<?xml version="1.0" encoding="iso-8859-1" ?>
<feed xmlns="http://www.w3.org/2005/Atom">
<title>Cryptology ePrint Archive</title>
<link rel="self" href="http://eprint.iacr.org/rss/atom.xml" />
<updated>2013-05-18T22:21:02Z</updated>
<id>http://eprint.iacr.org/rss/atom.xml</id>
<author><name>Kevin McCurley</name></author>
<category term="science"/>
<category term="mathematics"/>
<category term="computer science"/>
<category term="cryptology"/>
<category term="cryptography"/>
<generator version="2.0">None of your business</generator>
<rights>All rights reserved by authors</rights>
<entry>
<title><![CDATA[Three Snakes in One Hole: A 67 Gbps Flexible Hardware for SOSEMANUK with Optional Serpent and SNOW 2.0 Modes]]></title>
<updated>2013-05-16T07:33:21Z</updated>
<author><name><![CDATA[Goutam Paul]]></name></author>
<author><name><![CDATA[Anupam Chattopadhyay]]></name></author>
<id>http://eprint.iacr.org/2013/282</id>
<category term="implementation / Cryptography"/>
<category term="Hardware Accelerator"/>
<category term="Serpent"/>
<category term="SNOW 2.0"/>
<category term="SOSEMANUK"/>
<category term="Stream cipher implementation"/>
<content><![CDATA[With increasing usage of hardware accelerators in modern heterogeneous
System-on-Chips (SoCs), the distinction between hardware and software is no longer rigid. The domain of cryptography is no exception and efficient hardware design of so-called software ciphers are becoming increasingly popular. In this paper, for the first time we propose an efficient hardware accelerator design for SOSEMANUK, one of the finalists of the eSTREAM stream cipher competition in the software category. Since SOSEMANUK combines the design principles of the block cipher Serpent and the stream cipher SNOW 2.0, we make our design
flexible to accommodate the option for independent execution of Serpent and SNOW 2.0. In the process, we identify interesting design points and explore different levels of optimizations. We perform a detailed experimental evaluation of the performance figures of each design point and in each case our figures by far outperform the existing benchmarks. The best throughput achieved by the combined design is 67.84 Gbps for SOSEMANUK, 33.92 Gbps for SNOW 2.0 and 2.12 Gbps for Serpent. The throughput for SOSEMANUK by far outperforms all existing benchmarks on the eSTREAM candidates.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/282" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Adapting Lyubashevsky's Signature Schemes to the Ring Signature Setting]]></title>
<updated>2013-05-16T07:31:20Z</updated>
<author><name><![CDATA[Carlos Aguilar-Melchor]]></name></author>
<author><name><![CDATA[Slim Bettaieb]]></name></author>
<author><name><![CDATA[Xavier Boyen]]></name></author>
<author><name><![CDATA[Laurent Fousse]]></name></author>
<author><name><![CDATA[Philippe Gaborit]]></name></author>
<id>http://eprint.iacr.org/2013/281</id>
<category term="public-key cryptography / Ring signatures"/>
<category term="lattices"/>
<content><![CDATA[Basing signature schemes on strong lattice problems has been a long standing open issue. Today, two families of lattice-based signature schemes are known: the ones based on the hash-and-sign construction of Gentry et al.; and Lyubashevsky's schemes, which are based on the Fiat-Shamir framework.
In this paper we show for the first time how to adapt the schemes of Lyubashevsky to the ring signature setting. In particular we transform the scheme of ASIACRYPT 2009 into a ring signature scheme that provides strong properties of security under the random oracle model. Anonymity is ensured in the sense that signatures of different users are within negligible statistical distance even under full key exposure. In fact, the scheme satisfies a notion which is stronger than the classical full key exposure setting as even if the keypair of the signing user is adversarially chosen, the statistical distance between signatures of different users remains negligible.
Considering unforgeability, the best lattice-based ring signature schemes provide either unforgeability against arbitrary chosen subring attacks or insider corruption in log-sized rings. In this paper we present two variants of our scheme. In the basic one, unforgeability is ensured in those two settings. Increasing signature and key sizes by a factor k (typically 80 &#8722; 100), we provide a variant in which unforgeability is ensured against insider corruption attacks for arbitrary rings. The technique used is pretty general and can be adapted to other existing schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/281" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Path ORAM: An Extremely Simple Oblivious RAM Protocol]]></title>
<updated>2013-05-16T07:28:30Z</updated>
<author><name><![CDATA[Emil Stefanov]]></name></author>
<author><name><![CDATA[Marten van Dijk]]></name></author>
<author><name><![CDATA[Elaine Shi]]></name></author>
<author><name><![CDATA[Christopher Fletcher]]></name></author>
<author><name><![CDATA[Ling Ren]]></name></author>
<author><name><![CDATA[Xiangyao Yu]]></name></author>
<author><name><![CDATA[Srinivas Devadas]]></name></author>
<id>http://eprint.iacr.org/2013/280</id>
<category term="cryptographic protocols / oblivious ram"/>
<category term="oram"/>
<category term="privacy"/>
<category term="storage"/>
<category term="access patterns"/>
<content><![CDATA[We present Path ORAM, an extremely simple Oblivious RAM protocol with a small amount of client storage. Partly due to its simplicity, Path ORAM is the most practical ORAM scheme known to date. We formally prove that Path ORAM requires O(log^2 N / k) bandwidth overhead for block size B = k * log N. For block sizes bigger than O(log^2 N) bits, Path ORAM is asymptotically better than the best known ORAM scheme with small client storage. Due to its practicality, Path ORAM has been adopted in the design of secure processors since its proposal.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/280" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Pinocchio: Nearly Practical Verifiable Computation]]></title>
<updated>2013-05-16T07:26:49Z</updated>
<author><name><![CDATA[Bryan Parno]]></name></author>
<author><name><![CDATA[Craig Gentry]]></name></author>
<author><name><![CDATA[Jon Howell]]></name></author>
<author><name><![CDATA[Mariana Raykova]]></name></author>
<id>http://eprint.iacr.org/2013/279</id>
<category term="cryptographic protocols / verifiable computation"/>
<category term="NIZKs"/>
<category term="zero knowledge"/>
<category term="implementation"/>
<content><![CDATA[To instill greater confidence in computations outsourced to the cloud, clients should be able to verify the correctness of the results returned. To this end, we introduce Pinocchio, a built system for efficiently verifying general computations while relying only on cryptographic assumptions. With Pinocchio, the client creates a public evaluation key to describe her computation; this setup is proportional to evaluating the computation once. The worker then evaluates the computation on a particular input and uses the evaluation key to produce a proof of correctness. The proof is only 288 bytes, regardless of the computation performed or the size of the inputs and outputs. Anyone can use a public verification key to check the proof.  Pinocchio achieves strong asymptotic efficiency by refining the Quadratic Arithmetic Programs of Gennaro, Gentry, Parno, and Raykova (EuroCrypt 2013).

Crucially, our evaluation on seven applications demonstrates that Pinocchio is efficient in practice too. Pinocchio's verification time is typically 10ms: 5-7 orders of magnitude less than previous work; indeed Pinocchio is the first general-purpose system to demonstrate per-instance verification cheaper than native execution (for some apps). Pinocchio also reduces the worker's proof effort by an additional 19-60x. As an additional feature, Pinocchio generalizes to zero-knowledge proofs at a negligible cost over the base protocol. Finally, to aid development, Pinocchio provides an end-to-end toolchain that compiles a subset of C into programs that implement the verifiable computation protocol.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/279" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A Frequency Leakage Model and its application to CPA and DPA]]></title>
<updated>2013-05-16T07:25:58Z</updated>
<author><name><![CDATA[S. Tiran]]></name></author>
<author><name><![CDATA[S. Ordas]]></name></author>
<author><name><![CDATA[Y. Teglia]]></name></author>
<author><name><![CDATA[M. Agoyan]]></name></author>
<author><name><![CDATA[P. Maurine]]></name></author>
<id>http://eprint.iacr.org/2013/278</id>
<category term="SCA"/>
<category term="DPA"/>
<category term="CPA; Leakage Model"/>
<category term="Frequency Domain"/>
<content><![CDATA[This paper introduces a leakage model in the frequency domain to
enhance the efficiency of Side Channel Attacks of CMOS circuits. While usual techniques are focused on noise removal around clock harmonics, we show that the actual leakage is not necessary located in those expected bandwidths as experimentally observed by E. Mateos and C.H. Gebotys in 2010. We start by building a theoretical modeling of power consumption and electromagnetic emanations before deriving from it a criterion to guide standard attacks. This criterion is then validated on real experiments, both on FPGA and ASIC, that show an impressive increase of the yield of SCA.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/278" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[ESPOON: Enforcing Encrypted Security Policies in Outsourced Environments]]></title>
<updated>2013-05-16T07:07:34Z</updated>
<author><name><![CDATA[Muhammad Rizwan Asghar]]></name></author>
<author><name><![CDATA[Mihaela Ion]]></name></author>
<author><name><![CDATA[Giovanni Russello]]></name></author>
<author><name><![CDATA[Bruno Crispo]]></name></author>
<id>http://eprint.iacr.org/2013/277</id>
<category term="applications / Encrypted Policies"/>
<category term="Sensitive Policy Evaluation"/>
<category term="Data Outsourcing"/>
<category term="Cloud Computing"/>
<category term="Privacy"/>
<category term="Security"/>
<content><![CDATA[The enforcement of security policies in outsourced environments is still an open challenge for policy-based systems. On the one hand, taking the appropriate security decision requires access to the policies. However, if such access is allowed in an untrusted environment then confidential information might be leaked by the policies. Current solutions are based on cryptographic operations that embed security policies with the security mechanism. Therefore, the enforcement of such policies is performed by allowing the authorised parties to access the appropriate keys. We believe that such solutions are far too rigid because they strictly intertwine authorisation policies with the enforcing mechanism.

