<?xml version="1.0" encoding="iso-8859-1" ?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title>Cryptology ePrint Archive</title>
	<link rel="self" href="http://eprint.iacr.org/rss/atom.xml" />
<updated>2009-07-04T13:31:01Z</updated>
<id>http://eprint.iacr.org/rss/atom.xml</id>
<author><name>Kevin McCurley</name></author>
<category term="science"/>
<category term="mathematics"/>
<category term="computer science"/>
<category term="cryptology"/>
<category term="cryptography"/>
<generator version="2.0">None of your business</generator>
<rights>All rights reserved by authors</rights>
<entry>
	<title><![CDATA[Factoring Unbalanced Moduli with Known Bits]]></title>
<updated>2009-07-01T05:00:16Z</updated>
<author><name><![CDATA[Eric Brier]]></name></author>
<author><name><![CDATA[David Naccache]]></name></author>
<author><name><![CDATA[Mehdi Tibouchi]]></name></author>
<id>http://eprint.iacr.org/2009/323</id>
<category term="foundations / factoring"/>
<category term="LLL"/>
<content><![CDATA[Let $n = pq > q^3$ be an RSA modulus. This note describes a LLL-based method allowing to factor $n$ given $2log_2q$ contiguous bits of $p$, irrespective to their position. A second method is presented, which needs fewer bits but whose length depends on the position of the known bit pattern. Finally, we introduce a somewhat surprising ad hoc method where two different known bit chunks, totalling $\frac32 log_2 q$ bits suffice to factor $n$. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/323" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Certifying Assembly with Formal Cryptographic Proofs: the Case of BBS]]></title>
<updated>2009-07-01T04:14:18Z</updated>
<author><name><![CDATA[Reynald Affeldt, David Nowak]]></name></author>
<author><name><![CDATA[Kiyoshi Yamada]]></name></author>
<id>http://eprint.iacr.org/2009/322</id>
<category term="foundations / Hoare logic"/>
<category term="SmartMIPS"/>
<category term="Coq"/>
<category term="PRNG"/>
<category term="provable security"/>
<category term="game playing"/>
<content><![CDATA[With today's dissemination of embedded systems manipulating sensitive data, it has become important to equip low-level programs with strong security guarantees. Unfortunately, security proofs as done by cryptographers are about algorithms, not about concrete implementations running on hardware. In this paper, we show how to extend security proofs to guarantee the security of assembly implementations of cryptographic primitives. Our approach is based on a framework in the Coq proof-assistant that integrates correctness proofs of assembly programs with game-playing proofs of provable security. We demonstrate the usability of our approach using the Blum-Blum-Shub (BBS) pseudorandom number generator, for which a MIPS implementation for smartcards is shown cryptographically secure.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/322" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Tweakable Enciphering Schemes From Stream Ciphers With IV]]></title>
<updated>2009-07-01T04:12:08Z</updated>
<author><name><![CDATA[Palash Sarkar]]></name></author>
<id>http://eprint.iacr.org/2009/321</id>
<category term="secret-key cryptography / stream cipher with IV"/>
<category term="tweakable encryption"/>
<category term="disk encryption"/>
<content><![CDATA[We present the first construction of a tweakable enciphering scheme from a stream cipher
supporting an initialization vector. This construction can take advantage of the recent
advances in hardware efficient stream ciphers to yield disk encryption systems with a very
small hardware footprint. Such systems will be attractive for resource constrained devices.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/321" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Automorphic Signatures in Bilinear Groups]]></title>
<updated>2009-07-01T04:11:47Z</updated>
<author><name><![CDATA[Georg Fuchsbauer]]></name></author>
<id>http://eprint.iacr.org/2009/320</id>
<category term="public-key cryptography / anonymity"/>
<category term="digital signatures"/>
<category term="elliptic curve cryptosystem"/>
<category term="group signatures"/>
<category term="zero knowledge "/>
<content><![CDATA[We call signature schemes in bilinear groups automorphic if they have the following properties: the verification keys lie in the message space, messages and signatures consist of group elements only, and verification is done by evaluating a set of pairing-product equations.
These signatures make a perfect counterpart to the powerful proof system by Groth and Sahai (Eurocrypt 2008).  We give practical instantiations under appropriate assumptions and an extension yielding blind signatures.  To illustrate their usefulness in combination with Groth-Sahai proofs, we efficiently instantiate a series of recent primitives ensuring user anonymity.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/320" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Comments and Improvements on Chameleon Hashing Without Key Exposure Based on Factoring]]></title>
<updated>2009-07-01T04:10:39Z</updated>
<author><name><![CDATA[Xiaofeng Chen]]></name></author>
<author><name><![CDATA[Haibo Tian]]></name></author>
<author><name><![CDATA[Fangguo Zhang]]></name></author>
<id>http://eprint.iacr.org/2009/319</id>
<category term="public-key cryptography / "/>
<content><![CDATA[In this paper, we present some security flaws of the key-exposure
free chameleon hash scheme based on factoring \cite{GWX07}.
