*12:17* [Pub][ePrint]
Tradeoff Cryptanalysis of Memory-Hard Functions, by Alex Biryukov and Dmitry Khovratovich
We explore time-memory and other tradeoffs for memory-hard functions, which are supposed to impose significant computational and time penalties if less memory is used than intended. We analyze two schemes: Catena, which has been presented at Asiacrypt 2014, and Lyra2, the fastest finalist of the Password Hashing Competition (PHC).

We demonstrate that Catena\'s proof of tradeoff resilience is flawed, and attack it with a novel \\emph{precomputation tradeoff}. We show that using $M^{2/3}$ memory instead of $M$ we may have no time penalties. We further generalize our method for a wide class of schemes with predictable memory access.

For Lyra2, which addresses memory unpredictability (depending on the input), we develop a novel \\emph{ranking tradeoff} and show how to decrease the time-memory and the time-area product by significant factors. We also generalize the ranking method for a wide class of schemes with unpredictable memory access.

*12:17* [Pub][ePrint]
Leakage-Resilient Cryptography with Key Derived from Sensitive Data, by Konrad Durnoga and Tomasz Kazana and Michał Zając and Maciej Zdanowicz
In this paper we address the problem of large space consumption for protocols in the Bounded Retrieval Model (BRM), which require users to store large secret keys subject to adversarial leakage.We propose a method to derive keys for such protocols on-the-fly from weakly random private data (like text documents or photos, users keep on their disks anyway for non-cryptographic purposes) in such a way that no extra storage is needed. We prove that any leakage-resilient protocol (belonging to a certain, arguably quite broad class) when run with a key obtained this way retains a similar level of security as the original protocol had. Additionally, we guarantee privacy of the data the actual keys are derived from. That is, an adversary can hardly gain any knowledge about the private data except that he could otherwise obtain via leakage. Our reduction works in the Random Oracle model.

As an important tool in the proof we use a newly established bound for min-entropy, which can be of independent interest. It may be viewed as an analogue of the chain rule -- a weaker form of the well-known formula $\\mathbf{H}(X \\vert Y) = \\mathbf{H}(X, Y) - \\mathbf{H}(Y)$ for random variables $X$, $Y$, and Shannon entropy, which our result originates from. For min-entropy only a much more limited version of this relation is known to hold. Namely, the min-entropy of $X$ may decrease by up to the bitlength of $Y$ when $X$ is conditioned on $Y$, in short: $\\widetilde{\\mathbf{H}(X \\vert Y) \\geq \\mathbf{H}_\\infty(X) - \\lvert Y\\rvert$.

In many cases this inequality does not offer tight bounds, and such significant entropy loss makes it inadequate for our particular application. In the quasi chain rule we propose, we inject some carefully crafted side information (spoiling knowledge) to show that with large probability the average min-entropy of $X$ conditioned on both: $Y$ and this side information can be almost lower bounded by the min-entropy of $(X, Y)$ decreased by the min-entropy of $Y$ conditioned on the side information.

*22:31* [Job][New]
Ph.D. student - PUF design and security, *Laboratoire Hubert Curien, University of Lyon, Saint-Etienne, France*
The main objective of the research in the group Applied Cryptography & Telecom is to propose efficient and robust hardware architectures aimed at applied cryptography and telecom that are resistant to passive and active cryptographic attacks. Currently, the central theme of this research consists in designing architectures for Secure Embedded Systems implemented in logic devices such as FPGAs and ASICs. More information on http://laboratoirehubertcurien.fr/spip.php?rubrique29The PhD thesis will take part of the European H2020 Project HECTOR (Hardware Enabled CrypTOgraphy and Randomness) aims at bridging the gap between the mathematics of cryptography with the reality of hardware implementations. HECTOR consortium: Technickon (Austria), KU Leuven (Belgium), Univ. Jean Monnet St-Etienne (France), TU Graz (Austria), THALES Comm. & Security SAS (France), STMicroelectronics Rousset SAS (France), STMicroelectronics SRL (Italia), Brighstsight (Netherlands), Micronic (Slovakia).