In this paper, we want to address the issue of enforcing security policies in an untrusted environment while protecting the policy confidentiality. Our solution ESPOON is aiming at providing a clear separation between security policies and the enforcement mechanism. However, the enforcement mechanism should learn as less as possible about both the policies and the requester attributes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/277" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Towards a Practical Cryptographic Voting Scheme Based on Malleable Proofs]]></title>
<updated>2013-05-16T07:06:18Z</updated>
<author><name><![CDATA[David Bernhard]]></name></author>
<author><name><![CDATA[Stephan Neumann]]></name></author>
<author><name><![CDATA[Melanie Volkamer]]></name></author>
<id>http://eprint.iacr.org/2013/276</id>
<category term="implementation / Malleable Proofs"/>
<category term="Distributed Key Generation"/>
<category term="Performance"/>
<content><![CDATA[Mixnets are one of the main approaches to deploy secret and verifiable electronic elections.
General-purpose verifiable mixnets however suffer from the drawback that the amount of data to be verified by observers increases linearly with the number of involved mix nodes, the number of decryptors, and the number of voters. Chase et al. proposed a verifiable mixnet at Eurocrypt 2012 based on so-called \emph{malleable proofs} - proofs that do not increase with the number of mix nodes. In work published at PKC 2013, the same authors adapted malleable proofs to verifiable distributed decryption, resulting in a cryptographic voting scheme. As a result, the amount of data to be verified only increases linearly with the number of voters.
However, their scheme leaves several questions open which we address in this paper:
As a first contribution, we adapt a multi-party computation protocol to build a distributed key generation protocol for the encryption scheme underlying their voting scheme. As a second contribution, we decompress their abstract scheme description, identify elementary operations, and count the number of such operations required for mixing and verification. Based on timings for elementary operations, we extrapolate the running times of the mixing and verification processes, allowing us to assess the feasibility of their scheme. For the German case, we conclude that the replacement of postal voting by cryptographic voting based on malleable proofs is feasible on an electoral district level.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/276" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The Potential of Individualized Trusted Root Stores: Minimizing the Attack Surface in the Light of CA Failures]]></title>
<updated>2013-05-16T07:04:50Z</updated>
<author><name><![CDATA[Johannes Braun]]></name></author>
<author><name><![CDATA[Gregor Rynkowski]]></name></author>
<id>http://eprint.iacr.org/2013/275</id>
<category term="public-key cryptography / Web PKI"/>
<category term="Internet security"/>
<category term="CA compromise"/>
<category term="SSL/TLS"/>
<content><![CDATA[The security of most Internet applications relies on underlying public key infrastructures (PKIs) and thus on an ecosystem of certification authorities (CAs). The pool of PKIs responsible for the issuance and the maintenance of SSL certificates, called the Web PKI, has grown extremely large and complex. Herein, each CA is a single point of failure for the security, leading to an attack surface, the size of which is hardly assessable.
This paper approaches the issue if and how the attack surface can be reduced in order to reduce the risk of relying on a malicious certificate. In particular we consider the individualization of the set of trusted CAs. We present a tool called Rootopia, which allows to assess the respective part of the Web PKI relevant for a user.
Our analysis of browser histories of 22 Internet users reveals, that the major part of the PKI is completely irrelevant to a single user. The attack surface can be reduced by more than 90%, which shows the potential of the individualization of the set of trusted CAs. Furthermore, all the relevant CAs reside within a small set of countries. Our findings confirm, that we unnecessarily trust in a
huge number of CAs, exposing ourselves to unnecessary risks.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/275" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A time series approach for profiling attack]]></title>
<updated>2013-05-16T07:02:55Z</updated>
<author><name><![CDATA[Liran Lerman]]></name></author>
<author><name><![CDATA[Gianluca Bontempi]]></name></author>
<author><name><![CDATA[Souhaib Ben Taieb]]></name></author>
<author><name><![CDATA[Olivier Markowitch]]></name></author>
<id>http://eprint.iacr.org/2013/274</id>
<category term="side-channel attack"/>
<category term="power analysis"/>
<category term="machine learning"/>
<category term="time series classification."/>
<content><![CDATA[The goal of a profiling attack is to challenge the security of a cryptographic device in the worst case scenario. Though template attack are reputed as the strongest power analysis attack, they effectiveness is strongly dependent on the validity of the Gaussian assumption. This led recently to the appearance of nonparametric approaches, often based on machine learning strategies. Though these approaches outperform template attack, they tend to neglect the time series nature of the power traces. In this paper, we  propose an original multi-class profiling attack that takes into account the temporal dependence of power traces. The experimental study shows that the time series analysis approach is competitive and often better than static classification alternatives. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/274" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Computing the Rank of Incidence Matrix and Algebraic Immunity of Boolean Functions]]></title>
<updated>2013-05-14T07:48:43Z</updated>
<author><name><![CDATA[Deepak Kumar Dalai]]></name></author>
<id>http://eprint.iacr.org/2013/273</id>
<category term="secret-key cryptography / Boolean function"/>
<category term="algebraic immunity"/>
<category term="rank of matrix"/>
<category term="LU-decomposition"/>
<content><![CDATA[The incidence matrix between a set of monomials and a set of vectors in $\F_2$ has a great importance in the study of coding theory, cryptography, linear algebra, combinatorics. The rank of these matrices are very useful while computing algebraic immunity($\ai$) of Boolean functions in cryptography literature~\cite{MPC04,DGM04}.
Moreover, these matrices are very sparse and well structured. Thus, for aesthetic reason finding rank of these  matrices is also very interesting in mathematics.
In this paper, we have reviewed the existing algorithms with added techniques to speed up the algorithms and have proposed some new efficient algorithms for the computation of the rank of incidence matrix and solving the system of equations where the co-efficient matrix is an incidence matrix.Permuting the rows and columns of the incidence matrix with respect to an ordering, the incidence matrix can be converted to a lower block triangular matrix, which makes the computation in quadratic time complexity and linear space complexity. Same technique is used to check and computing low degree annihilators of an $n$-variable Boolean functions in faster time complexity than the usual algorithms. Moreover, same technique is also exploited on the Dalai-Maitra algorithm in~\cite{DM06} for faster computation. On the basis of experiments, we conjecture that the $\ai$ of $n$-variable inverse S-box is $\lfloor\sqrt{n}\rfloor + \lceil\frac{n}{\lfloor\sqrt{n}\rfloor}\rceil-2$.
We have also shown the skepticism on the existing fastest algorithm
in~\cite{ACGKMR06} to find $\ai$ and lowest degree annihilators of a Boolean function.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/273" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cryptography Challenges for Computational Privacy in Public Clouds]]></title>
<updated>2013-05-14T23:54:02Z</updated>
<author><name><![CDATA[Sashank Dara]]></name></author>
<id>http://eprint.iacr.org/2013/272</id>
<category term="applications"/>
<category term="implementation"/>
<category term="computational privacy"/>
<category term="cloud privacy"/>
<category term="fully homomorphic encryption"/>
<category term="functional encryption"/>
<category term="challenges"/>
<content><![CDATA[Computational privacy is a property of cryptographic
system that ensures the privacy of data (and/or operations)
while being processed at an untrusted server. Cryptography
has been an indispensable tool for computer security but its
readiness for this new generational shift of computing platform
i.e. Cloud Computing is still questionable.
Theoretical constructions like Fully Homomorphic Encryption,
Functional encryption, Server aided Multiparty Computation,
Verifiable Computation, Instance Hiding etc. are few
directions being pursued. These cryptographic techniques solve
Cloud privacy problems at different levels but most of them dont
fit well in overall scheme of things.
We state the privacy requirements for Cloud offerings in
various delivery methods. We discuss the challenges with current
cryptographic techniques being pursued by researchers and show
that they dont cater to blanket cover these privacy requirements.
We urge the need to find generalizations and connections
among these isolated techniques. As this might give more insights
into the underpinnings of Computational Privacy and lead to
better solutions.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/272" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The Legal Classification of Identity-Based Signatures]]></title>
<updated>2013-05-14T07:46:30Z</updated>
<author><name><![CDATA[Christoph Sorge]]></name></author>
<id>http://eprint.iacr.org/2013/271</id>
<category term="applications / digital signatures"/>
<category term="electronic signatures"/>
<category term="legal aspects"/>
<content><![CDATA[Identity-based cryptography has attracted attention in the cryptographic research community in recent years. Despite the importance of cryptographic schemes for applications in business and law, the legal implications of identity-based cryptography have not yet been discussed. We investigate how identity-based signatures fit into the legal framework. We focus on the European Signature Directive, but also take the UNCITRAL Model Law on Electronic Signatures into account. In contrast to previous assumptions, identity-based signature schemes can, in principle, be used even for qualified electronic signatures, which can replace handwritten signatures in the member states of the European Union. We derive requirements to be taken into account in the development of future identity-based signature schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/271" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Pseudorandom Generators from Regular One-way Functions: New Constructions with Improved Parameters]]></title>
<updated>2013-05-13T07:03:07Z</updated>
<author><name><![CDATA[Yu Yu]]></name></author>
<id>http://eprint.iacr.org/2013/270</id>
<category term="foundations / one-way functions"/>
<category term="pseudorandom generators"/>
<category term="randomized iterate"/>
<content><![CDATA[We revisit the problem of basing pseudorandom generators on regular one-way functions, and present the following constructions: 

(1) For any known-regular one-way function (on $n$-bit inputs) that is known to be $\eps$-hard to invert, we give a neat (and tighter) proof for the folklore construction of pseudorandom generator of seed length $\Theta(n)$ by making a single call to the underlying one-way function. 

(2) For any unknown-regular one-way function with known $\eps$-hardness, we give a new construction with seed length $\Theta(n)$ and $O(n/\log{(1/\eps)})$ calls. Here the number of calls is also optimal by matching the lower bounds of Holenstein and Sinha [FOCS 2012]. 

Both constructions require the knowledge about $\eps$, but the dependency can be removed while keeping nearly the same parameters. In the latter case, we get a construction of pseudo-random generator from any unknown-regular one-way function using seed length $\tilde{O}(n)$ and $\tilde{O}(n/\log{n})$ calls, where $\tilde{O}$ omits a factor that can be made arbitrarily close to constant (e.g. $\log\log\log{n}$ or even less). This improves the \emph{randomized iterate} approach by Haitner, Harnik and Reingold [CRYPTO 2006] which requires seed length $O(n{\log}{n})$ and $O(n/\log{n})$ calls.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/270" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Chosen Ciphertext Secure (CCS): Stateful Symmetric Key CCA Encryption with Minimal Ciphertext Expansion]]></title>
<updated>2013-05-13T06:06:16Z</updated>
<author><name><![CDATA[Jonathan Trostle]]></name></author>
<id>http://eprint.iacr.org/2013/269</id>
<category term="secret-key cryptography / Private key CCA2 encryption"/>
<category term="energy constrained cryptography"/>
<category term="authenticated encryption"/>
<content><![CDATA[In some wireless environments, minimizing the size of messages is paramount due to the resulting significant energy savings. We
present a new stateful symmetric encryption scheme: CCS or Chosen
Ciphertext Secure scheme. CCS has the property that modifications to
the ciphertext randomizes the resulting plaintext. Using this property,
we prove the scheme is CCA2 secure. Thus we obtain CCA2 encryption
schemes with minimal ciphertext expansion which are applicable to resource constrained wireless environments. For protocols that send short messages, our scheme is similar to Counter with CBC-MAC (CCM) for
computation but has much shorter messages (since we can use much
smaller or no MAC tags) for a similar level of security. A key idea is
that various protocol fields in the underlying plaintext act as an authentication tag given changes to the message ciphertext. To the best of our knowledge, CCS is the first scheme that achieves CCA2 security with only 2-3 bytes of ciphertext expansion.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/269" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Dynamic Cube Attack on Grain-v1]]></title>
<updated>2013-05-13T06:05:18Z</updated>
<author><name><![CDATA[Majid Rahimi, Mostafa Barmshori]]></name></author>
<id>http://eprint.iacr.org/2013/268</id>
<category term="&#8206;stream cipher&#8206;"/>
<category term="&#8206;Grain-v1&#8206;"/>
<category term="&#8206;dynamic cube attack&#8206;"/>
<category term="&#8206;key recovery attack"/>
<content><![CDATA[This article aims to present dynamic cube attack on Grain-v1. Dynamic cube attack finds the secret key by using distinguishers gained from structure's weakness. The main idea of dynamic cube attack lies in simplifying the output function. After making it easier, dynamic cube attack will be able to exploit distinguishing attack for recovering the secret key. In this paper, we investigate Grain-v1 to which key recovery attack has never been applied because its feedback function is so sophisticated. we apply dynamic cube attack on it by utilizing both intelligent choices of Initial Value variables and appropriate simplifications. Our attack is done in feasible time complexity, and it recovers all bits of the key while the number of initialization rounds in Grain-v1 is decreased to 100. Moreover, it is the first key recovery attack on reduced version of Grain-v1. This &#8206;attack &#8206;is &#8206;faster &#8206;than &#8206;exhaustive &#8206;search &#8206;by a&#8206; &#8206;factor $&#8206;2^{32}$.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/268" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Multi-Party Computation of Polynomials and Branching Programs without Simultaneous Interaction]]></title>
<updated>2013-05-13T06:03:16Z</updated>
<author><name><![CDATA[S. Dov Gordon]]></name></author>
<author><name><![CDATA[Tal Malkin]]></name></author>
<author><name><![CDATA[Mike Rosulek]]></name></author>
<author><name><![CDATA[Hoeteck Wee]]></name></author>
<id>http://eprint.iacr.org/2013/267</id>
<category term="cryptographic protocols / secure computation "/>
<content><![CDATA[Halevi, Lindell, and Pinkas (CRYPTO 2011) recently proposed a model for secure computation that captures communication patterns that arise
in many practical settings, such as secure computation on the web. In their model, each party interacts only once, with a single centralized server. Parties do not interact with each other; in fact, the parties need not even be online simultaneously.

In this work we present a suite of new, simple and efficient protocols for secure computation in this "one-pass" model. We give protocols that obtain optimal privacy for the following general tasks:
-- Evaluating any multivariate polynomial $F(x_1, \ldots ,x_n)$ (modulo a large RSA modulus N), where the parties each hold an input $x_i$.
-- Evaluating any read once branching program over the parties' inputs.

As a special case, these function classes include all previous functions for which an optimally private, one-pass computation was known, as well as many new functions, including variance and other statistical functions, string matching, second-price auctions, classification algorithms and some classes of finite automata
and decision trees.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/267" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[L-P States of RC4 Stream Cipher ]]></title>
<updated>2013-05-14T02:44:37Z</updated>
<author><name><![CDATA[Jing Lv]]></name></author>
<author><name><![CDATA[Dongdai Lin]]></name></author>
<id>http://eprint.iacr.org/2013/266</id>
<category term="RC4"/>
<category term="Distinguishing attack"/>
<category term="predictive states"/>
<category term="L-P states"/>
<content><![CDATA[The stream cipher RC4 was designed by R.Rivest in $1987$, and it is a widely deployed cipher. Many predictive states of RC4 for some special indices $i$ were presented in the last $20$ years. In this paper, we present several long term predictive states. These states increase the probability to guess part of the internal state in a known plaintext attack and present a cryptanalytic weakness of RC4. This paper also analyzes possible long term bias in the keystream and further propose a search method for the long term predictive states.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/266" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Attribute-Based Encryption with Fast Decryption]]></title>
<updated>2013-05-13T06:01:19Z</updated>
<author><name><![CDATA[Susan Hohenberger]]></name></author>
<author><name><![CDATA[Brent Waters]]></name></author>
<id>http://eprint.iacr.org/2013/265</id>
<category term="public-key cryptography / attribute-based encryption"/>
<content><![CDATA[Attribute-based encryption (ABE) is a vision of public key encryption that allows users to encrypt and decrypt messages based on user attributes.    This functionality comes at a cost.   In a typical implementation, the size of the ciphertext is proportional to the number of attributes associated with it and the decryption time is proportional to the number of attributes used during decryption.   Specifically, many practical ABE implementations require one pairing operation per attribute used during decryption.