Besides, we propose an improved chameleon hash scheme without key
exposure based on factoring which enjoys all the desired security
notions of chameleon hashing.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/319" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[The Fermat  factorization method revisited]]></title>
<updated>2009-07-01T04:08:53Z</updated>
<author><name><![CDATA[ERRA Robert]]></name></author>
<author><name><![CDATA[GRENIER Chirstophe]]></name></author>
<id>http://eprint.iacr.org/2009/318</id>
<category term="public-key cryptography / Fermat factoring equation Coppersmith  method RSA"/>
<content><![CDATA[We consider the well known Fermat factorization method, we call the {\it Fermat factorization equation} the equation solved 
by it: ${\cal P}(x,y)=(x+2R)^2-y^2-4N=0$;   where $N=p\, q>0$ is a RSA modulus with primes $p$ and $q$ supposed of equal length.

This equation is a bivariate integer polynomial equation and we propose to solve it directly using Coppersmith's method for bivariate integer polynomials. As we use them as a black box, our proofs will be  brief. 

We show a first result : we can factor $N$ in a polynomial time if $|p-q|<N^{5/18}$. 
Using the fact that the Newton polygon of ${\cal P}(x,y)$ is in fact a lower triangle 
we show a better result: we can indeed factor $N$ in a polynomial time if $|p-q|<N^{1/3}$. 
We conclude with proposals for future works.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/318" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Related-key Cryptanalysis of the Full AES-192 and AES-256]]></title>
<updated>2009-07-01T04:07:20Z</updated>
<author><name><![CDATA[Alex Biryukov]]></name></author>
<author><name><![CDATA[Dmitry Khovratovich]]></name></author>
<id>http://eprint.iacr.org/2009/317</id>
<category term="secret-key cryptography / AES-256"/>
<category term="AES-192"/>
<category term="related-key attack"/>
<category term="local collisions"/>
<category term="boomerang switching"/>
<content><![CDATA[In this paper we present two related-key attacks on the full AES. For AES-256 we show the first key recovery attack that works for all the keys and has complexity $2^{119}$, while the recent attack by Biryukov-Khovratovich-Nikoli\'c works for a weak key class and has higher complexity. The second attack is the first cryptanalysis of the full AES-192. Both our attacks are boomerang attacks, which are based on the recent idea of finding {\em local collisions in block ciphers} and enhanced with the {\em boomerang switching} techniques to gain free rounds in the middle.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/317" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[An Efficient Password Security of Three-Party Key exchange Protocol based on ECDLP]]></title>
<updated>2009-07-01T04:06:26Z</updated>
<author><name><![CDATA[Jayaprakash  Kar, Dr.Bansidhar Majhi]]></name></author>
<id>http://eprint.iacr.org/2009/316</id>
<category term="cryptographic protocols / "/>
<content><![CDATA[In this paper we have proposed an efficient password security of Three-Party Key Exchange Protocol based on Elliptic Curve Discrete Logarithm Problem. Key exchange protocols allow two parties communicating over a public network to establish a common secret key called session key. Due to their significance by in building a secure communication channel, a number of key exchange protocols have been suggested over the years for a variety of settings.Here we have taken two one-way hash functions to built the level of security high.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/316" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Breaking RSA-based PIN Encryption with thirty ciphertext validity queries]]></title>
<updated>2009-07-01T04:02:50Z</updated>
<author><name><![CDATA[N.P. Smart]]></name></author>
<id>http://eprint.iacr.org/2009/315</id>
<content><![CDATA[We show that one can recover the PIN from a standardised RSA-based PIN encryption algorithm from a small number of queries to a ciphertext validity checking oracle. The validity checking oracle required is rather special and we discuss whether such oracles could be obtained in
the real world. Our method works using a minor extension to the ideas
of Bleichenbacher and Manger, in particular we obtain information from negative, as well as positive, responses from the validity checking oracle.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/315" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Secure Two-Party Computation is Practical]]></title>
<updated>2009-07-01T04:01:37Z</updated>
<author><name><![CDATA[B. Pinkas]]></name></author>
<author><name><![CDATA[T. Schneider]]></name></author>
<author><name><![CDATA[N.P. Smart]]></name></author>
<author><name><![CDATA[S. Williams]]></name></author>
<id>http://eprint.iacr.org/2009/314</id>
<content><![CDATA[Secure multi-party computation has been considered by the cryptographic community for a number of years.  Until recently it has been a purely theoretical area, with few implementations with which to test various ideas.  This has led to a number of optimisations being proposed which are quite restricted in their application.  In this paper we describe an implementation of the 2-party case, using Yao's garbled circuits, we present various algorithmic protocol improvements. These optimisations are analysed both theoretically and empirically, using experiments of various adversarial situations.  Our experimental data is provided for reasonably large circuits, including one which performs an AES encryption, a problem which we discuss in the context of various possible applications.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/314" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Identity Based Group Signatures from Hierarchical Identity-Based Encryption]]></title>
<updated>2009-07-01T09:22:44Z</updated>
<author><name><![CDATA[Nigel P. Smart]]></name></author>
<author><name><![CDATA[Bogdan Warinschi]]></name></author>
<id>http://eprint.iacr.org/2009/313</id>
