International Association for Cryptologic Research

IACR News Central

Get an update on changes of the IACR web-page here. For questions, contact newsletter (at) You can also receive updates via:

To receive your credentials via mail again, please click here.

You can also access the full news archive.

Further sources to find out about changes are CryptoDB, ePrint RSS, ePrint Web, Event calender (iCal).

15:17 [Pub][ePrint] Achieving Compactness Generically: Indistinguishability Obfuscation from Non-Compact Functional Encryption, by Prabhanjan Ananth and Abhishek Jain and Amit Sahai

  We show how to construct indistinguishability obfuscation (iO) for circuits from any non-compact functional encryption (FE) scheme with sub-exponential security against unbounded collusions. We accomplish this by giving a generic transformation from any such FE scheme into a compact FE scheme. By composing this with the transformation from sub-exponentially secure compact FE to iO (Ananth and Jain [CRYPTO\'15], Bitansky and Vaikuntanathan [FOCS\'15]), we obtain our main result.

Our result provides a new pathway to iO. For example, by combining our result with the FE scheme of Garg et al. [ePrint 2014/666], we obtain a new construction of iO based on the sub-exponential GGHZ assumption over composite-order multilinear maps.

We also identify a \"simple\" function family for FE that suffices for our general result. We show that the function family F is complete, where every f in F consists of three evaluations of a Weak PRF followed by finite operations. We believe that this may be useful for realizing iO from weaker assumptions in the future.

15:17 [Pub][ePrint] Same Value Analysis on Edwards Curves, by Rodrigo Abarzúa and Santi Martínez and Valeria Mendoza

  Recently, several research groups in cryptography have presented new elliptic curve model based on Edwards curves.

These new curves were selected for their good performance and security perspectives.

Cryptosystems based on elliptic curves in embedded devices can be vulnerable to Side-Channel Attacks (SCA), such as the Simple Power Analysis (SPA) or the Differential Power Analysis (DPA).

In this paper, we analyze the existence of special points whose use in SCA is known as Same Value Analysis (SVA), for Edwards curves. These special points show up as internal collisions under power analysis. Our results indicate that no Edwards curve is safe from such an attacks.

15:17 [Pub][ePrint] Compact Implementations of LEA Block Cipher for Low-End Microprocessors, by Hwajeong Seo and Zhe Liu and Jongseok Choi and Taehwan Park and and Howon Kim

  In WISA\'13, a novel lightweight block cipher named LEA

was released. This algorithm has certain useful features for hardware

and software implementations, i.e., simple ARX operations, non-S-box

architecture, and 32-bit word size. These features are realized in several

platforms for practical usage with high performance and low overheads.

In this paper, we further improve 128-, 192- and 256-bit LEA encryption

for low-end embedded processors. Firstly we present speed optimization

methods. The methods split a 32-bit word operation into four byte-wise

operations and avoid several rotation operations by taking advantages of

efficient byte-wise rotations. Secondly we reduce the code size to ensure

minimum code size.We nd the minimum inner loops and optimize them

in an instruction set level. After then we construct the whole algorithm

in a partly unrolled fashion with reasonable speed. Finally, we achieved

the fastest LEA implementations, which improves performance by 10.9%

than previous best known results. For size optimization, our implemen-

tation only occupies the 280B to conduct LEA encryption. After scaling,

our implementation achieved the smallest ARX implementations so far,

compared with other state-of-art ARX block ciphers such as SPECK and


15:17 [Pub][ePrint] Fully Homomorphic Encryption on Octonion Ring, by Masahiro Yagisawa

  In previous work(2015/474 in Cryptology ePrint Archive), I proposed a fully homomorphic encryption without bootstrapping which has the weak point in the enciphering function. In this paper I propose the improved fully homomorphic encryption scheme on non-associative octonion ring over finite field without bootstrapping technique. I improve the previous scheme by (1) adopting the enciphering function such that it is difficult to express simply by using the matrices and (2) constructing the composition of the plaintext p with two sub-plaintexts u and v. The improved scheme is immune from the \"p and -p attack\". The improved scheme is based on multivariate algebraic equations with high degree or too many variables while the almost all multivariate cryptosystems proposed until now are based on the quadratic equations avoiding the explosion of the coefficients. The improved scheme is against the Gröbner basis attack.