This work focuses on designing ABE schemes with fast decryption algorithms.   We restrict our attention to expressive systems without system-wide bounds or limitations, such as placing a limit on the number of attributes used in a ciphertext or a private key.   In this setting, we present the first key-policy ABE system where ciphertexts can be decrypted with a constant number of pairings.   We show that GPSW ciphertexts can be decrypted with only 2 pairings by increasing the private key size by a factor of X, where X is the set of distinct attributes that appear in the private key.   We then present a generalized construction that allows each system user to independently tune various efficiency tradeoffs to their liking on a spectrum where the extremes are GPSW on one end and our very fast scheme on the other.    This tuning requires no changes to the public parameters or the encryption algorithm.   Strategies for choosing an individualized user optimization plan are discussed.   Finally, we discuss how these ideas can be translated into the ciphertext-policy ABE setting at a higher cost.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/265" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Encrypted Secret Sharing and Analysis by Plaintext Randomization]]></title>
<updated>2013-05-13T06:00:16Z</updated>
<author><name><![CDATA[Stephen R. Tate]]></name></author>
<author><name><![CDATA[Roopa Vishwanathan]]></name></author>
<author><name><![CDATA[Scott Weeks]]></name></author>
<id>http://eprint.iacr.org/2013/264</id>
<category term="public-key cryptography / public-key cryptography"/>
<category term="secret sharing"/>
<category term="reduction"/>
<category term="cryptographic games"/>
<content><![CDATA[In this paper we consider the problem of secret sharing where shares
are encrypted using a public-key encryption (PKE) scheme and
ciphertexts are publicly available. While intuition tells us that the
secret should be protected if the PKE is secure against
chosen-ciphertext attacks (i.e., CCA-secure), formally proving this
reveals some subtle and non-trivial challenges. We isolate the
problems that this raises, and devise a new analysis technique called
``plaintext randomization'' that can successfully overcome these
challenges, resulting in the desired proof.  The encryption of
different shares can use one key or multiple keys, with natural
applications in both scenarios.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/264" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Speeding up QUAD]]></title>
<updated>2013-05-13T05:59:13Z</updated>
<author><name><![CDATA[Albrecht Petzoldt]]></name></author>
<id>http://eprint.iacr.org/2013/263</id>
<category term="secret-key cryptography / Multivariate Cryptography"/>
<category term="QUAD Stream Cipher"/>
<category term="Partially Circulant Polynomials"/>
<category term="Linear Recurring Sequences"/>
<content><![CDATA[QUAD is a provable secure stream cipher based on multivariate polynomials which was proposed in 2006 by Berbain, Gilbert and Patarin \cite{BG06}. In this paper we show how to speed up QUAD over GF(256) by a factor of up to 5.8. We get this by using structured systems of polynomials, in particular partially circulant polynomials and polynomials generated by a linear recurring sequence (LRS), instead of random ones. By using this strategy, we can also reduce the system parameter of QUAD by about 99 \verb!%!. We furthermore present experiments, which seem to show that using structured polynomials of this special choice does not influence the security of QUAD.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/263" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[An efficient FHE based on the hardness of solving systems of non-linear multivariate equations]]></title>
<updated>2013-05-13T05:58:36Z</updated>
<author><name><![CDATA[Gerald Gavin]]></name></author>
<id>http://eprint.iacr.org/2013/262</id>
<category term="public-key cryptography / FHE"/>
<category term="homomorphic cryptosystem"/>
<content><![CDATA[We propose  a general framework to develop fully homomorphic cryptosystems without using the Gentry's technique. The security relies on the difficulty of solving systems of non-linear equations (which is a NP-complete problem). While  the  security of our scheme is not reduced to a hard instance of this problem, security  is globally investigated.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/262" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Secure information transmission based on physical principles]]></title>
<updated>2013-05-11T14:36:22Z</updated>
<author><name><![CDATA[Dima Grigoriev]]></name></author>
<author><name><![CDATA[Vladimir Shpilrain]]></name></author>
<id>http://eprint.iacr.org/2013/261</id>
<category term="public-key cryptography / computationally unbounded adversary"/>
<category term="physical principles"/>
<content><![CDATA[We employ physical properties of the real world to design a protocol for secure information transmission where one of the parties is able
to transmit secret information to another party over an insecure channel, without any prior secret arrangements between the parties.
The distinctive feature of this protocol, compared to all known
public-key cryptographic protocols, is that neither party uses a
one-way function. In particular, our protocol is secure against (passive) computationally unbounded adversary.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/261" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[From Weak to Strong Zero-Knowledge and Applications]]></title>
<updated>2013-05-08T14:32:24Z</updated>
<author><name><![CDATA[Kai-Min Chung]]></name></author>
<author><name><![CDATA[Edward Lui]]></name></author>
<author><name><![CDATA[Rafael Pass]]></name></author>
<id>http://eprint.iacr.org/2013/260</id>
<content><![CDATA[The notion of \emph{zero-knowledge} \cite{GMR85} is formalized by requiring that for every malicious efficient verifier $V^*$, there exists an efficient simulator $S$ that can reconstruct the view of $V^*$ in a true interaction with the prover, in a way that is indistinguishable to \emph{every} polynomial-time distinguisher. \emph{Weak zero-knowledge} weakens this notions by switching the order of the quantifiers and only requires that for every distinguisher $D$, there exists a (potentially different) simulator $S_D$.

In this paper we consider various notions of zero-knowledge, and investigate whether their weak variants are equivalent to their strong variants. Although we show (under complexity assumption) that for the standard notion of zero-knowledge, its weak and strong counterparts are not equivalent, for meaningful variants of the standard notion, the weak and strong counterparts are indeed equivalent. Towards showing these equivalences, we introduce new non-black-box simulation techniques permitting us, for instance, to demonstrate that the classical 2-round graph non-isomorphism protocol of Goldreich-Micali-Wigderson \cite{GMW91} satisfies a ``distributional'' variant of zero-knowledge. 

Our equivalence theorem has other applications beyond the notion of zero-knowledge. For instance, it directly implies the \emph{dense model theorem} of Reingold et al (STOC '08), and the leakage lemma of Gentry-Wichs (STOC '11), and provides a modular and arguably simpler proof of these results (while at the same time recasting these result in the language of zero-knowledge).

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/260" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Private Interactive Communication Across an Adversarial Channel]]></title>
<updated>2013-05-08T14:31:06Z</updated>
<author><name><![CDATA[Ran Gelles]]></name></author>
<author><name><![CDATA[Amit Sahai]]></name></author>
<author><name><![CDATA[Akshay Wadia]]></name></author>
<id>http://eprint.iacr.org/2013/259</id>
<category term="foundations / Interactive communication"/>
<category term="coding"/>
<category term="adversarial noise"/>
<category term="private function evaluation"/>
<category term="information-theoretic security."/>
<content><![CDATA[Consider two parties Alice and Bob, who hold private inputs x and y, and wish to compute a function f(x,y) privately in the information theoretic sense; that is, each party should learn nothing beyond f(x,y). However, the communication channel available to them is noisy. This means that the channel can introduce errors in the transmission between the two parties. Moreover, the channel is adversarial in the sense that it knows the protocol that Alice and Bob are running, and maliciously introduces errors to disrupt the communication, subject to some bound on the total number of errors. A fundamental question in this setting is to design a protocol that remains private in the presence of large number of errors.

If Alice and Bob are only interested in computing f(x,y) correctly, and not privately, then quite robust protocols are known that can tolerate a constant fraction of errors. However, none of these solutions is applicable in the setting of privacy, as they inherently leak information about the parties' inputs. This leads to the question whether we can simultaneously achieve privacy and error-resilience against a constant fraction of errors.

We show that privacy and error-resilience are contradictory goals. In particular, we show that for every constant c > 0, there exists a function f which is privately computable in the error-less setting, but for which no private and correct protocol is resilient against a c-fraction of errors.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/259" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Witness Encryption and its Applications]]></title>
<updated>2013-05-08T14:29:16Z</updated>
<author><name><![CDATA[Sanjam Garg]]></name></author>
<author><name><![CDATA[Craig Gentry]]></name></author>
<author><name><![CDATA[Amit Sahai]]></name></author>
<author><name><![CDATA[Brent Waters]]></name></author>
<id>http://eprint.iacr.org/2013/258</id>
<category term="public-key cryptography / Multilinear Maps"/>
<content><![CDATA[We put forth the concept of \emph{witness encryption}. A witness encryption scheme is defined for an NP language $L$ (with corresponding witness relation $R$). In such a scheme, a user can encrypt a message $M$ to a particular problem instance $x$ to produce a ciphertext. A recipient of a ciphertext is able to decrypt the message if $x$ is in the language and the recipient knows a witness $w$ where $R(x,w)$ holds. However, if $x$ is not in the language, then no polynomial-time attacker can distinguish between encryptions of any two equal length messages.  We emphasize that the encrypter himself may have no idea whether $x$ is actually in the language.

Our contributions in this paper are threefold. First, we introduce and formally define witness encryption. Second, we show how to build several cryptographic primitives from witness encryption. Finally, we give a candidate construction based on the NP-complete \textsc{Exact Cover} problem and Garg, Gentry, and Halevi's recent construction of ``approximate" multilinear maps.

Our method for witness encryption also yields the first candidate construction for an open problem posed by Rudich in 1989: constructing computational secret sharing schemes for an NP-complete access structure.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/258" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Secure two-party computation: a visual way]]></title>
<updated>2013-05-08T14:26:56Z</updated>
<author><name><![CDATA[Paolo D'Arco]]></name></author>
<author><name><![CDATA[Roberto De Prisco]]></name></author>
<id>http://eprint.iacr.org/2013/257</id>
<category term="foundations / Secure two-party computation"/>
<category term="Yao's protocol"/>
<category term="visual cryptography"/>
<content><![CDATA[In this paper we propose a novel method for performing secure two-party computation. 
By merging together in a suitable way two beautiful ideas of the 80's and the 90's, Yao's garbled circuit construction and Naor and Shamir's visual cryptography, respectively, we 
enable Alice and Bob to securely evaluate a function $f(\cdot,\cdot)$ of their  inputs, $x$ and $y$, through a {\em pure physical} process. Indeed, once Alice has prepared a set of properly constructed transparencies, Bob computes the function value $f(x,y)$ by applying a sequence 
of simple steps which require the use of a pair of scissors, superposing transparencies, and the human visual system.  A crypto-device for the function evaluation process is not needed any more. 

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/257" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Lossiness of the Rabin Trapdoor Function]]></title>
<updated>2013-05-08T14:24:13Z</updated>
<author><name><![CDATA[Yannick Seurin]]></name></author>
<id>http://eprint.iacr.org/2013/256</id>
<category term="public-key cryptography / Rabin trapdoor function"/>
<category term="lossy trapdoor function"/>
<category term="Phi-Hiding assumption"/>
<category term="provable security"/>
<category term="Rabin-Williams signatures"/>
<content><![CDATA[Lossy trapdoor functions, introduced by Peikert and Waters (STOC~'08), are functions that can be generated in two indistinguishable ways: either the function is injective, and there is a trapdoor to invert it, or the function is lossy, meaning that the size of its range is strictly smaller than the size of its domain. Kiltz, O'Neill, and Smith (CRYPTO 2010) showed that the RSA trapdoor function is lossy under the $\Phi$-Hiding assumption of Cachin, Micali, and  Stadler (EUROCRYPT~'99) and used this result to provide a security proof for the RSA-OAEP encryption scheme in the standard model. More recently, Kakvi and Kiltz (EUROCRYPT 2012) used the lossiness of RSA to show that the RSA Full Domain Hash signature scheme has a \emph{tight} security reduction from the $\Phi$-Hiding assumption.
In this work, we consider the Rabin trapdoor function, \emph{i.e.} modular squaring over $\mathbb{Z}_{N}^*$. We show that when adequately restricting its domain (either to the set $\mathbb{QR}_{N}$ of quadratic residues, or to $(\mathbb{J}_{N})^+$, the set of positive integers $1\le x\le (N-1)/2$ with Jacobi symbol +1) the Rabin trapdoor function is lossy, the injective mode corresponding to Blum integers $N=pq$ with $p,q\equiv 3\bmod 4$, and the lossy mode corresponding to what we call pseudo-Blum integers $N=pq$ with $p,q\equiv 1 \bmod 4$. This lossiness result holds under a natural extension of the $\Phi$-Hiding assumption to the case $e=2$ that we call the 2-$\Phi/4$-Hiding assumption. 
We then use this result to prove that deterministic variants of Rabin-Williams Full Domain Hash signatures have a tight reduction from the 2-$\Phi$/4-Hiding assumption, therefore answering one of the main questions left open by Bernstein (EUROCRYPT 2008) in his work on Rabin-Williams signatures.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/256" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[How to Construct an Ideal Cipher from a Small Set of Public Permutations]]></title>
<updated>2013-05-08T14:19:19Z</updated>
<author><name><![CDATA[Rodolphe Lampe]]></name></author>
<author><name><![CDATA[Yannick Seurin]]></name></author>
<id>http://eprint.iacr.org/2013/255</id>
<category term="foundations / block cipher"/>
<category term="ideal cipher"/>
<category term="iterated Even-Mansour cipher"/>
<category term="key-alternating cipher"/>
<category term="indifferentiability"/>
<content><![CDATA[We show how to construct an ideal cipher with $n$-bit blocks and $n$-bit keys (\emph{i.e.} a set of $2^n$ public $n$-bit permutations) from a small constant number of $n$-bit random public permutations. The construction that we consider is the \emph{single-key iterated Even-Mansour cipher}, which encrypts a plaintext $x\in\{0,1\}^n$ under a key $k\in\{0,1\}^n$ by alternatively xoring the key $k$ and applying independent random public $n$-bit permutations $P_1,\ldots, P_r$ (this construction is also named a \emph{key-alternating cipher}). We analyze this construction in the plain indifferentiability framework of Maurer, Renner, and Holenstein (TCC 2004), and show that twelve rounds are sufficient to achieve indifferentiability from an ideal cipher. We also show that four rounds are necessary by exhibiting attacks for three rounds or less.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/255" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Towards Adoption of DNSSEC: Availability and Security Challenges]]></title>
<updated>2013-05-10T03:53:07Z</updated>
<author><name><![CDATA[Amir Herzberg]]></name></author>
<author><name><![CDATA[Haya Shulman]]></name></author>
<id>http://eprint.iacr.org/2013/254</id>
<category term="DNSSEC"/>
<category term="DNS security"/>
<category term="DNS cache poisoning."/>
<content><![CDATA[DNSSEC deployment is long overdue; however, it
seems to be finally taking off. Recent cache poisoning attacks
motivate protecting DNS, with strong cryptography, rather than
with challenge-response 'defenses'.
Our goal is to motivate and help correct DNSSEC deployment.
We discuss the state of DNSSEC deployment, obstacles to
adoption and potential ways to increase adoption. We then
present a comprehensive overview of challenges and potential
pitfalls of DNSSEC, well known and less known, including:DNSSEC deployment is long overdue; however, it
seems to be finally taking off. Recent cache poisoning attacks
motivate protecting DNS, with strong cryptography, rather than
with challenge-response 'defenses'.
Our goal is to motivate and help correct DNSSEC deployment.
We discuss the state of DNSSEC deployment, obstacles to
adoption and potential ways to increase adoption. We then
present a comprehensive overview of challenges and potential
pitfalls of DNSSEC, well known and less known, including:
 Vulnerable configurations: we present several DNSSEC configurations,
which are natural and, based on the limited
deployment so far, expected to be popular, yet are vulnerable
to attack. This includes NSEC3 opt-out records and interdomain
referrals (in NS, MX and CNAME records).
 Incremental Deployment: we discuss potential for increased
vulnerability due to popular practices of incremental deployment,
and recommend secure practice.
 Super-sized Response Challenges: DNSSEC responses include
cryptographic keys and hence are relatively long; we
explain how this extra-long responses cause interoperability
challenges, and can be abused for DoS and even DNS
poisoning. We discuss potential solutions.
 Vulnerable configurations: we present several DNSSEC configurations,
which are natural and, based on the limited
deployment so far, expected to be popular, yet are vulnerable
to attack. This includes NSEC3 opt-out records and interdomain
referrals (in NS, MX and CNAME records).
 Incremental Deployment: we discuss potential for increased
vulnerability due to popular practices of incremental deployment,
and recommend secure practice.
 Super-sized Response Challenges: DNSSEC responses include
cryptographic keys and hence are relatively long; we
explain how this extra-long responses cause interoperability
challenges, and can be abused for DoS and even DNS
poisoning. We discuss potential solutions.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/254" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[CacheAudit: A Tool for the Static Analysis of   Cache Side Channels]]></title>
<updated>2013-05-08T14:16:20Z</updated>
<author><name><![CDATA[Goran Doychev]]></name></author>
<author><name><![CDATA[Dominik Feld]]></name></author>
<author><name><![CDATA[Boris Köpf]]></name></author>
<author><name><![CDATA[Laurent Mauborgne]]></name></author>
<author><name><![CDATA[Jan Reineke]]></name></author>
<id>http://eprint.iacr.org/2013/253</id>
<category term="implementation / AES"/>
<category term="Cache Side Channels"/>
<category term="Program Analysis"/>
<content><![CDATA[We present CacheAudit, a versatile framework for the automatic, static analysis of cache side channels. CacheAudit takes as input a program binary and a cache configuration, and it derives formal, quantitative security guarantees for a comprehensive set of side-channel adversaries, namely those based on observing cache states, traces of hits and misses, and execution times.