<content><![CDATA[A number of previous papers explored the notion of identity-based group signature. We present a generic construction of identity-based group signatures. Our construction is based on the Naor transformation of a identity-based signature out of an identity-based encryption, adjusted to hierarchical identity-based encryption. We identify sufficient conditions on the underlying HIBE so that the scheme that results 
from our transformation meets our security definitions. Finally, we suggest a couple of extensions enabled by our construction, one of which is to hierarchical identity-based group signatures.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/313" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Jacobi Quartic Curves Revisited]]></title>
<updated>2009-07-02T14:33:25Z</updated>
<author><name><![CDATA[Huseyin Hisil]]></name></author>
<author><name><![CDATA[Kenneth Koon-Ho Wong]]></name></author>
<author><name><![CDATA[Gary Carter]]></name></author>
<author><name><![CDATA[Ed Dawson]]></name></author>
<id>http://eprint.iacr.org/2009/312</id>
<category term="public-key cryptography / Efficient elliptic curve arithmetic"/>
<category term="point multiplication"/>
<category term="Jacobi model of elliptic curves."/>
<content><![CDATA[This paper provides new results about efficient arithmetic on Jacobi quartic form elliptic curves, $y^2 = d x^4 + 2 a x^2 + 1$. With recent proposals, the arithmetic on Jacobi quartic curves became solidly faster than that of Weierstrass curves. These proposals use up to 7 coordinates to represent a single point. However, fast scalar multiplication algorithms based on windowing techniques, precompute and store several points which require more space than what it takes with 3 coordinates. Also note that some of these proposals require $d = 1$ for full speed. Unfortunately, elliptic curves having 2-times-a-prime number of points, cannot be written in Jacobi quartic form if $d = 1$. Even worse the contemporary formulae may fail to output correct coordinates for some inputs. This paper provides improved speeds using fewer coordinates without causing the above mentioned problems. For instance, our proposed point doubling algorithm takes only 2 multiplications, 5 squarings, and no multiplication with curve constants when $d$ is arbitrary and $a = \pm1/2$.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/312" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Multi Party Distributed Private Matching, Set Disjointness and Cardinality Set Intersection with Information Theoretic Security]]></title>
<updated>2009-07-01T03:57:19Z</updated>
<author><name><![CDATA[Sathya Narayanan G, Aishwarya T, Anugrah Agrawal,  Arpita Patra, Ashish Choudhary, Pandu Rangan C]]></name></author>
<id>http://eprint.iacr.org/2009/311</id>
<category term="cryptographic protocols / Privacy preserving Set operations"/>
<category term="Multiparty Computation"/>
<content><![CDATA[In this paper, we focus on the specific problems of Private Matching, Set Disjointness and Cardinality Set Intersection in information theoretic settings. Specifically, we give perfectly secure protocols 
for the above problems in n party settings, tolerating a computational ly unbounded semi-honest adversary, who can passively corrupt at most t < n/2 parties. To the best of our knowledge, these are the first such 
information theoretically secure protocols in a multi-party setting for all three problems. Previous solutions for Distributed Private Matching and Cardinality Set Intersection were cryptographical ly secure and the 
previous Set Disjointness solution, though information theoretically secure, is in a two party setting. We also propose a new model for Distributed Private matching which is relevant in a multi-party setting. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/311" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[RFID distance bounding protocol with mixed challenges to prevent relay attacks]]></title>
<updated>2009-07-01T03:55:53Z</updated>
<author><name><![CDATA[Chong Hee Kim]]></name></author>
<author><name><![CDATA[Gildas Avoine]]></name></author>
<id>http://eprint.iacr.org/2009/310</id>
<category term="cryptographic protocols / RFID"/>
<category term="authentication"/>
<category term="distance bounding protocol"/>
<category term="relay attack."/>
<content><![CDATA[RFID systems suffer from different location-based attacks such as distance fraud, mafia fraud and terrorist fraud attacks. Among them mafia fraud attack is the most serious since this attack can be mounted without the notice of both the reader and the tag. An adversary performs a kind of man-in-the-middle attack between the reader and the tag. It is very difficult to prevent this attack since the adversary does not change any data between the reader and the tag. Recently distance bounding protocols measuring the round-trip time between the reader and the tag have been researched to prevent this attack.

All the existing distance bounding protocols based on binary challenges, without final signature, provide an adversary success probability equal to (3/4)^n where n is the number of rounds in the protocol. In this paper, we introduce a new protocol based on binary mixed challenges that converges toward the expected and optimal (1/2)^n bound. We prove its security in case of both noisy and non-noisy channels.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/310" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Fault Attacks on RSA Signatures with Partially Unknown Messages]]></title>
<updated>2009-07-01T03:55:24Z</updated>
<author><name><![CDATA[Jean-Sebastien Coron]]></name></author>
<author><name><![CDATA[Antoine Joux]]></name></author>
<author><name><![CDATA[Ilya Kizhvatov]]></name></author>
<author><name><![CDATA[David Naccache]]></name></author>
<author><name><![CDATA[Pascal Paillier]]></name></author>
<id>http://eprint.iacr.org/2009/309</id>
<category term="implementation / Fault attacks"/>
<category term="digital signatures"/>
<category term="RSA"/>
<category term="Coppersmith's theorem"/>
<category term="ISO 9796-2"/>
<content><![CDATA[Fault attacks exploit hardware malfunctions to recover secrets from embedded electronic devices.