The key size of this scheme and complexity for enciphering /deciphering become to be small enough to handle.

15:17 [Pub][ePrint] On the Security of Extended Generalized Feistel Networks, by Manoj Kumar and Saibal K. Pal 1 and Anupama Panigrahi

  In this paper, we analyze the security claims of Extended Generalized Feistel Networks (EGFNs) schemes proposed by Berger et al [1]. We provide impossible differentials for 10 rounds of EGFNs with 16 branches which add up one round to the claim of 9 rounds in the impossible differential trail. Therefore, impossible differential trail covers 10 rounds for the EGFNs scheme, which is the best result on impossible differentials of EGFNs so far. We also provide several 10 round impossible differential trails to attack EGFNs based new cipher proposals. 𝒰-method is also used by authors to assert their claim for maximum number of rounds in impossible differential trails of EGFNs. This analysis indicates that 𝒰-method does not provide optimal results for this scheme.

15:17 [Pub][ePrint] Modern Cryptography Through the Lens of Secret Sharing, by Ilan Komargodski and Mark Zhandry

  Secret sharing is a mechanism by which a trusted dealer holding a secret ``splits\'\' the secret into many ``shares\'\' and distributes the shares to a collections of parties. Associated with the sharing is a monotone access structure, that specifies which parties are ``qualified\'\' and which are not: any qualified subset of parties can (efficiently) reconstruct the secret, but no unqualified subset can learn anything about the secret. In the most general form of secret sharing, the access structure can be any monotone NP language.

In this work, we consider two very natural extensions of secret sharing. In the first, which we call distributed secret sharing, there is no trusted dealer at all, and instead the role of the dealer is distributed amongst the parties themselves. Distributed secret sharing can be thought of as combining the features of multiparty non-interactive key exchange and standard secret sharing, and may be useful in settings where the secret is so sensitive that no one individual dealer can be trusted with the secret. Our second notion is called functional secret sharing, which incorporates some of the features of functional encryption into secret sharing by providing more fine-grained access to the secret. Qualified subsets of parties do not learn the secret, but instead learn some function applied to the secret, with each set of parties potentially learning a different function.

Our main result is that both of the extensions above are equivalent to several recent cutting-edge primitives. In particular, general-purpose distributed secret sharing is equivalent to witness PRFs, and general-purpose functional secret sharing is equivalent to indistinguishability obfuscation. Thus, our work shows that it is possible to view some of the recent developments in cryptography through a secret sharing lens, yielding new insights about both these cutting-edge primitives and secret sharing.

15:17 [Pub][ePrint] Solving LWE via List Decoding, by Mingqiang Wang and Xiaoyun Wang and Kunxian Xia and Jincheng Zhuang

  Learning with errors (LWE) was introduced by Regev in 2005, which enjoys attractive worst-case hardness properties. It has served as the foundation for a variety of cryptographic schemes. There are two main types of attacks against LWE: one for the decision version of LWE, the other for the search version of LWE.

In this paper, we apply the list decoding method to solve search version of LWE. Our algorithm runs in probabilistic polynomial time and results in specific security estimates for a large range of parameters. To our knowledge, it is the first time to apply the list decoding method to recover the key of LWE.

Our algorithm improves Laine and Lauter\'s result.

15:17 [Pub][ePrint] New multilinear maps from ideal lattices, by Gu Chunsheng

  Recently, Hu and Jia presented an efficient attack on the GGH map. They show that the MPKE and WE based on GGH with public tools of encoding are not secure. Currently, an open problem is to fix GGH with functionality-preserving. We present a new construction of multilinear map using ideal lattices, which maintains functionality of GGH with public tools of encoding, such as applications of GGH-based MPKE and WE. The security of our construction depends upon new hardness assumption.