Our technical contributions include novel abstractions to efficiently compute precise over-approximations of the possible side-channel observations for each of these adversaries.  These approximations then yield upper bounds on the information that is revealed.  In case studies we apply CacheAudit to binary executables of algorithms for symmetric encryption and sorting, obtaining the first formal proofs of security for implementations with countermeasures such as preloading and data-independent memory access patterns.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/253" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Primitivity of some Trinomials over Finite Fields]]></title>
<updated>2013-05-03T07:55:56Z</updated>
<author><name><![CDATA[LI Yujuan, WANG Huaifu, ZHAO Jinhua]]></name></author>
<id>http://eprint.iacr.org/2013/252</id>
<category term="secret-key cryptography / LFSR"/>
<category term="primitive polynomial"/>
<category term="finite field"/>
<content><![CDATA[In this paper, we give
conditions under which the trinomials of the form $x^{n}+ax+b$ over
finite field ${\mathbb{F}}_{p^{m}}$ are not primitive and
 conditions under which there are no primitive trinomials of the
form $x^{n}+ax+b$ over finite field ${\mathbb{F}}_{p^{m}}$. For
finite field ${\mathbb{F}}_{4}$, We show that there are no primitive
trinomials of the form $x^{n}+x+\alpha$, if $n\equiv1\mod 3$ or
$n\equiv0\mod 3$ or $n\equiv4\mod 5$.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/252" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Permutation Polynomials and Their Differential Properties over Residue Class Rings]]></title>
<updated>2013-05-03T02:33:24Z</updated>
<author><name><![CDATA[Yuyin Yu]]></name></author>
<author><name><![CDATA[Mingsheng Wang]]></name></author>
<id>http://eprint.iacr.org/2013/251</id>
<category term="foundations / permutation polynomial"/>
<category term="residue class ring"/>
<category term=" Almost Perfect Nonlinear (APN)"/>
<content><![CDATA[This paper mainly focuses on permutation polynomials over the residue class ring $\mathbb{Z}_{N}$, where $N>3$ is composite. We have proved that for the polynomial $f(x)=a_{1}x^{1}+\cdots +a_{k}x^{k}$ with integral coefficients, $f(x)\bmod N$ permutes $\mathbb{Z}_{N}$ if and only if $f(x)\bmod N$ permutes $S_{\mu}$ for all $\mu \mid N$, where $S_{\mu}=\{0< t <N: \gcd(N,t)=\mu\}$ and $S_{N}=S_{0}=\{0\}$. Based on it, we give a lower bound of the differential uniformities for such permutation polynomials, that is, $\delta (f)\geq \frac{N}{\#S_{a}}$, where $a$ is the biggest nontrivial divisor of $N$. Especially, $f(x)$ can not be APN permutations over the residue class ring \mathbb{Z}_{N}$. It is also proved that $f(x)\bmod N$ and $(f(x)+x)\bmod N$ can not permute $\mathbb{Z}_{N}$ at the same time when $N$ is even.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/251" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Fully Homomorphic Encryption for Mathematicians]]></title>
<updated>2013-05-03T02:31:45Z</updated>
<author><name><![CDATA[Alice Silverberg]]></name></author>
<id>http://eprint.iacr.org/2013/250</id>
<content><![CDATA[We give an introduction to Fully Homomorphic Encryption for mathematicians. Fully Homomorphic Encryption allows untrusted parties to take encrypted data Enc(m_1),...,Enc(m_t) and any efficiently computable function f, and compute an encryption of f(m_1,...,m_t), without knowing or learning the decryption key or the raw data m_1,...,m_t. The problem of how to do this was recently solved by Craig Gentry, using ideas from algebraic number theory and the geometry of numbers. In this paper we discuss some of the history and background, give examples of Fully Homomorphic Encryption schemes, and discuss the hard mathematical problems on which the cryptographic security is based.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/250" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[How to Factor N_1 and N_2 When p_1=p_2 mod 2^t]]></title>
<updated>2013-05-09T23:44:37Z</updated>
<author><name><![CDATA[Kaoru Kurosawa]]></name></author>
<author><name><![CDATA[Takuma Ueda]]></name></author>
<id>http://eprint.iacr.org/2013/249</id>
<category term="factoring"/>
<category term="Gaussian reduction algorithm"/>
<category term="lattice"/>
<content><![CDATA[Let $N_1=p_1q_1$ and $N_2=p_2q_2$ be two different RSA moduli. Suppose that $p_1=p_2 \bmod 2^t$ for some $t$, and $q_1$ and $q_2$ are $\alpha$ bit primes. Then May and Ritzenhofen showed that $N_1$ and $N_2$ can be factored in quadratic time if 
\[ t \geq 2\alpha+3. \] 

In this paper, we improve this lower bound on $t$. Namely we prove that $N_1$ and $N_2$ can be factored in quadratic time if 
\[ t \geq 2\alpha+1. \] 
Further our simulation result shows that our bound is tight. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/249" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Another Look at Security Theorems for 1-Key Nested MACs]]></title>
<updated>2013-05-09T06:08:31Z</updated>
<author><name><![CDATA[Neal Koblitz]]></name></author>
<author><name><![CDATA[Alfred Menezes]]></name></author>
<id>http://eprint.iacr.org/2013/248</id>
<content><![CDATA[We prove a security theorem without collision-resistance for a class of 1-key hash-function-based MAC schemes that includes HMAC and Envelope MAC.  The proof has some advantages over earlier proofs: it is in the uniform model, it uses a weaker related-key assumption, and it covers a broad class of MACs in a single theorem.  However, we also explain why our theorem is of doubtful value in assessing the real-world security of these MAC schemes.  In addition, we prove a theorem assuming collision-resistance.  From these two theorems we conclude that from a provable security standpoint there is little reason to prefer HMAC to Envelope MAC or similar schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/248" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Leakage-resilient Attribute-based Encryptions with Fast Decryption: Model, Analysis and Construction]]></title>
<updated>2013-05-03T02:28:44Z</updated>
<author><name><![CDATA[Mingwu Zhang]]></name></author>
<author><name><![CDATA[Wei Shi]]></name></author>
<author><name><![CDATA[Chunzhi Wang]]></name></author>
<author><name><![CDATA[Zhenhua Chen]]></name></author>
<author><name><![CDATA[Yi Mu]]></name></author>
<id>http://eprint.iacr.org/2013/247</id>
<category term="public-key cryptography / "/>
<content><![CDATA[raditionally, in attribute-based encryption (ABE), an access structure is constructed from a linear secret sharing scheme (LSSS), a boolean formula or an access tree.
In this work, we encode the access structure as their minimal sets, which is equivalent to the existence of a smallest monotonic span program for the characteristic function of the same access structure.
We present two leakage-resilient attribute-based encryption schemes, ciphertext-policy ABE (LR-CP-ABE) and key-policy ABE (LR-KP-ABE), that can tolerate private key and master key to be partially leaked.
By using our encoding mechanism, we obtain short ciphertext in LR-CP-ABE and short key in LR-KP-ABE. Also, our schemes have higher decryption efficiency in that the decryption cost is independent to the depth of access structures. Meanwhile, our proposed schemes provide the tolerance of both master key leakage and continual leakage in the sense that there are many master keys for universal set $\Sigma$ and many private keys per attribute set $\S$. We explicitly employ a refresh algorithm to update a (master) key while the leakage information will beyond the allowable leakage bound. The schemes are proven to be adaptively leakage-resilient secure in the standard model under the static assumptions in composite order bilinear groups.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/247" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A Lever Function to a New Codomain with Adequate Indeterminacy]]></title>
<updated>2013-05-03T02:26:51Z</updated>
<author><name><![CDATA[Shenghui Su]]></name></author>
<author><name><![CDATA[Maozhi Xu]]></name></author>
<author><name><![CDATA[Shuwang Lu]]></name></author>
<id>http://eprint.iacr.org/2013/246</id>
<category term="public-key cryptography / Public key cryptosystem; Coprime sequence; Lever function; Continued fraction attack; Random oracle"/>
<content><![CDATA[The key transforms of the REESSE1+ cryptosystem is Ci = (Ai * W ^ l(i)) ^ d (% M) with l(i) in O = {5, 7, ..., 2n + 3} for i = 1, ..., n, where l(i) is called a lever function. In this paper, the authors give a new codomain O± from {±5, ..., ±(n + 4)} and subjected to x + y != 0 for any x, y in O±, where "±x" means the coexistence of "+x" and "-x", which indicates that O± is indeterminate. Then, discuss the necessity and sufficiency of l(.) to W± for resisting continued fraction attack (CFA), prove indeterminacy and other properties of l(.) to O±, illustrate the ineffectualness of CFA by using two examples which show that some conditions are only necessary but not sufficient for the counteraction of powers of W and W ^ -1 even though O± = {5, ..., n + 4} is selected and known, analyze the time complexities of CFA and root finding attack with guess, and expound a relation between a lever function and a random oracle. Our research manifests that l(.) to W± makes it generally impossible to extract a private key from a flat public key Ci = Ai * W ^ l(i)(% M) for i = 1, ..., n in polynomial time.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/246" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The Fiat-Shamir Transformation in a Quantum World]]></title>
<updated>2013-05-03T02:25:12Z</updated>
<author><name><![CDATA[Özgür Dagdelen]]></name></author>
<author><name><![CDATA[Marc Fischlin]]></name></author>
<author><name><![CDATA[Tommaso Gagliardoni]]></name></author>
<id>http://eprint.iacr.org/2013/245</id>
<category term="foundations / Fiat-Shamir"/>
<category term="signature"/>
<category term="quantum random oracle model"/>
<content><![CDATA[The Fiat-Shamir transformation is a famous technique to turn identification schemes into signature schemes. The derived scheme is provably secure in the random-oracle model against classical adversaries. Still, the technique has also been suggested to be used in connection with quantum-immune identification schemes, in order to get quantum-immune signature schemes. However, a recent paper by Boneh et al. (Asiacrypt 2011) has raised the issue that results in the random-oracle model may not be immediately applicable to quantum adversaries, because such adversaries should be allowed to query the random oracle in superposition. It has been unclear if the Fiat-Shamir technique is still secure in this quantum oracle model (QROM).