In the late 90's, Boneh, DeMillo and Lipton introduced fault-based attacks on {\sc crt-rsa}.
These attacks factor the signer's modulus when the message padding
function is deterministic. However, the attack does not apply when the
message is partially unknown, for example when messages contain some
randomness which is recovered only when
 verifying a {\sl correct} signature.

In this paper we successfully extends RSA fault attacks to a large class
of partially known message configurations.
The new attacks rely on Coppersmith's algorithm for finding small roots of multivariate polynomial equations.
We illustrate the approach by successfully attacking several randomized versions of the ISO 9796-2 encoding standard.
Practical experiments show that a $2048$-bit modulus can be factored
in less than a minute given one faulty signature containing $160$
random bits and an unknown $160$-bit message digest.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/309" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[A note on the Certificateless Multi-receiver  Signcryption Scheme]]></title>
<updated>2009-07-01T03:55:08Z</updated>
<author><name><![CDATA[S. Sharmila Deva Selvi]]></name></author>
<author><name><![CDATA[S. Sree Vivek]]></name></author>
<author><name><![CDATA[C. Pandu Rangan]]></name></author>
<id>http://eprint.iacr.org/2009/308</id>
<category term="public-key cryptography / "/>
<content><![CDATA[Certificateless cryptography aims at combining the advantages of identity based and public key cryptography, so as to avoid the 
key escrow problem inherent in the identity based system and cumbersome certificate management in public key infrastructure. Signcryption 
achieves confidentiality and authentication simultaneously in an e
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/308" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Anonymous Signatures Revisited]]></title>
<updated>2009-07-01T03:53:25Z</updated>
<author><name><![CDATA[Vishal Saraswat]]></name></author>
<author><name><![CDATA[Aaram Yun]]></name></author>
<id>http://eprint.iacr.org/2009/307</id>
<category term="public-key cryptography / anonymous signature"/>
<category term="signature"/>
<category term="anonymity"/>
<category term="unpretendability"/>
<content><![CDATA[We revisit the notion of the anonymous signature, first formalized by 
Yang, Wong, Deng and Wang, and then further developed by 
Fischlin and Zhang and Imai. 
We point out that the previous formalism is inadequate in several aspects 
and present a new formalism. We introduce the notion unpretendability
to guarantee infeasibility for someone other than the correct signer to 
pretend authorship of the message and signature. Our definition retains 
applicability for all previous applications of the anonymous signature, 
provides stronger security, and is conceptually simpler.  
We give a generic construction from any ordinary signature scheme and finally
we present an example construction of an efficient anonymous signature scheme.
We show that the short signature scheme by Boneh and Boyen can be naturally
regarded as such a secure anonymous signature scheme according to
our formalism.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/307" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Authentic Time-Stamps for Archival Storage]]></title>
<updated>2009-07-01T03:52:43Z</updated>
<author><name><![CDATA[Alina Oprea]]></name></author>
<author><name><![CDATA[Kevin D. Bowers]]></name></author>
<id>http://eprint.iacr.org/2009/306</id>
<category term="cryptographic protocols / time-stamping"/>
<category term="compliance storage"/>
<category term="authenticated data structures"/>
<content><![CDATA[We study the problem of authenticating the content and creation time of documents generated by an organization and retained in archival storage. Recent regulations (e.g., the Sarbanes-Oxley act and the Securities and Exchange Commission rule) mandate secure retention of important business records for several years. We provide a mechanism to authenticate bulk repositories of archived documents. In our approach, a space efficient local data structure encapsulates a full document repository in a short (e.g., 32-byte) digest. Periodically registered with a trusted party, these commitments enable compact proofs of both document creation time and content integrity.  The data structure, an append-only persistent authenticated dictionary, allows for efficient proofs of existence and non-existence, improving on state-of-the-art techniques. We give a rigorous security analysis of our solution and confirm through an experimental evaluation with the Enron email corpus its feasibility in practice. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/306" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Improved generic algorithms for 3-collisions]]></title>
<updated>2009-06-24T01:20:15Z</updated>
<author><name><![CDATA[Antoine Joux]]></name></author>
<author><name><![CDATA[Stefan Lucks]]></name></author>
<id>http://eprint.iacr.org/2009/305</id>
<category term="foundations / multicollision"/>
<category term="random maps"/>
<content><![CDATA[ An $r$-collision for a function is a set of $r$ distinct inputs with identical outputs. Actually finding $r$-collisions for a random map over a finite set of cardinality $N$ requires at least about $N^{(r-1)/r} $ units of time on a sequential machine. For $r$=2, memoryless and well-parallelisable algorithms are known. The current paper describes memory-efficient and parallelisable algorithms for $r \ge 3$. The main results are: (1)~A sequential algorithm for 3-collisions, roughly using memory $N^\alpha$ and time $N^{1-\alpha}$ for $\alpha\le1/3$. I.e., given $N^{1/3}$ units of storage, on can find 3-collisions in time $N^{2/3}$. Note that there is a time-memory tradeoff which allows to reduce the memory consumption. (2)~A parallelisation of this algorithm using $N^{1/3}$ processors running in time $N^{1/3}$. Each single processor only needs a constant amount of memory. (3)~An generalisation of this second approach to $r$-collisions for $r \ge3$: given $N^s$ parallel processors, on can generate $r$-collisions roughly in time $N^{((r-1)/r)-s}$, using memory $N^{((r-2)/r)-s}$ on every processor. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/305" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Factor-4 and 6 Compression of Cyclotomic Subgroups]]></title>