15:17 [Pub][ePrint] Authenticated Encryption without Tag Expansion (or, How to Accelerate AERO), by Kazuhiko Minematsu

  Standard form of authenticated encryption (AE) requires the ciphertext to be expanded by

the nonce and the authentication tag. These expansions can be problematic

when messages are relatively short and communication cost is high.

This paper studies a form of AE scheme whose ciphertext is only expanded by

nonce, with the help of stateful receiver which also enables detection of replays.

While there is a scheme having this feature, called AERO, proposed by McGrew and Foley,

there is no formal treatment based on the provable security framework.

We propose a provable security framework for such AE schemes, which we call MiniAE, and

show several secure schemes using standard symmetric crypto primitives.

Most notably, one of our schemes

has a similar structure as OCB mode of operation and uses only one blockcipher call

to process one input block, thus the computation cost is comparable to the

nonce-based encryption-only schemes.

15:17 [Pub][ePrint] Fine-grained sharing of encrypted sensor data over cloud storage with key aggregation, by Hung Dang and Yun Long Chong and Francois Brun and Ee-Chien Chang

  We consider scenarios in sensor network where the sensed samples are each encrypted with a different key and streamed to a cloud storage. The large number of samples poses technical challenge in fine-grained sharing. For instance, if the data owner wants to grant a user access to a large subset of the samples, the straightforward solution of sending all corresponding keys to the user would overwhelm the data owner\'s network resources. Although existing solution such as Attribute-Based Encryption (ABE) and Key Aggregation Cryptosystem (KAC) can aggregate a number of keys into a single key of small size, each of the techniques has limitations in certain aspects, which render them impractical in our applications. In particular, ABE generally incurs large overhead in ciphertext size, while KAC, though attaining constant ciphertext size and aggregated key size, requires quadratic reconstruction time with respect to the number of keys to be reconstructed. In this paper, we made an observation that for a large class of queries, specifically the combination of range and down-sampling queries, there is a algorithmic enhancement for KAC that reduces its reconstruction time from quadratic to linear. Such improvement addresses the main hurdle in adopting KAC for large datasets. Experimental studies show that on those class of queries, the proposed algorithm outperforms the original KAC by at least $90$ times when reconstructing $2^{15}$ keys. We also give a Minimum Spanning Tree (MST)-based algorithm for general queries and a clustering algorithm to trade-off the reconstruction time with the size of aggregated key. Experimental studies show that these algorithms can reduce the reconstruction time for keys that are dense in small range.

15:17 [Pub][ePrint] Predictable Arguments of Knowledge, by Antonio Faonio and Jesper Buus Nielsen and Daniele Venturi

  We initiate a formal investigation on the power of predictability for argument of knowledge systems for NP.

Specifically, we consider private-coin argument systems where the answers of the prover can be predicted, given the private randomness of the verifier.

We show that predictable arguments of knowledge (PAoK) can be made extremely laconic, with the prover sending a single bit, and assumed to have only one round (two messages) without loss of generality. We then explore constructs of PAoK. For specific relations we obtain PAoK from Extractable Hash Proof systems (Wee, Crypto \'10); we also show that PAoK are equivalent to Extractable Witness Encryption. Unfortunately, the latter poses serious doubts on the existence of PAoK for all NP. However, we show that for the class of random self-reducible problems in NP we can avoid the problem relying on the assumption of public-coin differing-inputs obfuscation (Ishai et al., TCC \'15).

Finally, we apply PAoK in the context of leakage-tolerant PKE protocols.

At PKC \'13 Nielsen et al. have shown that any leakage-tolerant PKE protocol requires long keys already when it tolerates super-logarithmic leakage.

We strengthen their result proving a more fine-grained lower bound for any constant numbers bits of leakage.