International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) iacr.org. You can also receive updates via:

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

2014-11-14
16:17 [Pub][ePrint] Bicliques with Minimal Data and Time Complexity for AES (Extended Version $\\star$), by Andrey Bogdanov and Donghoon Chang and Mohona Ghosh and Somitra Kumar Sanadhya

  Biclique cryptanalysis is a recent technique that has been successfully applied to AES resulting in key recovery faster than brute force. However, a major hurdle in carrying out biclique cryptanalysis on AES is that it requires very high data complexity. This naturally warrants questions over the practical feasibility of

implementing biclique attack in the real world. In Crypto\'13, Canteaut et al. proposed biclique attack where the data complexity of the attack was reduced to a single plaintext-ciphertext pair. However, no application of the same on AES was suggested.

In this paper, we re-evaluate the security-bound of full round AES against biclique attack. Under some reasonable

restrictions, we exhaustively analyze the most promising class of biclique cryptanalysis as applied to AES through a computer-assisted search and find optimal attacks towards lowest computational and data

complexities:

- Among attacks with the minimal data complexity of the unicity distance, the ones with computational

complexity $2^{126.67}$ (for AES-128), $2^{190.9}$ (for AES-192) and $2^{255}$ (for AES-256) are the fastest. Each attack just requires 2 (for AES-128 and AES-192) or 3 (for AES-256) known plaintexts for success probability 1. We obtain these results using the improved biclique attack proposed in Crypto\'13.

- Among attacks with data complexity less than the full codebook, for AES-128, the ones of computational complexity $2^{126.16}$ are the fastest. Within these, the one with data complexity $2^{64}$ requires the smallest amount of data. Thus, the original attack (with data complexity $2^{88}$) did not have the optimal data complexity for AES-128. Similar findings are observed for AES-192 as well (data complexity $2^{48}$ as against $2^{80}$ in the original attack). For AES-256, we find an attack that has a lower computational complexity of $2^{254.31}$ as compared to the original attack complexity of $2^{254.42}$.

- Among all attacks covered, the ones of computational complexity $2^{125.56}$ (for AES-128), $2^{189.51}$ (for AES-192) and $2^{253.87}$ (for AES-256) are fastest, though requiring the full codebook. This can be considered as an indication of the limitations of the independent-biclique attack approach as applied to AES.



16:17 [Pub][ePrint] Certificateless Proxy Re-Encryption Without Pairing, by Akshayaram Srinivasan and C. Pandu Rangan

  Proxy Re-Encryption was introduced by Blaze, Bleumer and Strauss to efficiently solve the problem of delegation of decryption rights. In proxy re-encryption, a semi-honest proxy transforms a ciphertext intended for Alice to a ciphertext of the same message for Bob without learning anything about the underlying message. From its introduction, several proxy re-encryption schemes in the Public Key Infrastructure (PKI) and Identity (ID) based setting have been proposed. In practice, systems in the public key infrastructure suffer from the certificate management problem and those in identity based setting suffer from the key escrow problem. Certificateless Proxy Re-encryption schemes enjoy the advantages provided by ID-based constructions without suffering from the key escrow problem.

In this work, we construct the first unidirectional, single-hop CCA-secure certificateless proxy re-encryption scheme without pairing by extending the PKI based construction of Chow et al. proposed in 2010. We prove its security in the random oracle model under the Computational Diffie-Hellman (CDH) assumption. Prior to this work, the only secure certificateless proxy re-encryption scheme is due to Guo et al. proposed in 2013 using bilinear pairing. The construction proposed in this work is more efficient than that system and satisfies stronger security properties. We also show that the recently proposed construction of Yang et al. is insecure with respect to the security model considered in this work.



16:17 [Pub][ePrint] Efficient Generic Zero-Knowledge Proofs from Commitments, by Samuel Ranellucci and Alain Tapp and Rasmus Winther Zakarias

  Even though Zero-knowledge has existed for more than 30

years, few generic constructions for Zero-knowledge exist. In this paper

we present a new kind of commitment scheme on which we build a novel

and efficient Zero-knowledge protocol for circuit satisfiability.





2014-11-13
17:11 [Event][New] Lightweight Cryptography Workshop 2015

  Submission: 1 April 2015
Notification: 15 May 2015
From July 20 to July 21
Location: Gaithersburg, MD, USA
More Information: http://www.nist.gov/itl/csd/ct/lwc_workshop2015.cfm


10:17 [Pub][ePrint] Improved Parameters and an Implementation of Graded Encoding Schemes from Ideal Lattices, by Martin R. Albrecht and Catalin Cocis and Fabien Laguillaumie and Adeline Langlois

  We discuss how to set parameters for GGH-like graded encoding schemes approximating cryptographic multilinear maps from ideal lattices and propose a strategy which reduces parameter sizes for concrete instances. Secondly, we discuss a first software implementation of a graded encoding scheme based on GGHLite, an improved variant of Garg, Gentry and Halevi\'s construction (GGH) due to Langlois, Stehlé and Steinfeld. Thirdly, we provide an implementation of non-interactive $N$-partite Diffie-Hellman key exchange. We discuss our implementation strategies and show that our implementation outperforms previous work.