<updated>2009-06-24T08:37:34Z</updated>
<author><name><![CDATA[Koray Karabina]]></name></author>
<id>http://eprint.iacr.org/2009/304</id>
<category term="public-key cryptography / Finite field compression"/>
<category term="cyclotomic subgroups"/>
<category term="pairing-based cryptography"/>
<content><![CDATA[Bilinear pairings derived from supersingular elliptic curves of embedding degrees 4 and 6 over finite fields of characteristic two and three, respectively, have been used to implement pairing-based cryptographic protocols. The pairing values lie in certain prime-order subgroups of certain cyclotomic subgroups. It was previously known how to compress the pairing values over characteristic two fields by a factor of 2, and the pairing values over characteristic three fields by a factor of 6. We show how the pairing values over characteristic two fields can be compressed by a factor of 4. Moreover, we present and compare several algorithms for performing exponentiation in the prime-order subgroups using the compressed representations. In particular, in the case where the base is fixed, we gain a 59% speed up over the fastest previously known exponentiation algorithm that uses factor-6 compressed representations.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/304" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Key extraction from general non-discrete signals]]></title>
<updated>2009-06-24T01:16:30Z</updated>
<author><name><![CDATA[E. Verbitskiy]]></name></author>
<author><name><![CDATA[P. Tuyls]]></name></author>
<author><name><![CDATA[C. Obi]]></name></author>
<author><name><![CDATA[B. Schoenmakers]]></name></author>
<author><name><![CDATA[B. Skoric]]></name></author>
<id>http://eprint.iacr.org/2009/303</id>
<category term="fuzzy extractor"/>
<content><![CDATA[We address the problem of designing optimal schemes for the generation of secure cryptographic keys from continuous noisy data. We argue that, contrary to the discrete case, a universal fuzzy extractor does not exist. 
This implies that in the continuous case, key extraction schemes  have to be designed for particular probability distributions.
We extend the known definitions of the correctness and security properties of fuzzy extractors. Our definitions apply to continuous as well as discrete variables.

We propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions.
The extra freedom in the choice of discretisation, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution.
We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise.

Finally, we study the security implications of incomplete knowledge of the source's probability distribution P.
We derive a bound on the min-entropy of the extracted key under the worst case assumption, where the attacker knows P exactly.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/303" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Cryptanalysis of ESSENCE]]></title>
<updated>2009-06-29T07:04:07Z</updated>
<author><name><![CDATA[Maria Naya-Plasencia]]></name></author>
<author><name><![CDATA[Andrea Röck]]></name></author>
<author><name><![CDATA[Jean-Philippe Aumasson]]></name></author>
<author><name><![CDATA[Yann Laigle-Chapuy]]></name></author>
<author><name><![CDATA[Gaëtan Leurent]]></name></author>
<author><name><![CDATA[Willi Meier]]></name></author>
<author><name><![CDATA[Thomas Peyrin]]></name></author>
<id>http://eprint.iacr.org/2009/302</id>
<category term="secret-key cryptography / hash function"/>
<category term="collision"/>
<category term="SHA-3"/>
<category term="NIST hash competition"/>
<content><![CDATA[ESSENCE is a hash function submitted to the NIST Hash Competition that stands out as a hardware-friendly and highly parallelizable design, and that has thus far remained unbroken. Preliminary analysis in its documentation argues that it resists standard differential cryptanalysis. This paper disproves this claim, showing that advanced techniques can be used to significantly reduce the cost of such attacks: using a manually found differential characteristic and a nontrivial search algorithm, we obtain shortcut collision attacks on the full ESSENCE-256 and ESSENCE-512, with respective complexities $2^{91}$ and $2^{168}$. As an aside, we show how to use these attacks for forging valid message/MAC pairs for HMAC-ESSENCE-256 and HMAC-ESSENCE-512, essentially at the same cost as a collision.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/302" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[A Probabilistic Secret Sharing Scheme for a Compartmented Access Structure]]></title>
<updated>2009-06-24T01:15:05Z</updated>
<author><name><![CDATA[Yuyin Yu]]></name></author>
<author><name><![CDATA[Mingsheng Wang]]></name></author>
<id>http://eprint.iacr.org/2009/301</id>
<category term="Secret sharing"/>
<category term="Compartmented access structure"/>
<category term="Ideality"/>
<content><![CDATA[In a compartmented access structure, there are disjoint participants
C1, . . . ,Cm. The access structure consists of subsets of participants
containing at least ti from Ci for i = 1, . . . ,m, and a total of at
least t0 participants. Tassa [2] asked: whether there exists an efficient ideal secret sharing scheme for such an access structure? Tassa and Dyn [5] presented a solution using the idea of bivariate interpolation and the concept of dual program [9, 10]. For the purpose of practical applications, it is advantageous to have a simple scheme solving the problem. In this paper a simple scheme is given for this problem using the similar idea from [5].