Here, we discuss that giving proofs for the Fiat-Shamir transformation in the QROM is presumably hard. We show that there cannot be black-box extractors, as long as the underlying quantum-immune identification scheme is secure against active adversaries and the first message of the prover is independent of its witness. Most schemes are of this type. We then discuss that for some schemes one may be able to resurrect the Fiat-Shamir result in the QROM by modifying the underlying protocol first. We discuss in particular a version of the Lyubashevsky scheme which is provably secure in the QROM.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/245" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cryptographic schemes, key exchange, public key.]]></title>
<updated>2013-05-03T02:24:38Z</updated>
<author><name><![CDATA[Ted Hurley]]></name></author>
<id>http://eprint.iacr.org/2013/244</id>
<category term="implementation / general cryptography"/>
<category term="key exchange"/>
<category term="public key"/>
<category term="with coding"/>
<content><![CDATA[ General cryptographic schemes  are presented where keys can be one-time or ephemeral. Processes for key exchange are derived. Public key cryptographic schemes based on the new systems are established. Authentication and signature schemes are easy to implement.    
The schemes may be integrated with error-correcting  coding schemes   
so that encryption/coding and decryption/decoding may
be done simultaneously.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/244" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A Simple ORAM]]></title>
<updated>2013-05-03T02:22:10Z</updated>
<author><name><![CDATA[Kai-Min Chung]]></name></author>
<author><name><![CDATA[Rafael Pass]]></name></author>
<id>http://eprint.iacr.org/2013/243</id>
<category term="foundations / Oblivious RAM"/>
<content><![CDATA[
In this short note, we demonstrate a simple and practical ORAM that enjoys an extremely simple proof of security. Our construction is based on a recent ORAM due to Shi, Chan, Stefanov and Li (Asiacrypt'11), but
with some crucial modifications, which significantly simply the analysis.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/243" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[AE5 Security Notions: Definitions Implicit in the CAESAR Call]]></title>
<updated>2013-05-09T09:53:51Z</updated>
<author><name><![CDATA[Chanathip Namprempre]]></name></author>
<author><name><![CDATA[Phillip Rogaway]]></name></author>
<author><name><![CDATA[Tom Shrimpton]]></name></author>
<id>http://eprint.iacr.org/2013/242</id>
<category term="secret-key cryptography / "/>
<content><![CDATA[A draft call for the CAESAR authenticated-encryption competition adopts an interface that is not aligned with existing definitions in the literature. It is the purpose of this brief note to formalize what we believe to be the intended definitions.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/242" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The Perils of Repeating Patterns: Observation of Some Weak Keys in RC4]]></title>
<updated>2013-05-03T02:20:24Z</updated>
<author><name><![CDATA[Joachim Strömbergson]]></name></author>
<author><name><![CDATA[Simon Josefsson]]></name></author>
<id>http://eprint.iacr.org/2013/241</id>
<category term="secret-key cryptography / RC4"/>
<category term="KSA"/>
<category term="weak keys"/>
<category term="cryptanalysis"/>
<category term="stream cipher"/>
<category term="pseudo randomness"/>
<content><![CDATA[We describe some observed trivially weak keys for the stream cipher RC4.

Keys with repeating patterns are found to be key length invariant. The cause of the problem is the simplistic key dependent state permutation in the RC4 initialization.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/241" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Algebraic analysis of Trivium-like ciphers]]></title>
<updated>2013-04-29T05:37:12Z</updated>
<author><name><![CDATA[Sui-Guan Teo]]></name></author>
<author><name><![CDATA[Kenneth Koon-Ho Wong]]></name></author>
<author><name><![CDATA[Harry Bartlett]]></name></author>
<author><name><![CDATA[Leonie Simpson]]></name></author>
<author><name><![CDATA[Ed Dawson]]></name></author>
<id>http://eprint.iacr.org/2013/240</id>
<category term="secret-key cryptography / Stream ciphers"/>
<category term="Trivium"/>
<category term="Trivium-N"/>
<category term="Bivium-A"/>
<category term="Bivium-B"/>
<category term="algebraic attacks"/>
<content><![CDATA[Trivium is a bit-based stream cipher in the final portfolio of the eSTREAM project. In this paper, we apply the approach of Berbain et al. to Trivium-like ciphers and perform new algebraic analyses on them, namely Trivium and its reduced versions: Trivium-N, Bivium-A and Bivium-B. In doing so, we answer an open question in the literature. We demonstrate a new algebraic attack on Bivium-A.  This attack requires less time and memory than previous
techniques which use the F4 algorithm to recover Bivium-A's initial state. Though our attacks on Bivium-B, Trivium and Trivium-N are worse than exhaustive keysearch, the systems of equations which are constructed are smaller and less complex compared to previous algebraic analysis.  Factors which can affect the complexity of our attack on Trivium-like ciphers are discussed in detail.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/240" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Optimizing ORAM and Using it Efficiently for Secure Computation]]></title>
<updated>2013-04-29T05:36:25Z</updated>
<author><name><![CDATA[Craig Gentry]]></name></author>
<author><name><![CDATA[Kenny Goldman]]></name></author>
<author><name><![CDATA[Shai Halevi]]></name></author>
<author><name><![CDATA[Charanjit Julta]]></name></author>
<author><name><![CDATA[Mariana Raykova]]></name></author>
<author><name><![CDATA[Daniel Wichs]]></name></author>
<id>http://eprint.iacr.org/2013/239</id>
<category term="cryptographic protocols / oblivious RAM"/>
<content><![CDATA[Oblivious RAM (ORAM) allows a client to access her data on a remote server while hiding the access pattern (which locations she is accessing) from the server. Beyond its immediate utility in allowing private computation over a client's outsourced data, ORAM also allows mutually distrustful parties to run secure-computations over their joint data with sublinear on-line complexity. In this work we revisit the tree-based ORAM of Shi et al. [SCSL11] and show how to optimize its performance as a stand-alone scheme, as well as its performance within higher level constructions. More specifically, we make several contributions:

- We describe two optimizations to the tree-based ORAM protocol of Shi et al., one reducing the storage overhead of that protocol by an $O(k)$ multiplicative factor, and another reducing its time complexity by an $O(\log k)$ multiplicative factor, where $k$ is the security parameter. Our scheme also enjoys a much simpler and tighter analysis than the original protocol.

- We describe a protocol for binary search over this ORAM construction, where the entire binary search operation is done in the same complexity as a single ORAM access (as opposed to $\log n$ accesses for the naive protocol). We then describe simple uses of this binary-search protocol for things like range queries and keyword search.

- We show how the ORAM protocol itself and our binary-search protocol can be implemented efficiently as secure computation, using somewhat-homomorphic encryption.

Since memory accesses by address (ORAM access) or by value (binary search) are basic and prevalent operations, we believe that these optimizations can be used to significantly speed-up many higher-level protocols for secure computation.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/239" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Type-Based Analysis of Generic Key Management APIs (Long Version)]]></title>
<updated>2013-05-01T12:10:51Z</updated>
<author><name><![CDATA[Pedro Adão]]></name></author>
<author><name><![CDATA[Riccardo Focardi]]></name></author>
<author><name><![CDATA[Flaminia L. Luccio]]></name></author>
<id>http://eprint.iacr.org/2013/237</id>
<category term="foundations / Key-Management APIs"/>
<category term="Secure Hardware"/>
<category term="Type-based Analysis"/>
<category term="PKCS#11"/>
<content><![CDATA[In the past few years, cryptographic key management APIs have been shown to be subject to tricky attacks based on the improper use of cryptographic keys. 
In fact, real APIs provide mechanisms to declare the intended use of keys but they are not strong enough to provide key security. 
In this paper, we propose a simple imperative programming language for specifying strongly-typed APIs for the management of symmetric, 
asymmetric and signing keys. The language requires that type information is stored together with the key but it is independent of the actual 
low-level implementation. We develop a type-based analysis to prove the preservation of integrity and confidentiality of sensitive keys and 
we show that our abstraction is expressive enough to code realistic key management APIs.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/237" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Attacks on JH, Grøstl and SMASH Hash Functions]]></title>
<updated>2013-05-03T02:45:07Z</updated>
<author><name><![CDATA[Yiyuan Luo]]></name></author>
<author><name><![CDATA[Xuejia Lai]]></name></author>
<id>http://eprint.iacr.org/2013/233</id>
<category term="Hash Functions"/>
<category term="SHA-3"/>
<category term="JH"/>
<category term="Grøstl"/>
<content><![CDATA[JH and Gr{\o}stl hash functions are two of the five finalists in NIST SHA-3 competition. JH-$s$ and Gr{\o}stl-$s$ are based on a $2n$ bit compression function and the final output is truncated to $s$ bits, where $n$ is $512$ and $s$ can be $224$,$256$,$384$ and $512$. Previous security proofs show that JH-$s$ and Gr{\o}stl-$s$ are optimal collision resistance without length padding to the last block.

In this paper we present significant collision and preimage attacks on JH-$s$ and Gr{\o}stl-$s$. For collision and preimage attack, the adversary needs $ 2^{s/4+l/2+1}$ and $2^{(s+l)/2+1}$ queries to the underlying compression function respectively, where $l$ denotes the encoded bit length of the message; for JH, $l=128$ and for Gr{\o}stl, $l=64$.

If the message length is not padded to the last message block, for $s=224$, the attacker only needs $2^{57}$ and $2^{113}$ compression function queries to mount a collision attack and preimage attack respectively.

For the real JH and Gr{\o}stl, the message length is encoded into 128 and 64 bits respectively. For JH-512, the collision and preimage attack needs $2^{193}$ and $2^{321}$ queries to the compression function respectively. For Gr{\o}stl-512, the collision and preimage attack needs $2^{163}$ and $2^{289}$ queries to the compression function respectively.

Our attacks exploit structure flaws in the design of JH and Gr{\o}stl. It is easily applied to MJH and SMASH since they have similar structure (we call it Evan-Mansour structure) as the above hash functions. At the same time the provable security of chopMD in the literature is challenged. Through our attack, it is easy to see that the chopMD mode used in JH or Gr{\o}stl does not improve its security against collision and preimage attack. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/233" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Public key exchange using semidirect product of (semi)groups]]></title>
<updated>2013-05-01T05:02:05Z</updated>
<author><name><![CDATA[Maggie Habeeb]]></name></author>
<author><name><![CDATA[Delaram Kahrobaei]]></name></author>
<author><name><![CDATA[Charalambos Koupparis]]></name></author>
<author><name><![CDATA[Vladimir Shpilrain]]></name></author>
<id>http://eprint.iacr.org/2013/226</id>
<category term="public-key cryptography / public key exchange"/>
<content><![CDATA[In this paper, we describe a brand new key exchange protocol based on a semidirect product of (semi)groups (more specifically, on extension of a (semi)group by automorphisms), and then focus on practical instances of this general idea. Our protocol can be based on any group, in particular on any non-commutative group. One of its special cases is the standard Diffie-Hellman protocol, which is based on a cyclic group. However, when our protocol is used with a non-commutative (semi)group, it acquires several useful features that make it compare favorably to the Diffie-Hellman protocol. Here we also suggest a particular non-commutative semigroup (of matrices) as the platform and show that security of the relevant protocol is based on a quite different assumption compared to that of the standard Diffie-Hellman protocol.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/226" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The PACE|AA Protocol for Machine Readable Travel Documents, and its Security]]></title>
<updated>2013-05-05T02:05:59Z</updated>
<author><name><![CDATA[Jens Bender]]></name></author>
<author><name><![CDATA[Özgür Dagdelen]]></name></author>
<author><name><![CDATA[Marc Fischlin]]></name></author>
<author><name><![CDATA[Dennis Kügler]]></name></author>
<id>http://eprint.iacr.org/2013/223</id>
<category term="cryptographic protocols / ePassports"/>
<category term="key exchange"/>
<category term="deniability"/>
<content><![CDATA[We discuss an efficient combination of the cryptographic protocols adopted by the International Civil Aviation Organization (ICAO) for securing the communication of machine readable travel documents and readers. Roughly, in the original protocol the parties first run the
Password-Authenticated Connection Establishment (PACE) protocol to establish a shared key and then the reader (optionally) invokes the Active Authentication (AA) protocol to verify the passport's validity. Here, we show that by carefully re-using some of the secret data of the PACE protocol for the AA protocol one can save one exponentiation on the passports's side. We call this the PACE|AA protocol. We then formally prove that this more efficient combination not only preserves the desirable security properties of the two individual protocols but also increases privacy by preventing misuse of the challenge in the Active Authentication protocol. We finally discuss a solution which allows deniable authentication in the sense that the interaction cannot be used as a proof towards third parties.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/223" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Optical PUFs Reloaded]]></title>
<updated>2013-05-10T00:54:22Z</updated>
<author><name><![CDATA[Ulrich Rührmair]]></name></author>
<author><name><![CDATA[Christian Hilgers]]></name></author>
<author><name><![CDATA[Sebastian Urban]]></name></author>
<author><name><![CDATA[Agnes Weiershäuser]]></name></author>
<author><name><![CDATA[Elias Dinter]]></name></author>
<author><name><![CDATA[Brigitte Forster]]></name></author>
<author><name><![CDATA[Christian Jirauschek]]></name></author>
<id>http://eprint.iacr.org/2013/215</id>
<category term="Optical Physical Unclonable Functions (PUFs)"/>
<category term="Machine Learning"/>
<category term="Implementation"/>
<content><![CDATA[We revisit optical physical unclonable functions (PUFs), which were
proposed by Pappu et al. in their seminal first publication on PUFs
[40, 41]. The first part of the paper treats non-integrated optical
PUFs. Their security against modeling attacks is analyzed, and we
discuss new image transformations that maximize the PUF's out-
put entropy while possessing similar error correction capacities as
previous approaches [40, 41]. Furthermore, the influence of us-
ing more than one laser beam, varying laser diameters, and smaller
scatterer sizes is systematically studied. Our findings enable the
simple enhancement of an optical PUF's security without addi-
tional hardware costs. Next, we discuss the novel application of
non-integrated optical PUFs as so-called "Certifiable PUFs". The
latter are useful to achieve practical security in advanced PUF-pro-
tocols, as recently observed by Rührmair and van Dijk at Oakland
2013 [48]. Our technique is the first mechanism for Certifiable
PUFs in the literature, answering an open problem posed in [48].