Objective of this thesis is to propose a set of tools that would allow simplifying physical unclonable functions (PUFs) design and security assessment.

We are looking for candidates with an outstanding Master in electrical engineering. Strong knowledge in VLSI design, FPGA & ASIC design are required. A first experience with PUF or TRNG design would be also appreciated. Notions of stochastic modelling will be a bonus. Skills in oral presentation and scientific writing in English are required (French is not required but recommended).

The PhD position will start before October 2015, it is funded for 36 months.

*21:17* [Pub][ePrint]
Key Homomorphic PRFs and Their Applications, by Dan Boneh and Kevin Lewi and Hart Montgomery and Ananth Raghunathan
A pseudorandom function F : K x X -> Y is said to be key homomorphic if given F(k1, x) and F(k2, x) there is an efficient algorithm to compute F(k1 xor k2, x), where xor denotes a groupoperation on k1 and k2 such as xor. Key homomorphic PRFs are natural objects to study and have a number of interesting applications: they can simplify the process of rotating encryption keys for encrypted data stored in the cloud, they give one round distributed PRFs, and they can be the basis of a symmetric-key proxy re-encryption scheme. Until now all known constructions

for key homomorphic PRFs were only proven secure in the random oracle model. We construct the first provably secure key homomorphic PRFs in the standard model. Our main construction

is based on the learning with errors (LWE) problem. In the proof of security we need a variant of LWE where query points are non-uniform and we show that this variant is as hard as the standard LWE. We also construct key homomorphic PRFs based on the decision linear assumption in groups with an l-linear map. We leave as an open problem the question of constructing standard model key homomorphic PRFs from more general assumptions.

*21:17* [Pub][ePrint]
Tighter, faster, simpler side-channel security evaluations beyond computing power, by Daniel J. Bernstein and Tanja Lange and Christine van Vredendaal
A Eurocrypt 2013 paper \"Security evaluations beyond computing power: How to analyze side-channel attacks you cannot mount?\" by Veyrat-Charvillon, Gérard, and Standaert proposed a \"Rank Estimation Algorithm\" (REA) to estimate the difficulty of finding a secret key given side-channel information from independent subkeys, such as the 16 key bytes in AES-128 or the 32 key bytes in AES-256. The lower and upper bounds produced by the algorithm are far apart for most key ranks. The algorithm can produce tighter bounds but then becomes exponentially slower; it also becomes exponentially slower as the number of subkeys increases.This paper introduces two better algorithms for the same problem. The first, the \"Extended Rank Estimation Algorithm\" (EREA), is an extension of REA using statistical sampling as a second step to increase the speed of tightening the bounds on the rank. The second, the \"Polynomial Rank Outlining Algorithm\" (PRO), is a new approach to computing the rank. PRO can handle a much larger number of subkeys efficiently, is easy to implement in a computer-algebra system such as Sage, and produces much tighter bounds than REA in less time.

*21:17* [Pub][ePrint]
New Distinguishers for Reduced Round Trivium and Trivia-SC using Cube Testers, by Anubhab Baksi and Subhamoy Maitra and Santanu Sarkar
In this paper we experiment with cube testers on reduced round Trivium that can act as a distinguisher. Using heuristics, we obtain several distinguishers for Trivium running more than 800 rounds (maximum 829) with cube sizes not exceeding 27. In the process, we also exploit state biases that has not been explored before. Further, we apply our techniques to analyse Trivia-SC, a stream cipher proposed by modifying the parameters of Trivium and used as a building block for TriviA-ck (an AEAD scheme, which is submitted to the ongoing CAESARcompetition). We obtain distinguishers till 900 rounds of Trivia-SC with a cube size of 21 only and our results refute certain claims made by the designers. These are the best results reported so far, though our work does not affect the security claims for the ciphers with full initialization rounds, namely 1152.