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/301" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Universally Composable Contributory Group Key Exchange]]></title>
<updated>2009-06-24T01:14:36Z</updated>
<author><name><![CDATA[M. Choudary Gorantla]]></name></author>
<author><name><![CDATA[Colin Boyd]]></name></author>
<author><name><![CDATA[Juan Manuel Gonz\`alez Nieto]]></name></author>
<id>http://eprint.iacr.org/2009/300</id>
<category term="cryptographic protocols / Group Key Exchange"/>
<category term="Contributiveness"/>
<category term="Universal Composition"/>
<content><![CDATA[We treat the security of group key exchange (GKE) in the universal composability (UC) framework. Analyzing GKE protocols in the UC framework naturally addresses attacks by malicious insiders. We define an ideal functionality for GKE that captures contributiveness in addition to other desired security goals. We show that an efficient two-round protocol securely realizes the proposed functionality in the random oracle model. As a result, we obtain the most efficient UC-secure contributory GKE protocol known.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/300" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On the security of oscillator-based random number generators]]></title>
<updated>2009-06-24T01:13:08Z</updated>
<author><name><![CDATA[Mathieu Baudet]]></name></author>
<author><name><![CDATA[David Lubicz]]></name></author>
<author><name><![CDATA[Julien Micolod]]></name></author>
<author><name><![CDATA[Andr\'e Tassiaux]]></name></author>
<id>http://eprint.iacr.org/2009/299</id>
<category term="implementation / hardware random number generators"/>
<category term="ring"/>
<content><![CDATA[True Random Number Generators (TRNGs) are a critical building block
of many cryptographic systems. It is thus of first importance to
design TRNGs with a proved assessment of security. A common and
attractive way to implement a TRNG on a chip is to sample a ring
oscillator and take advantage of its phase jitters as a source of
entropy.  In this paper, we present a comprehensive statistical
model for TRNGs based on this principle. In order to use this model,
typically to evaluate the entropy rate or to control the biases of
certain bit patterns, it is necessary to assess the physical
parameters of the ring oscillator. We propose a method for filtering
out the perturbations due to the global deterministic component of
the jitters, and for precisely measuring the statistics of the
Gaussian jitters, that is, the secure source of entropy. Finally we
outline two specific statistical tests applicable to the bit stream
of a TRNG in order to check for its good operation, or in some cases,
to recover the parameters of the underlying oscillator.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/299" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On the Security of Certificateless Signcryption Schemes]]></title>
<updated>2009-06-27T00:14:00Z</updated>
<author><name><![CDATA[S. Sharmila Deva Selvi, S. Sree Vivek. C. Pandu Ragan]]></name></author>
<id>http://eprint.iacr.org/2009/298</id>
<category term="Certificateless Signcryption"/>
<category term="Cryptanalysis"/>
<category term="Provable Security"/>
<category term="Bilinear Pairing"/>
<category term="Pairing-free Certificateless Signcryption."/>
<content><![CDATA[Signcryption is a cryptographic primitive which offers authentication and confidentiality simultaneously with a very low cost when compared to signing and encryption a message independently. Certificateless cryptography (CLC) is a relatively new filed where the public key of the user is not certified by a central authority, which overcomes the cumbersome certificate verification which is an ill fate in public key infrastructure (PKI). Certificateless systems provide a natural way to reduce the key escrow in identity based cryptosystems (IBC). In the literature there are four certificateless signcryption schemes and in this paper, we show that two out of them are insecure.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/298" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[A New Improved Distinguisher for HC-128]]></title>
<updated>2009-06-24T05:24:18Z</updated>
<author><name><![CDATA[Subhabrata Sen]]></name></author>
<author><name><![CDATA[Rudradev Sengupta]]></name></author>
<author><name><![CDATA[Subhamoy Maitra]]></name></author>
<author><name><![CDATA[Goutam Paul]]></name></author>
<author><name><![CDATA[Shashwat Raizada]]></name></author>
<id>http://eprint.iacr.org/2009/297</id>
<category term="secret-key cryptography / Bias"/>
<category term="Cryptography"/>
<category term="Distinguishing Attack"/>
<category term="eStream"/>
<category term="Keystream"/>
<category term="Linear Approximation"/>
<category term="Stream Cipher."/>
<content><![CDATA[In this paper we present a new distinguisher for HC-128 which is the best known so far. The distinguisher requires approximately 
$2^{106}$ keystream words with success probability 0.9772.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/297" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Perfectly Balanced Functions in Symbolic Dynamics]]></title>
<updated>2009-06-24T01:01:05Z</updated>
<author><name><![CDATA[O.A. Logachev]]></name></author>
<author><name><![CDATA[A.A. Salnikov]]></name></author>
<author><name><![CDATA[S.V. Smyshlyaev]]></name></author>
<author><name><![CDATA[V.V. Yashchenko]]></name></author>
<id>http://eprint.iacr.org/2009/296</id>
<category term="foundations / symbolic dynamics"/>
<category term="code"/>
<category term="filter generator"/>
<category term="perfectly balanced function"/>
<category term="barrier"/>
<content><![CDATA[In the present paper we study properties of perfectly balanced Boolean functions. Based on the concept of Boolean function barrier, we propose a novel approach to construct large classes of perfectly balanced Boolean functions.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/296" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Defending Against Key Abuse Attacks in KP-ABE Enabled Broadcast Systems]]></title>