In the second part of the paper, we turn to integrated optical
PUFs. We build the first prototype of an integrated optical PUF
that functions without moving components and investigate its se-
curity. We show that these PUFs can surprisingly be attacked by
machine learning techniques if the employed scattering structure is
linear, and if the raw interference images of the PUF are available
to the adversary. Our result enforces the use of non-linear scattering
structures within integrated PUFs. The quest for suitable materials is identified as a central, but currently open research problem. 

Our work makes intensive use of two prototypes of optical PUFs. The
presented integratable optical PUF prototype is, to our knowledge,
the first of its kind in the literature.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/215" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Non-malleable Codes from Additive Combinatorics]]></title>
<updated>2013-05-13T10:41:58Z</updated>
<author><name><![CDATA[Divesh Aggarwal]]></name></author>
<author><name><![CDATA[Yevgeniy Dodis]]></name></author>
<author><name><![CDATA[Shachar Lovett]]></name></author>
<id>http://eprint.iacr.org/2013/201</id>
<category term="applications / Non malleable codes"/>
<category term=" Combinatorics"/>
<content><![CDATA[Non-malleable codes provide a useful and meaningful security guarantee in situations where traditional error-correction (and even error-detection) is impossible; for example, when the attacker can completely overwrite the encoded message. Informally, a code is non-malleable if the message contained in a modified codeword is either the original message, or a completely unrelated value. Although such codes do not exist if the family of "tampering functions" \cF is completely unrestricted, they are known to exist for many broad tampering families \cF. One such natural family is the family of tampering functions in the so called {\em split-state} model. Here the message m is encoded into two shares L and R, and the attacker is allowed to arbitrarily tamper with L and R {\em individually}. The split-state tampering arises in many realistic applications, such as the design of non-malleable secret sharing schemes, motivating the question of designing efficient non-malleable codes in this model.

Prior to this work, non-malleable codes in the split-state model received considerable attention in the literature, but were either (1) constructed in the random oracle model [DPW10], or (2) relied on advanced cryptographic assumptions (such as non-interactive zero-knowledge proofs and leakage-resilient encryption) [LL12], or (3) could only encode 1-bit messages [DKO13]. As our main result, we build the first efficient, multi-bit, information-theoretically-secure non-malleable code in the split-state model.

The heart of our construction uses the following new property of the inner-product function <L,R> over the vector space F_p^n (for any prime p and large enough dimension n): if L and R are uniformly random over F_p^n, and f,g: F_p^n \rightarrow F_p^n are two arbitrary functions on L and R, the joint distribution (<L,R>,<f(L),g(R)>) is ``close'' to the convex combination of "affine distributions" {(U,c U+d)| c,d \in F_p}, where U is uniformly random in F_p. In turn, the proof of this surprising property of the inner product function critically relies on some results from additive combinatorics, including the so called {\em Quasi-polynomial Freiman-Ruzsa Theorem} (which was recently established by Sanders [San12] as a step towards resolving the Polynomial Freiman-Ruzsa conjecture [Gre05]).
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/201" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the evaluation of modular polynomials]]></title>
<updated>2013-05-07T10:25:54Z</updated>
<author><name><![CDATA[Andrew V. Sutherland]]></name></author>
<id>http://eprint.iacr.org/2013/181</id>
<category term="public-key cryptography / elliptic curves"/>
<category term="isogenies"/>
<content><![CDATA[We present two algorithms that, given a prime ell and an elliptic curve E/Fq, directly compute the polynomial $\Phi_\ell(j(E),Y)\in\Fq[Y] whose roots are the j-invariants of the elliptic curves that are ell-isogenous to E. We do not assume that the modular polynomial Phi_ell(X,Y) is given. The algorithms may be adapted to handle other types of modular polynomials, and we consider applications to point counting and the computation of endomorphism rings.  We demonstrate the practical efficiency of the algorithms by setting a new point-counting record, modulo a prime q with more than 5,000 decimal digits, and by evaluating a modular polynomial of level ell=100,019.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/181" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A generic construction for voting correctness at minimum cost - Application to Helios]]></title>
<updated>2013-05-15T06:26:09Z</updated>
<author><name><![CDATA[Veronique Cortier]]></name></author>
<author><name><![CDATA[David Galindo]]></name></author>
<author><name><![CDATA[Stephane Glondu]]></name></author>
<author><name><![CDATA[Malika Izabachene]]></name></author>
<id>http://eprint.iacr.org/2013/177</id>
<category term="cryptographic protocols / voting protocols"/>
<category term="Helios"/>
<category term="correctness"/>
<category term="full correctness"/>
<category term="verifiability"/>
<category term="ballot privacy"/>
<category term="fully distributed threshold cryptosystem"/>
<category term="implementation"/>
<content><![CDATA[Most voting schemes aim at providing verifiability: voters should be able to check that their ballots did contribute to the outcome (individual verifiability) and that the tallying authorities did their job properly (universal verifiability).  Surprisingly, verifiability still does not answer a very simple and natural question: how can I be sure that the published result corresponds to the (sum of) intended votes of the voters? This property is called correctness by Juels, Catalano, and Jakobsson. Actually, even a prominent voting system like Helios does not achieve correctness in the case of a dishonest bulletin board, since it may add ballots.

We generalize the aforementioned definition of correctness to account for a malicious bulletin board (full correctness) and we provide a generic construction that transforms a correct voting scheme into a fully correct voting scheme. This construction simply requires to send credentials to the voters, with no additional infrastructure. We further provide a simple and natural criteria that implies voting correctness, which can then be turned into full correctness due to our construction. As an application, we build a variant of Helios that is both fully correct, verifiable and private.

Real-world elections often require threshold cryptosystems so that any t out of l trustees can proceed to tallying. We describe a fully distributed (with no dealer) threshold cryptosystem suitable for Helios (in particular, suitable to partial decryption). In doing so we happen to revisit the seminal multi-authority election system from Cramer, Gennaro and Schoenmakers. Altogether, we provide the first proof of privacy, verifiability and correctness for a fully distributed Helios voting scheme (and its enhanced version with credentials), together with its detailed description. This also implies, to our knowledge, the first formal proofs of privacy, verifiability and correctness for the scheme by Cramer et al. Last but not least, we provide an open source implementation of our variant of Helios.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/177" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Completeness Theorems for All Finite Stateless 2-Party Primitives]]></title>
<updated>2013-05-08T11:24:01Z</updated>
<author><name><![CDATA[Daniel Kraschewski]]></name></author>
<id>http://eprint.iacr.org/2013/161</id>
<category term="foundations / oblivious transfer"/>
<category term="complete primitives"/>
<category term="information-theoretic security"/>
<category term="universal composability"/>
<category term="secure function evaluation"/>
<content><![CDATA[Since Kilian showed in 1988 that oblivious transfer (OT) is complete in the sense that every secure multi-party computation can be realized from this primitive, cryptographers are working on reductions of OT to various other primitives. A long-standing open question in this context is the classification of finite stateless 2-party primitives (so-called "cryptogates"), i.e. trusted black boxes that can be jointly queried by two parties, have finite input and output alphabets, and do not change behavior depending on time or input history. Over the decades, completeness criteria have been found for deterministic cryptogates (i.e. primitives without internal randomness), noisy channels, and symmetric (i.e., both parties receive the same output) or asymmetric (i.e., only one party receives any output at all) randomized cryptogates. However, the known criteria for randomized primitives other than noisy channels only hold in presence of passive adversaries (i.e., even corrupted parties still follow the protocol).

We complete this line of research by providing simple but comprehensive combinatorial completeness criteria for ALL finite stateless 2-party primitives. I.e., for the first time there are completeness criteria for randomized primitives that are neither symmetric nor asymmetric (but give different outputs to the querying parties), and we overcome the limitation that previous results for randomized primitives with input from BOTH parties only regarded passive adversaries. A fundamental tool of our approach is a powerful lemma from real algebraic geometry, which allows us to base a cryptographic security proof on a rather "game-theoretic" approach.

As a corollary of our work, every non-complete example of a finite stateless 2-party primitive is essentially symmetric. This relationship between non-completeness and symmetric output behavior was previously only known for deterministic cryptogates.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/161" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[MiniLEGO: Efficient Secure Two-Party Computation From General Assumptions]]></title>
<updated>2013-04-29T03:32:11Z</updated>
<author><name><![CDATA[Tore Kasper Frederiksen]]></name></author>
<author><name><![CDATA[Thomas Pelle Jakobsen]]></name></author>
<author><name><![CDATA[Jesper Buus Nielsen]]></name></author>
<author><name><![CDATA[Peter Sebastian Nordholt]]></name></author>
<author><name><![CDATA[Claudio Orlandi]]></name></author>
<id>http://eprint.iacr.org/2013/155</id>
<category term="cryptographic protocols / Garbled circuits"/>
<category term="cut-and-choose"/>
<category term="error correcting codes"/>
<content><![CDATA[One of the main tools to construct secure two-party computation protocols are Yao garbled circuits. Using the cut-and-choose technique, one can get reasonably efficient Yao-based protocols with security against malicious adversaries. At TCC 2009, Nielsen and Orlandi suggested to apply cut-and-choose at the gate level, while previously cut-and-choose was applied on the circuit as a whole. This appealing idea allows for a speed up with practical  significance (in the order of the logarithm of the size of the circuit) and has become known as the ``LEGO'' construction. Unfortunately the construction by Nielsen and Orlandi is based on  a specific number-theoretic assumption and requires public-key operations per gate of the circuit.

The main technical contribution of this work is a new  XOR-homomorphic commitment scheme based on oblivious transfer, that we use to cope with the problem of connecting the gates in the LEGO construction. Our new protocol has the following advantages:
\begin{enumerate}

\item 
  
It maintains the efficiency of the LEGO cut-and-choose.

\item 
  
After a number of seed oblivious transfers linear in the security parameter, the construction uses only primitives from Minicrypt (i.e., private-key cryptography) per gate in the circuit (hence the name MiniLEGO).

\item 
  
On the contrary of original LEGO, MiniLEGO is compatible with all known optimization for Yao garbled gates (row reduction, free-XORs, point-and-permute).

\end{enumerate}
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/155" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Optimal Suspicion Functions for Tardos Traitor Tracing Schemes]]></title>
<updated>2013-05-06T03:30:47Z</updated>
<author><name><![CDATA[Jan-Jaap Oosterwijk]]></name></author>
<author><name><![CDATA[Boris Skoric]]></name></author>
<author><name><![CDATA[Jeroen Doumen]]></name></author>
<id>http://eprint.iacr.org/2013/154</id>
<category term="Traitor tracing"/>
<content><![CDATA[We investigate alternative suspicion functions for Tardos traitor tracing schemes. In the simple decoder approach (computation of a score for every user independently) we derive suspicion functions that optimize a performance indicator related to the sufficient code length $\ell$ in the limit of large coalition size $c$. Our results hold for the Restricted-Digit Model as well as the Combined-Digit Model. The scores depend on information that is usually not available
to the tracer -- the attack strategy or the tallies of the symbols received by the colluders. We discuss how such results can be used in realistic contexts.

We study several combinations of coalition attack strategy vs. suspicion function optimized against some attack (another attack or the same). In many of these combinations the usual scaling $\ell \propto c^2$ is replaced by a lower power of $c$, e.g. $c^{3/2}$. We find that the interleaving strategy is an especially
powerful attack, and the suspicion function tailored against interleaving is effective against all considered attacks.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/154" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Blank Digital Signatures]]></title>
<updated>2013-05-07T06:16:08Z</updated>
<author><name><![CDATA[Christian Hanser]]></name></author>
<author><name><![CDATA[Daniel Slamanig]]></name></author>
<id>http://eprint.iacr.org/2013/130</id>
<category term="public-key cryptography / Digital signature scheme"/>
<category term="blank digital signatures"/>
<category term="elliptic curves"/>
<category term="pairings"/>
<category term="polynomial commitments"/>
<content><![CDATA[In this paper we present a novel type of digital signatures, which we call blank digital signatures. The basic idea behind this scheme is that an 
originator can define and sign a message template, describing fixed parts of a message as well as multiple choices for exchangeable 
parts of a message. One may think of a form with blank fields, where for such fields the originator specifies all the allowed strings to choose from. Then, a proxy is given 
the power to sign an instantiation of the template signed by the originator by using some secret information. By an instantiation, the proxy
commits to one allowed choice per blank field in the template.
The resulting message signature can be publicly verified under the originator's and the proxy's signature verification keys. 
Thereby, no verifying party except the originator and the proxy learn anything about the ``unused'' choices from the message template given a message signature. Consequently, the template is hidden from verifiers.