*21:17* [Pub][ePrint]
Privacy and Access Control for Outsourced Personal Records, by Matteo Maffei and Giulio Malavolta and Manuel Reinert and Dominique Schröder
Cloud storage has rapidly become a cornerstone of many IT infrastructures, constituting a seamless solution for the backup, synchronization, and sharing of large amounts of data. Putting user data in the direct control of cloud service providers, however, raises security and privacy concerns related to the integrity of outsourced data, the accidental or intentional leakage of sensitive information, the profiling of user activities and so on. Furthermore, even if the cloud provider is trusted, users having access to outsourced files might be malicious and misbehave. These concerns are particularly serious in sensitive applications like personal health records and credit score systems.To tackle this problem, we present GORAM, a cryptographic system that protects the secrecy and integrity of outsourced data with respect to both an untrusted server and malicious clients, guarantees the anonymity and unlinkability of accesses to such data, and allows the data owner to share outsourced data with other clients, selectively granting them read and write permissions. GORAM is the first system to achieve such a wide range of security and privacy properties for outsourced storage. In the process of designing an efficient construction, we developed two new, generally applicable cryptographic schemes, namely, batched zero-knowledge proofs of shuffle and an accountability technique based on chameleon signatures, which we consider of independent interest. We implemented GORAM in Amazon Elastic Compute Cloud (EC2) and ran a performance evaluation demonstrating the scalability and efficiency of our construction.

*21:17* [Pub][ePrint]
Bitwise Linear Mappings with Good Cryptographic Properties and Efficient Implementation, by S. M. Dehnavi and A. Mahmoodi Rishakani and M. R. Mirzaee Shamsabad
Linear mappings are crucial components of symmetric ciphers. A special type of linear mappings are(0,1)-matrices which have been used in symmetric ciphers such as ARIA, E2 and Camellia as diffusion

layers with efficient implementation. Bitwise linear maps are also used in symmetric ciphers such as

SHA family of hash functions and HC family of stream ciphers. In this article, we investigate a special

kind of linear mappings: based upon this study, we propose several linear mappings with only XOR and

rotation operations. The corresponding matrices of these mappings can be used in either the former case

as (0,1)-matrices of maximal branch number or in the latter case as linear mappings with good cryptographic

properties. The proposed mappings and their corresponding matrices can be efficiently implemented both

in software and hardware.

*04:47* [Job][New]
• Research Fellow/Postdoctoral Researcher in Applied Crypto, *University of Auckland, Auckland, New Zealand*
The Computer Science department at the University of Auckland seeks a Research Fellow/Postdoctoral Researcher to join the cloud security team led by Dr Giovanni Russello. This research will take place in a new MBIE-funded Cyber Security STRATUS (Security Technologies Returning Accountability, Transparency and User-centric Services to the Cloud) project and will be in collaboration with University of Waikato, UniTech, the Cloud Security Alliance, and several New Zealand-based industrial partners (https://stratus.org.nz). The aim is to research novel yet practical cloud security tools to be adopted by the industry partners.

The research conducted by the University of Auckland’s team will focus on applied cryptography for retrieval and processing of encrypted data in outsourced and untrusted environments. This involves a substantial program of research to develop, implement and apply to industrial case studies.

This is a full time post for a fixed-term of 2 years. Salary starts at 74,000 NZD per annum.

Applicants should have a PhD in computer science in a relevant field (cloud security with emphasis on crypto solutions) a demonstrable research interest in the area of applied crypto with emphasis in homomorphic encryption for encrypted data processing and retrieval focusing on cloud computing, and experience in designing, analysing, and efficiently implement novel crypto algorithms. Previous experience in the area of big data with emphasis on privacy/confidentiality would be advantageous.

Host Institution: The University of Auckland is New Zealand\'s leading university. In the 2013 QS survey, the Computer Science Department ranked 38th. The University of Auckland has a strong international focus and is the only New Zealand member of Universitas 21 and the Association of Pacific Rim Universities - international consortia of research-led universities. Auckland is ranked third out of 221 world citie