<updated>2009-07-01T09:49:01Z</updated>
<author><name><![CDATA[Shucheng Yu]]></name></author>
<author><name><![CDATA[Kui Ren]]></name></author>
<author><name><![CDATA[Wenjing Lou]]></name></author>
<author><name><![CDATA[Jin Li]]></name></author>
<id>http://eprint.iacr.org/2009/295</id>
<category term="public-key cryptography / attribute-based encryption"/>
<category term="traitor tracing"/>
<category term="broadcast"/>
<content><![CDATA[Key-Policy Attribute-Based Encryption (KP-ABE) is a promising
cryptographic primitive which enables fine-grained access control
over sensitive data. However, key abuse attacks in KP-ABE may impede
its wide application especially in copyright-sensitive systems. To
defend against this kind of attacks, this paper proposes a novel KP-ABE scheme which is able to disclose any illegal key distributor’s ID when key abuse is detected. In our scheme, each bit of user ID is defined as an attribute and the user secret key is associated with his unique ID. The tracing algorithm fulfills its task by tricking the pirate device into decrypting the ciphertext associated with the corresponding bits of his ID. Our proposed scheme has the salient property of black box tracing, i.e., it traces back to the illegal key distributor’s ID only by observing the pirate device’s outputs on certain inputs. In addition, it does not require the pirate device’s secret keys to be well-formed as compared to some previous work. Our proposed scheme is provably secure under the Decisional Bilinear Diffie-Hellman (DBDH) assumption and the Decisional Linear (DL) assumption.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/295" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Low Latency High Bandwidth Anonymous Overlay Network with Anonymous Routing]]></title>
<updated>2009-06-24T00:59:25Z</updated>
<author><name><![CDATA[Roman Schlegel]]></name></author>
<author><name><![CDATA[Duncan S. Wong]]></name></author>
<id>http://eprint.iacr.org/2009/294</id>
<category term="anonymity"/>
<content><![CDATA[Most existing anonymous networks focus on providing strong anonymity for the price of having lower bandwidth, higher latency and degraded usability when compared with the conventional use of the Internet. They also often anonymize only a few specific applications.
In this paper, we propose a new approach of constructing an anonymous network. The network consists of an overlay network, which provides anonymity to all applications running on top of it, and a routing protocol, which can be considered as an anonymized version of path vector routing. The protocol preserves the high performance characteristics of the path vector routing and also has the added advantage of hiding the overlay network topology. Our simulation results show that the expected latency of our approach is 50% better than that of existing systems.
Besides the new anonymous routing protocol, this paper aims to provide the general overview of this new anonymous overlay network which may serve as the input for further research.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/294" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Enhancing Attribute-based Encryption with Attribute Hierarchy]]></title>
<updated>2009-06-24T00:58:22Z</updated>
<author><name><![CDATA[Jin Li]]></name></author>
<author><name><![CDATA[Qian Wang]]></name></author>
<author><name><![CDATA[Cong Wang]]></name></author>
<author><name><![CDATA[Kui Ren]]></name></author>
<id>http://eprint.iacr.org/2009/293</id>
<category term="public-key cryptography / Attribute-Based"/>
<category term=" Hierarchy"/>
<category term="Encryption"/>
<category term="Access Control"/>
<category term="Pairing"/>
<content><![CDATA[Attribute-based encryption (ABE) has been envisioned as a promising cryptographic primitive for realizing secure and
flexible access control. However, ABE is being criticized for its high scheme overhead as extensive pairing operations are usually required. In this paper, we focus on improving the efficiency of ABE by leveraging a previously overlooked fact, i.e., the often-found hierarchical relationships among the attributes that are inherent to many access control scenarios. As the first research effort along this direction, we coin the notion of hierarchical ABE (\textsf{HABE}), which can be viewed as the generalization of traditional ABE in the sense that both definitions are equal when all attributes are independent. We further give a concrete \textsf{HABE} construction considering a tree hierarchy among the attributes, which is provably secure. More importantly, our construction exhibits significant improvements over the traditional ABE when attribute hierarchies exist.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/293" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Implementing Wagner's generalized birthday attack against the SHA-3 candidate FSB ]]></title>
<updated>2009-06-17T09:13:53Z</updated>
<author><name><![CDATA[Daniel J. Bernstein]]></name></author>
<author><name><![CDATA[Tanja Lange]]></name></author>
<author><name><![CDATA[Christiane Peters]]></name></author>
<author><name><![CDATA[Ruben Niederhagen]]></name></author>
<author><name><![CDATA[Peter Schwabe]]></name></author>
<id>http://eprint.iacr.org/2009/292</id>
<category term="implementation / SHA-3"/>
<category term="Birthday"/>
<category term="FSB -- Wagner"/>
<category term="not much Memory"/>
<content><![CDATA[The hash function FSB is one of the candidates submitted to NIST's competition to find the new standard hash function, SHA-3. The compression function of FSB is based on error correcting codes. In this paper we show how to use Wagner's generalized birthday attack to find collisions in FSB's compression function. In particular, we present details on our implementation attacking FSB_48, a toy version of FSB which was proposed by the FSB submitters as a training case for FSB. Our attack does not make use of any properties of the particular linear code used within FSB. FSB_48 was chosen as a target where generalized birthday attacks would be one of the strongest attacks and which could be attacked in practice.