10:17 [Pub][ePrint] Zeroizing without zeroes: Cryptanalyzing multilinear maps without encodings of zero, by Craig Gentry and Shai Halevi and Hemanta K. Maji and Amit Sahai

  We extend the recent zeroizing attacks of Cheon et al. on multilinear maps to some settings where no encodings of zero below the maximal level are available. Some of the new attacks apply to the CLT scheme (resulting in total break) while others apply to the GGH scheme (resulting in a weak-DL attack).



10:17 [Pub][ePrint] Immunizing Multilinear Maps Against Zeroizing Attacks, by Dan Boneh and David J. Wu and Joe Zimmerman

  In recent work Cheon, Han, Lee, Ryu, and Stehle presented an attack on the multilinear map of Coron, Lepoint, and Tibouchi (CLT). They show that given many low-level encodings of zero, the CLT multilinear map can be completely broken, recovering the secret factorization of the CLT modulus. The attack is a generalization of the \"zeroizing\" attack of Garg, Gentry, and Halevi.

We first strengthen the attack of Cheon, Han, Lee, Ryu, and Stehle by showing that CLT can be broken even without low-level encodings of zero. This strengthening is sufficient to show that the subgroup elimination assumption does not hold for the CLT multilinear map.

We then present a generic defense against this type of \"zeroizing\" attack. For an arbitrary asymmetric composite-order multilinear map (including CLT), we give a functionality-preserving transformation that ensures that no sequence of map operations will produce valid encodings (below the zero-testing level) whose product is zero. We prove security of our transformation in a generic model of composite-order multilinear maps. Our new transformation rules out \"zeroizing\" leaving no currently known attacks on the decision linear assumption, subgroup elimination assumption, and other related problems for the CLT multilinear map. Of course, in time, it is possible that different attacks on CLT will emerge.





2014-11-12
10:17 [Pub][ePrint] Physical functions : the common factor of side-channel and fault attacks ?, by Bruno Robisson and Hélène Le Bouder

  Security is a key component for information technologies and

communication. Among the security threats, a very important one is

certainly due to vulnerabilities of the integrated circuits that implement

cryptographic algorithms. These electronic devices (such as smartcards)

could fall into the hands of malicious people and then could be sub-

ject to \\physical attacks\". These attacks are generally classied into two

categories : fault and side-channel attacks. One of the main challenges

to secure circuits against such attacks is to propose methods and tools

to estimate as soundly as possible, the eciency of protections. Numer-

ous works attend to provide tools based on sound statistical techniques

but, to our knowledge, only address side-channel attacks. In this article,

a formal link between fault and side-channel attacks is presented. The

common factor between them is what we called the \'physical\' function

which is an extension of the concept of \'leakage function\' widely used

in side-channel community. We think that our work could make possible

the re-use (certainly modulo some adjustments) for fault attacks of the

strong theoretical background developed for side-channel attacks. This

work could also make easier the combination of side-channel and fault

attacks and thus, certainly could facilitate the discovery of new attack

paths. But more importantly, the notion of physical functions opens from

now new challenges about estimating the protection of circuits.



03:52 [Event][New] WiSec 2015: 8th ACM Conference on Security and Privacy in Wireless and Mobile Networks

  Submission: 17 February 2015
Notification: 7 April 2015
From June 22 to June 26
Location: New York City, NY, USA
More Information: http://www.sigsac.org/wisec/WiSec2015/




2014-11-11
17:50 [Event][New] FSP 2015: The 2015 International Workshop on Future Security and Privacy

  Submission: 28 November 2014
From January 26 to January 28
Location: Jeju, Korea
More Information: http://www.platcon.org/workshops/fsp-14


13:17 [Pub][ePrint] Differential Analysis of Block Ciphers SIMON and SPECK, by Alex Biryukov and Arnab Roy and Vesselin Velichkov

  In this paper we continue the previous line of research on the analysis of the differential properties of the lightweight block ciphers Simon and Speck. We apply a recently proposed technique

for automatic search for differential trails in ARX ciphers and improve the trails in Simon32 and Simon48 previously reported as best. We further extend the search technique for the case of differen-

tials and improve the best previously reported differentials on Simon32, Simon48 and Simon64 by exploiting more effectively the strong differential effect of the cipher. We also present improved trails and differentials on Speck32, Speck48 and Speck64. Using these new results we improve the currently best known attacks on several versions of Simon and Speck. A second major contribution of the paper

is a graph based algorithm (linear time) for the computation of the exact differential probability of the main building block of Simon: an AND operation preceded by two bitwise shift operations. This gives

us a better insight into the differential property of the Simon round function and differential effect in the cipher. Our algorithm is general and works for any rotation constants. The presented techniques

are generic and are therefore applicable to a broader class of ARX designs.