We discuss several applications, provide a formal definition of blank digital signature schemes and introduce a security model. Furthermore, we provide an efficient construction of such a blank digital signature scheme from any secure digital signature scheme, pairing-friendly elliptic curves and polynomial commitments, which we prove secure in our model. We also provide a detailed efficiency analysis of our proposed construction supporting its practicality. Finally, we outline several open issues and extensions for future work.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/130" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Throughput Optimized Implementations of QUAD]]></title>
<updated>2013-05-13T10:28:53Z</updated>
<author><name><![CDATA[Jason R. Hamlet]]></name></author>
<author><name><![CDATA[Robert W. Brocato]]></name></author>
<id>http://eprint.iacr.org/2013/118</id>
<category term="QUAD"/>
<category term="stream cipher"/>
<category term="throughput optimization"/>
<category term="hardware acceleration"/>
<content><![CDATA[We present several software and hardware implementations of QUAD, a recently introduced stream cipher designed to be provably secure and practical to implement. The software implementations target both a personal computer and an ARM microprocessor. The hardware implementations target field programmable gate arrays. The purpose of our work was to first find the baseline performance of QUAD implementations, then to optimize our implementations for throughput. Our software implementations perform comparably to prior work. Our hardware implementations are the first known implementations to use random coefficients, in agreement with QUAD's security argument, and achieve much higher throughput than prior implementations.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/118" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A Conditional Proxy Broadcast Re-Encryption Scheme Supporting Timed-Release]]></title>
<updated>2013-05-05T20:26:16Z</updated>
<author><name><![CDATA[Kaitai Liang]]></name></author>
<author><name><![CDATA[Qiong Huang]]></name></author>
<author><name><![CDATA[Roman Schlegel]]></name></author>
<author><name><![CDATA[Duncan S. Wong]]></name></author>
<author><name><![CDATA[Chunming Tang]]></name></author>
<id>http://eprint.iacr.org/2013/115</id>
<category term="timed-release encryption"/>
<category term="unidirectional conditional proxy broadcast re-encryption"/>
<category term="bilinear map."/>
<content><![CDATA[To allow a delegator not only to delegate the keyword-controlled
decryption rights of a broadcast encryption to a set of specied recipi-
ents, but also to control when the decryption rights will be delegated, in this paper, for the rst time, we introduce a new notion called Timed-
Release Conditional Proxy Broadcast Re-Encryption (TR-CPBRE). We
also propose a concrete construction for TR-CPBRE which can be proven
selective identity adaptive CCA secure under the (P; Q; f)-general de-
cisional Die-Hellman exponent assumption, and chosen-time period
chosen-ciphertext secure under the bilinear Die-Hellman assumption.
When compared with the existing CPBRE and Timed-Release Proxy
Re-Encryption (TR-PRE) schemes, our scheme achieves better eciency,
and enables the delegator to make a ne-grained delegation of decryption
rights to multiple delegatees.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/115" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Indifferentiability of Key-Alternating Ciphers]]></title>
<updated>2013-05-09T01:50:17Z</updated>
<author><name><![CDATA[Elena Andreeva]]></name></author>
<author><name><![CDATA[Andrey Bogdanov]]></name></author>
<author><name><![CDATA[Yevgeniy Dodis]]></name></author>
<author><name><![CDATA[Bart Mennink]]></name></author>
<author><name><![CDATA[John P. Steinberger]]></name></author>
<id>http://eprint.iacr.org/2013/061</id>
<category term="foundations / Even-Mansour"/>
<category term="ideal cipher"/>
<category term="key alternating cipher"/>
<category term="indifferentiability"/>
<content><![CDATA[The Advanced Encryption Standard (AES) is the most widely used block cipher. The high level structure of AES can be viewed as a (10-round) key-alternating cipher, where a t-round key-alternating cipher KA_t consists of a small number $t$ of fixed permutations P_i on n bits, separated by key addition:

KA_t(K,m)= k_t + P_t(... k_2 + P_2(k_1 + P_1(k_0 + m))...),

where (k_0,...,k_t) are obtained from the master key K using some key derivation function.

For t=1, KA_1 collapses to the well-known Even-Mansour cipher, which is known to be indistinguishable from a (secret) random permutation, if P_1 is modeled as a (public) random permutation. In this work we seek for stronger security of key-alternating ciphers --- indifferentiability from an ideal cipher --- and
ask the question under which  conditions on the key derivation function and for how many rounds t is the key-alternating cipher KA_t indifferentiable from the ideal cipher, assuming P_1,...,P_t are (public) random permutations?

As our main result, we give an affirmative answer for t=5, showing that the 5-round key-alternating cipher KA_5 is indifferentiable from an ideal cipher, assuming P_1,...,P_5 are five independent random permutations, and the key derivation function sets all rounds keys
k_i=f(K), where 0<= i<= 5 and f is modeled as a random oracle. Moreover, when |K|=|m|, we show we can set f(K)=P_0(K)+K, giving an n-bit block cipher with an n-bit key, making only six calls to n-bit permutations P_0,P_1,P_2,P_3,P_4,P_5.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/061" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Fast and Maliciously Secure Two-Party Computation Using the GPU]]></title>
<updated>2013-04-29T03:34:52Z</updated>
<author><name><![CDATA[Tore Kasper Frederiksen]]></name></author>
<author><name><![CDATA[Jesper Buus Nielsen]]></name></author>
<id>http://eprint.iacr.org/2013/046</id>
<category term="cryptographic protocols / implementation"/>
<category term="two-party computation"/>
<content><![CDATA[We describe, and implement, a maliciously secure protocol for secure two-party computation, based on Yao's garbled circuit and an efficient OT extension, in a parallel computational model. The implementation is done using CUDA and yields the fastest results for maliciously secure two-party computation in a realistic and practical setting by using a simple consumer grade CPU and GPU. Our protocol further introduces some novel constructions in order to combine garbled circuits and an OT extension in a parallel and maliciously secure setting.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/046" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[An Analysis of the EMV Channel Establishment Protocol]]></title>
<updated>2013-05-08T11:49:04Z</updated>
<author><name><![CDATA[Christina Brzuska]]></name></author>
<author><name><![CDATA[Nigel P. Smart]]></name></author>
<author><name><![CDATA[Bogdan Warinschi]]></name></author>
<author><name><![CDATA[Gaven J. Watson]]></name></author>
<id>http://eprint.iacr.org/2013/031</id>
<category term="applications / "/>
<content><![CDATA[With over 1.5~billion debit and credit cards in use worldwide, the EMV system (a.k.a. ``Chip-and-PIN'') has become one of the most important deployed cryptographic protocol suites. Recently, the EMV consortium has decided to upgrade the existing RSA based system with a new system relying on Elliptic Curve Cryptography (ECC). One of the central components of the new system is a protocol that enables a card to establish a secure channel with a card reader. In this paper we provide a security analysis of the proposed protocol, we propose minor changes/clarifications to the ``Request for Comments'' issued in Nov 2012, and demonstrate that the resulting protocol meets the intended security goals. 

The structure of the protocol is one commonly encountered in practice: first run a key-exchange to establish a shared key (which performs authentication and key confirmation), only then use the channel to exchange application messages. Although common in practice, this structure takes the protocol out of the reach of most standard security models for key-exchange. Unfortunately, the only models that can cope with the above structure suffer from some drawbacks that make them unsuitable for our analysis. Our second contribution is to provide new security models for channel establishment protocols. Our models have a more inclusive syntax, are quite general, deal with a realistic notion of authentication (one-sided authentication as required by EMV), and do not suffer from the drawbacks that we identify in prior models.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/031" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[RSA private key reconstruction from random bits using SAT solvers]]></title>
<updated>2013-05-07T10:22:40Z</updated>
<author><name><![CDATA[Constantinos Patsakis]]></name></author>
<id>http://eprint.iacr.org/2013/026</id>
<category term="SAT solvers"/>
<category term="RSA"/>
<category term="partial key exposure"/>
<category term="factoring"/>
<category term="public-key cryptography"/>
<content><![CDATA[SAT solvers are being used more and more in Cryptanalysis. Their efficiency varies depending on the structure of the algorithm they are applied to. However, when it comes to integer factorization, or more specially the RSA problem, SAT solvers prove to be at least inefficient. The running times are too long to be compared with any well known integer factorization algorithm, even when it comes to small RSA moduli numbers. 

The recent work on cold boot attacks has sparkled again the interest
on partial key exposure attacks and RSA key reconstruction. In
this work, contrary to the search tree or lattice-based approaches that most of these works use, SAT solvers are used. The focus is on the study of two scenarios, one where there is disclosure of random bits of $p$ and $q$ and one for the case where the public exponent $e$ is equal to three. In both cases, we provide a more efficient modeling of RSA as an instance of a satisfiability problem, and manage to reconstruct the private key, given a part of the key, even for public keys of 1024 bits in few seconds.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/026" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On formal and automatic security verification of WSN transport protocols]]></title>
<updated>2013-05-09T05:37:12Z</updated>
<author><name><![CDATA[Ta Vinh Thong]]></name></author>
<author><name><![CDATA[ Amit Dvir]]></name></author>
<id>http://eprint.iacr.org/2013/014</id>
<category term="cryptographic protocols / Transport protocols for Wireless Sensor Networks"/>
<category term="Security"/>
<category term="Cryptographic protocol"/>
<category term="Formal verification"/>
<category term="Automated verification"/>
<category term="Probabilistic Timed Calculus  "/>
<content><![CDATA[In this paper, we address the problem of formal and automated security verification of WSN transport 
protocols that may perform cryptographic operations. The verification of this class of protocols is difficult 
because they typically consist of complex behavioral characteristics, such as real-time, probabilistic, and 
cryptographic operations. To solve this problem, we propose a 
probabilistic timed calculus for cryptographic protocols, and demonstrate how to use this formal language 
for proving security or vulnerability of protocols. The main advantage of the proposed language is that it 
supports an expressive syntax and semantics, including bisimilarities that supports real-time, probabilistic, 
and cryptographic issues at the same time. Hence, it can be used to verify the systems that involve these three 
property in a more convenient way. In addition, we propose an automatic verification method, based on the 
well-known PAT process analysis toolkit, for this class of protocols. 
For demonstration purposes, we apply the proposed manual and automatic proof methods for verifying the security of 
DTSN and SDTP, which are two of the recently proposed WSN tranport protocols. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2013/014" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Reusable Garbled Circuits and Succinct Functional Encryption]]></title>
<updated>2013-05-12T20:36:25Z</updated>
<author><name><![CDATA[Shafi Goldwasser]]></name></author>
<author><name><![CDATA[Yael Kalai]]></name></author>
<author><name><![CDATA[Raluca Ada Popa]]></name></author>
<author><name><![CDATA[Vinod Vaikuntanathan]]></name></author>
<author><name><![CDATA[Nickolai Zeldovich]]></name></author>
<id>http://eprint.iacr.org/2012/733</id>
<category term="functional encryption"/>
<content><![CDATA[Garbled circuits, introduced by Yao in the mid 80s, allow computing a
function f on an input x without leaking anything  about f or x besides f(x). Garbled circuits found numerous applications, but every known construction suffers from one limitation: it offers no security if used on multiple inputs x.  In this paper, we construct for the first time reusable garbled circuits. The key building block is a new  succinct single-key functional encryption scheme.

Functional encryption is an ambitious primitive: given an encryption
Enc(x) of a value x, and a secret key sk_f for a function f, anyone can compute f(x) without learning any other information about x. We
construct, for the first time, a succinct functional encryption
scheme for any polynomial-time function f where succinctness means
that the ciphertext size does not grow with the size of the circuit for f, but only with its depth. The security of our construction is based on the intractability of the Learning with Errors (LWE) problem and holds as long as an adversary has access to a single key sk_f (or even an a priori bounded number of keys for different functions).

Building on our succinct single-key functional encryption scheme, we
show several new applications in addition to reusable garbled circuits, such as a paradigm for general function obfuscation which we call token-based obfuscation, homomorphic encryption for a class of Turing machines where the evaluation runs in input-specific time rather than worst-case time, and a  scheme for delegating computation which is publicly verifiable and maintains the privacy of the computation.


]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/733" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Complexity of the BKW Algorithm on LWE]]></title>
<updated>2013-05-07T14:56:08Z</updated>
<author><name><![CDATA[Martin R. Albrecht]]></name></author>
<author><name><![CDATA[Carlos Cid]]></name></author>
<author><name><![CDATA[Jean-Charles Faugère]]></name></author>
<author><name><![CDATA[Robert Fitzpatrick]]></name></author>
<author><name><![CDATA[Ludovic Perret]]></name></author>
<id>http://eprint.iacr.org/2012/636</id>
<category term="foundations / learning with errors"/>
<category term="algorithm"/>
<content><![CDATA[This work presents a study of the complexity of the Blum-Kalai-Wasserman (BKW) algo- rithm when applied to the Learning with Errors (LWE) problem, by providing refined estimates for the data and computational effort requirements for solving concrete instances of the LWE problem. We apply this refined analysis to suggested parameters for various LWE-based cryptographic schemes from the literature and compare with alternative approaches based on lattice reduction. As a result, we provide new upper bounds for the concrete hardness of these LWE-based schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/636" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Generic Construction of Trace and Revoke Schemes]]></title>
<updated>2013-05-06T13:37:15Z</updated>
<author><name><![CDATA[Murat Ak]]></name></author>
<author><name><![CDATA[Aggelos Kiayias]]></name></author>
<author><name><![CDATA[Serdar Pehlivanoglu]]></name></author>
<author><name><![CDATA[Ali Aydin Selcuk]]></name></author>
<id>http://eprint.iacr.org/2012/531</id>
<category term="Digital rights management"/>
<category term="broadcast encryption"/>
<category term="traitor tracing"/>
<category term="fingerprinting codes."/>
<content><![CDATA[Broadcast encryption (BE) is a cryptographic primitive that allows a broadcaster to encrypt digital content to a privileged set of users and in this way prevent revoked users from accessing the content. In BE schemes, a group of users, called traitor s may leak their keys and enable an adversary to receive the content. Such malicious users can be detected through traitor tracing (TT) schemes. The ultimate goal in a content distribution system would be combining traitor tracing and broadcast encryption (resulting in a trace and revoke system) so that any receiver key found to be compromised in a tracing process would be revoked from future transmissions.

In this paper, we propose a generic method to transform a broadcast encryption scheme into a trace and revoke scheme. This transformation involves the utilization of a fingerprinting code over the underlying BE transmission. While fingerprinting codes have been used for constructing traitor tracing schemes in the past, their usage has various shortcomings such as the increase of the public key size with a linear factor in the length of the code. Instead, we propose a novel way to apply fingerprinting codes that allows for efficient parameters while retaining the traceability property. Our approach is based on a new property of fingerprinting codes we introduce, called public samplability.

