17 [Pub][ePrint]

We construct new leakage-resilient signature schemes.

Our schemes remain unforgeable against an adversary leaking arbitrary (yet bounded) information on the entire state of the signer (sometimes known as fully leakage resilience).

The main feature of our constructions, is that they offer a graceful degradation of security in situations where standard existential unforgeability is impossible. This property was recently put forward by Nielsen et al. (PKC 2014) to deal with settings in which the secret key is much larger than the size of a signature.

One remarkable such case is the so-called Bounded Retrieval Model (BRM), where one intentionally inflates the size of the secret key while keeping constant the signature size and the computational complexity of the scheme.

Our main constructions have leakage rate 1-o(1), and are proven secure in the standard model. We additionally give a construction in the BRM, relying on a random oracle.

All of our schemes are described in terms of generic building blocks, but also admit efficient instantiations under fairly standard number-theoretic assumptions.

Finally, we explain how to extend some of our schemes to the setting of noisy leakage, where the only restriction on the leakage functions is that the output does not decrease the min-entropy of the secret key by too much.

19:17 [Pub][ePrint]

There is a large body of work on using noisy communication channels for realizing different cryptographic tasks. In particular, it is known that secure message transmission can be achieved unconditionally using only {\\em one-way} communication from the sender to the receiver. In contrast, known solutions for more general secure computation tasks inherently require interaction, even when the entire input originates from the sender.

We initiate a general study of cryptographic protocols over noisy channels in a setting where only one party speaks. In this setting, we show that the landscape of what a channel is useful for is much richer. Concretely, we obtain the following results.

[-] Relationships between channels. The binary erasure channel (BEC) and the binary symmetric channel (BSC), which are known to be securely reducible to each other in the interactive setting, turn out to be qualitatively different in the setting of one-way communication. In particular, a BEC cannot be implemented from a BSC, and while the erasure probability of a BEC can be manipulated in both directions, the crossover probability of a BSC can only be manipulated in one direction.

[-] Zero-knowledge proofs and secure computation of deterministic functions. One-way communication over BEC or BSC is sufficient for securely realizing any deterministic (possibly reactive) functionality which takes its inputs from a sender and delivers its outputs to a receiver. This provides the first truly non-interactive solutions to the problem of zero-knowledge proofs.

[-] Secure computation of randomized functions. One-way communication over BEC or BSC {\\em cannot} be used for realizing general randomized functionalities which take input from a sender and deliver output to a receiver. On the other hand, one-way communication over other natural channels, such as bursty erasure channels, can be used to realize such functionalities. This type of protocols can be used for distributing certified cryptographic keys without revealing the keys to the certification authority.

19:17 [Pub][ePrint]

At Asiacrypt 2014, Hanser and Slamanig presented a structure-preserving signatures and prove its EUF-CMA security. Very recently,

Fuchsbauer gave a very surprising attack to point out their claim is flawed by showing how to generate a valid existential forgery with overwhelming probability with 4 chosen-message queries for $l=2$. However, we go further in this paper to show that the Hanser-Slamanig signature scheme is not unforgeable under the adaptive chosen message attack. We present a deterministic polynomial-time chosen-message attack which can forge the valid signature for any message with 3 ({\\it resp.} 4) chosen-message queries for $l=2$ ({\\it resp.} $l\\geq 3$ ).

19:17 [Pub][ePrint]

In a homomorphic signature scheme, given the public key and a vector of signatures $\\vec{\\sigma}:= (\\sigma_1, \\ldots, \\sigma_l)$ over $l$ messages $\\vec{\\mu}:= (\\mu_1, \\ldots, \\mu_l)$, there exists an efficient algorithm to produce a signature $\\sigma\'$ for $\\mu = f(\\vec{\\mu})$. Given the tuple $(\\sigma\', \\mu, f)$, anyone can then publicly verify the validity of the signature $\\sigma\'$.

Inspired by the recent (selectively secure) key-homomorphic functional encryption for circuits, recent works propose fully homomorphic signature schemes in the selective security model.

However, in order to gain adaptive security, one must rely on generic complexity leveraging, which is not only very inefficient but also leads to reductions that are unfalsifiable\'\'.

In this paper, we construct the first \\emph{adaptively secure} homomorphic signature scheme that can evaluate any circuit over signed data. For {\\it poly-logarithmic depth} circuits, our scheme achieves adaptive security under the standard {\\it Small Integer Solution} (SIS) assumption. For {\\it polynomial depth} circuits, the security of our scheme relies on sub-exponential SIS --- but unlike complexity leveraging, the security loss in our reduction depends only on circuit depth and on neither message length nor dataset size.