We have instantiated our generic transformation with the BE schemes of [4, 13, 20] something that enables us to produce trace and revoke schemes with novel properties. Specifically, we show (i) a trace and revoke scheme with constant private key size and short ciphertext size, (ii) the first ID-based trace and revoke scheme, (iii) the first publicly traceable scheme with constant private key size and (iv) the first trace and revoke scheme against pirate rebroadcasting attack in the public key setting.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/531" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Information-Theoretic Timed-Release Security: Key-Agreement, Encryption, and Authentication Codes]]></title>
<updated>2013-05-07T22:53:10Z</updated>
<author><name><![CDATA[Yohei Watanabe]]></name></author>
<author><name><![CDATA[Takenobu Seito]]></name></author>
<author><name><![CDATA[Junji Shikata]]></name></author>
<id>http://eprint.iacr.org/2012/460</id>
<category term="cryptographic protocols / timed-release security"/>
<category term="information-theoretic security"/>
<category term="unconditional security"/>
<content><![CDATA[In this paper, we study timed-release cryptography with information-theoretic security. As fundamental cryptographic primitives with information-theoretic security, we can consider key-agreement, encryption, and authentication codes. Therefore, in this paper we deal with information-theoretic timed-release security for all those primitives. 
Specifically, we propose models and formalizations of security for information-theoretic timed-release key-agreement, encryption, and authentication codes; we also derive tight lower bounds on entities' memory-sizes required for all those ones; and we show optimal constructions of all those ones. Furthermore, we investigate a relationship of mechanisms between information-theoretic timed-release key-agreement and information-theoretic key-insulated key-agreement. It turns out that there exists a simple algorithm which converts the former into the latter, and vice versa. In the sense, we conclude that these two mechanisms are essentially close.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/460" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Improved CRT Algorithm for Class Polynomials in Genus 2]]></title>
<updated>2013-05-07T05:23:23Z</updated>
<author><name><![CDATA[Kristin Lauter]]></name></author>
<author><name><![CDATA[Damien Robert]]></name></author>
<id>http://eprint.iacr.org/2012/443</id>
<category term="Class polynomials"/>
<category term="genus 2"/>
<category term="CRT"/>
<content><![CDATA[We present a generalization to genus~2 of the probabilistic algorithm of
Sutherland for computing Hilbert class polynomials.  The improvement over
the Br{\"o}ker-Gruenewald-Lauter algorithm
for the genus~2 case is that we do not need to find a curve in the 
isogeny class whose endomorphism ring is the maximal order; 
rather, we present a probabilistic algorithm for ``going up'' to a 
maximal curve (a curve with maximal endomorphism ring), once we find
any curve in the right isogeny class.  Then we use the structure of the 
Shimura class group and the computation of $(\ell,\ell)$-isogenies
to compute all isogenous maximal curves from an initial one.

This is an extended version of the article published at ANTS~X.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/443" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Strongly Secure Authenticated Key Exchange Protocol from Bilinear Groups without Random Oracles]]></title>
<updated>2013-05-09T08:37:22Z</updated>
<author><name><![CDATA[Zheng Yang]]></name></author>
<id>http://eprint.iacr.org/2012/381</id>
<category term="one-round authenticated key exchange"/>
<category term="pairing"/>
<category term="insider security"/>
<category term="standard model"/>
<content><![CDATA[Since the introducing of extended Canetti-Krawczyk~(eCK) security model for two party key exchange, many protocols have been proposed to provide eCK security. However, most of those protocols are provably secure in the random oracle model or rely on special design technique well-known as the NAXOS trick. In contrast to previous schemes, we present an eCK secure protocol in the standard model, without NAXOS trick and without knowledge of secret key (KOSK) assumption for public key registration. The security proof of our scheme is based on standard pairing assumption, collision resistant hash functions, bilinear decision Diffie-Hellman (BDDH) and decision linear Diffie-Hellman (DLIN) assumptions, and pseudo-random functions with pairwise independent random source. Although our proposed protocol is based on bilinear groups, it doesn't need any pairing operations during protocol execution.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/381" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Another look at non-uniformity]]></title>
<updated>2013-05-02T16:54:40Z</updated>
<author><name><![CDATA[Neal Koblitz]]></name></author>
<author><name><![CDATA[Alfred Menezes]]></name></author>
<id>http://eprint.iacr.org/2012/359</id>
<category term="foundations / "/>
<content><![CDATA[We argue that it is unnatural and undesirable to use the non-uniform model of complexity for practice-oriented security reductions in cryptography.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/359" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Fair Private Set Intersection with a Semi-trusted Arbiter]]></title>
<updated>2013-05-09T06:31:05Z</updated>
<author><name><![CDATA[Changyu Dong]]></name></author>
<author><name><![CDATA[Liqun Chen]]></name></author>
<author><name><![CDATA[Jan Camenisch]]></name></author>
<author><name><![CDATA[Giovanni Russello]]></name></author>
<id>http://eprint.iacr.org/2012/252</id>
<category term="cryptographic protocols / private set intersection"/>
<category term="optimistic fairness"/>
<category term="proxy re-encryption"/>
<content><![CDATA[A private set intersection (PSI) protocol allows two parties to compute the intersection of their input sets privately. Most of the previous PSI protocols only output the result to one party and the other party gets nothing from running the protocols. However, a mutual PSI protocol in which both parties can get the output is highly desirable in many applications. A major obstacle in designing a mutual PSI protocol is how to ensure fairness. In this paper we present the first fair mutual PSI protocol which is efficient and secure. Fairness of the protocol is obtained in an optimistic fashion, i.e. by using an offline third party arbiter. In contrast to many optimistic protocols which require a fully trusted arbiter, in our protocol the arbiter is only required to be semi-trusted, in the sense that we consider it to be a potential threat to both parties' privacy but believe it will follow the protocol. The arbiter can resolve disputes without knowing any private information belongs to the two parties. This feature is appealing for a PSI protocol in which privacy may be of ultimate importance.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/252" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Binary and q-ary Tardos codes, revisited]]></title>
<updated>2013-05-16T06:03:13Z</updated>
<author><name><![CDATA[Boris Skoric]]></name></author>
<author><name><![CDATA[Jan-Jaap Oosterwijk]]></name></author>
<id>http://eprint.iacr.org/2012/249</id>
<category term="collusion"/>
<category term="watermarking"/>
<category term="fingerprinting"/>
<content><![CDATA[The Tardos code is a much studied collusion-resistant fingerprinting code, with the special property that it has asymptotically optimal 
length $m\propto c_0^2$, where $c_0$ is the number of colluders.

In this paper we give alternative security proofs for the Tardos code,
working with the assumption that the strongest coalition strategy is position-independent.
We employ the Bernstein inequality and Bennett inequality instead of
the typically used Markov inequality.
This proof technique requires fewer steps and slightly improves the 
tightness of the bound on the false negative error probability.
We present new results on code length optimization, for both 
small and asymptotically large coalition sizes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/249" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Universally Composable Secure Computation with (Malicious) Physically Uncloneable Functions]]></title>
<updated>2013-05-15T17:54:18Z</updated>
<author><name><![CDATA[Rafail Ostrovsky, Alessandra Scafuro, Ivan Visconti, Akshay Wadia]]></name></author>
<id>http://eprint.iacr.org/2012/143</id>
<category term="cryptographic protocols / Physically uncloneable functions"/>
<category term="UC security"/>
<category term="hardware set-up assumptions."/>
<content><![CDATA[Physically Uncloneable Functions (PUFs) [Pap01] are noisy physical sources of randomness. As such, they are naturally appealing for  cryptographic applications, and have caught the interest of both theoreticians and practitioners. A major step towards understanding and securely using PUFs was recently taken in [Crypto 2011] where Brzuska, Fischlin, Schröder and Katzenbeisser model PUFs in the Universal Composition (UC) framework of Canetti [FOCS 2001]. Their model considers trusted PUFs only, and thus real-world adversaries can not create malicious PUFs, and can access the physical object only via the prescribed procedure. However,this does not accurately reect real-life scenarios, where an adversary could be able to create and use malicious PUFs, or access the PUF through other procedures.

The goal of this work is to extend the model proposed in [Crypto 2011] in order to capture such real-world attacks. The main contribution of this work is the study of the Malicious PUFs model. Namely, we extend the PUF functionality of Brzuska et al. so that it allows the adversary to create arbitrarily malicious PUFs. Then, we provide positive results in this, more realistic, model. We show that, under computational assumptions, it is possible to UC-securely realize any functionality. Furthermore, we achieve unconditional (not UC) security with malicious PUFs, by showing a statistically hiding statistically binding commitment scheme that uses one PUF only, and such PUF can be malicious.

As an additional contribution, we investigate another attack model, where adversaries access to a trusted PUF in a dierent way (i.e., not following the prescribed procedure). Technically this attack translates into the fact that the simulator cannot observe the queries made to an honest PUF. In this model, queries are oblivious to the simulator, and we call it the Oblivious Query model. We are able to achieve unconditionally UC-secure computation, even in this more severe model. This protocol is secure against stronger adversaries compared to the ones of Brzuska et al.

Finally, we show the impossibility of UC secure computation in the combination of the above two new models, where the real-world adversary can create malicious PUFs and maliciously access to honest PUFs.

Our work sheds light on the signicant power and applicability of PUFs in the design of cryptographic protocols modeling adversaries that misbehave with PUFs.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/143" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Attacks and Security Proofs of EAX-Prime]]></title>
<updated>2013-05-13T22:23:59Z</updated>
<author><name><![CDATA[Kazuhiko Minematsu]]></name></author>
<author><name><![CDATA[Stefan Lucks]]></name></author>
<author><name><![CDATA[Hiraku Morita]]></name></author>
<author><name><![CDATA[Tetsu Iwata]]></name></author>
<id>http://eprint.iacr.org/2012/018</id>
<category term="Authenticated Encryption"/>
<category term="EAX"/>
<category term="EAX$'$"/>
<category term="Attack"/>
<category term="Provable Security"/>
<content><![CDATA[EAX$'$ (EAX-prime) is an authenticated encryption (AE) specified by ANSI C12.22 as a standard security function for Smart Grid. 
EAX$'$ is based on EAX proposed by Bellare, Rogaway, and Wagner. 
While EAX has a proof of security based on the pseudorandomness of the internal blockcipher, no published security result is known for EAX$'$. 

This paper studies the security of EAX$'$ and shows that there is a sharp distinction in security of EAX$'$ depending on the input length. EAX$'$ encryption takes two inputs, called cleartext and plaintext, 
and we present various efficient attacks against EAX$'$ using single-block cleartext and plaintext. 
At the same time we prove that if cleartexts are always longer than one block, it is provably secure 
based on the pseudorandomness of the blockcipher. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/018" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[An Improved Certificateless Authenticated Key Agreement Protocol]]></title>
<updated>2013-05-03T06:48:33Z</updated>
<author><name><![CDATA[Haomin Yang]]></name></author>
<author><name><![CDATA[Yaoxue Zhang]]></name></author>
<author><name><![CDATA[Yuezhi Zhou]]></name></author>
<id>http://eprint.iacr.org/2011/653</id>
<category term="cryptographic protocols / certificateless public key cryptography; key agreement; man-in-the-middle attack;bilinear pairing."/>
<content><![CDATA[Recently, Mokhtarnameh, Ho, Muthuvelu proposed a certificateless key agreement protocol. In this paper, we show that their protocol is insecure against a man-in-the-middle attack which is a severe disaster for a key agreement protocol. In addition, the authors claimed that their scheme provides a binding a long-term public key with a corresponding partial private key. In fact, their protocol does not realize the binding.
We propose an improved key agreement protocol based on the protocol proposed by Mokhtarnameh, Ho and Muthuvelu. The improved protocol can resist a man-in-the-middle attack as well as satisfy the desired security properties for key agreement. It truly realizes the one-to-one correspondence between the long-term public key and the partial private key of a user. If there are two different, working long-term public keys for the same identity, the key generation center will be identified as having misbehaved in issuing both corresponding partial private keys.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/653" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Authenticated Key Exchange with Synchronized State]]></title>
<updated>2013-05-17T06:58:04Z</updated>
<author><name><![CDATA[Zheng Yang]]></name></author>
<id>http://eprint.iacr.org/2011/050</id>
<category term="authenticated key exchange"/>
<category term="impersonation detection"/>
<category term="state synchronization"/>
<category term="security model"/>
<content><![CDATA[We study the problem on how to either prevent identity impersonation (IDI) attacks or limit its consequences by on-line detecting previously unidentified IDI attacks, where IDI attacks are normally caused by the leakage of identity related long-term key. Such problem has, up until now, lacked a provably good solution. We deal with this problem through the scenario on authenticated key exchange with synchronized state (AKESS). This work provides a security model for AKESS protocols, in which we particularly formalize the security of the synchronized state. We propose a two party execution state synchronization framework for symmetric case, based on which we propose a generic compiler for AKESS protocols. Our goal is to compile any existing passively secure key exchange (KE) protocol to AKESS protocol using synchronized state, without any modification on those KE protocols. The proposal is probably secure in the standard model under standard assumptions. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/050" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The analytical property for $\zeta(s)$]]></title>
<updated>2013-05-16T19:28:09Z</updated>
<author><name><![CDATA[Sheng-Ping Wu ]]></name></author>
<id>http://eprint.iacr.org/2010/310</id>
<category term="foundations / "/>
<content><![CDATA[In this article it's discussed the analytic property of $\zeta(s)$.
The popular opinion is denied.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2010/310" />
<rights>Copyright held by author</rights>
</entry>
</feed>