We show how to adapt this attack so that it runs on our computer   cluster of only 10 PCs which provides far less memory than the usual implementation of generalized birthday attacks would require. This situation is very interesting for estimating the security of systems against distributed attacks using contributed off-the-shelf PCs.

For the SHA-3 competition this result is meaningful in that it allows to assess the security of FSB against the strongest non-structural attack; it does not provide any insight in the security of this particular choice of linear code.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/292" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Modeling Key Compromise Impersonation Attacks on Group Key Exchange Protocols]]></title>
<updated>2009-06-17T09:11:26Z</updated>
<author><name><![CDATA[M. Choudary Gorantla]]></name></author>
<author><name><![CDATA[Colin Boyd]]></name></author>
<author><name><![CDATA[Juan Manuel Gonz\'alez Nieto]]></name></author>
<id>http://eprint.iacr.org/2009/291</id>
<category term="cryptographic protocols / Group Key Exchange"/>
<category term="Key Compromise Impersonation"/>
<category term="Insider Attacks"/>
<content><![CDATA[A key exchange protocol allows a set of parties to agree upon a secret session key over a public network. Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for the case of GKE protocols. We first model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure even against outsider KCI attacks. The attacks on these protocols demonstrate the necessity of considering KCI resilience for GKE protocols. Finally, we give a new proof of security for an existing GKE protocol under the revised model assuming random oracles.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/291" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Security Analysis of Aggregate signature and Batch verification signature schemes]]></title>
<updated>2009-06-18T18:12:27Z</updated>
<author><name><![CDATA[S.Sharmila Deva Selvi]]></name></author>
<author><name><![CDATA[S.Sree Vivek]]></name></author>
<author><name><![CDATA[J.Shriram]]></name></author>
<author><name><![CDATA[S.Kalaivani]]></name></author>
<author><name><![CDATA[C.Pandu Rangan]]></name></author>
<id>http://eprint.iacr.org/2009/290</id>
<category term="Identity Based Signature"/>
<category term="Aggregate Signatures"/>
<category term="Batch Verification"/>
<category term="Cryptanalysis."/>
<content><![CDATA[An identity based signature scheme allows any pair of users to communicate securely and to verify each others signatures without exchanging public key certificates. An aggregate signature scheme is a digital signature scheme which supports aggregation of signatures. Batch verification is a method to verify multiple signatures at once. Aggregate signature is useful in reducing both communication and computation cost. In this paper, we describe the breaks possible in some of the aggregate signature schemes and batch verification scheme.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/290" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Analysis of the End-by-Hop Protocol for Secure Aggregation in Sensor Networks]]></title>
<updated>2009-06-17T09:10:29Z</updated>
<author><name><![CDATA[Erik Zenner]]></name></author>
<id>http://eprint.iacr.org/2009/289</id>
<category term="cryptographic protocols / cryptanalysis"/>
<category term="sensor networks"/>
<category term="protocols"/>
<content><![CDATA[In order to save bandwidth and thus battery power, sensor network measurements are sometimes aggregated en-route while being reported back to the querying server. Authentication of the measurements then becomes a challenge if message integrity is important for the application.

At ESAS 2007, the End-by-Hop protocol for securing in-network aggregation for sensor nodes was presented. The solution was claimed to be secure and efficient and to provide the possibility of trading off bandwidth against computation time on the server.

In this paper, we disprove these claims. We describe several attacks against the proposed solution and point out shortcomings in the original complexity analysis. In particular, we show that the proposed solution is inferior to a naive solution without in-network aggregation both in security and in efficiency.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/289" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Efficient Key Exchange with Tight Security Reduction]]></title>
<updated>2009-06-16T14:19:00Z</updated>
<author><name><![CDATA[Jiang Wu]]></name></author>
<author><name><![CDATA[Berkant Ustaoglu]]></name></author>
<id>http://eprint.iacr.org/2009/288</id>
<category term="cryptographic protocols / authenticated key exchange"/>
<content><![CDATA[In this paper, we propose two authenticated key exchange (AKE) protocols, SMEN and SMEN&#8722;, which have efficient online computation and tight security proof in the extended Canetti-Krawczyk (eCK) model. SMEN takes 1.25 exponentiations in online computation, close
to that (1.17 exponentiations) of the most efficient AKEs MQV and its variants HMQV and CMQV. SMEN has a security reduction as tight as that of NAXOS, which is the first AKE having a tight security reduction in the eCK model. As a comparison, MQV does not have a security proof; both HMQV and CMQV have a highly non-tight security reduction, and HMQV needs a non-standard assumption; NAXOS takes 2.17 exponentiations in online computation; NETS, a NAXOS variant, takes two online exponentiations in online computation. SMEN simultaneously
achieves online efficiency and a tight security proof at a cost of 0.17 more exponentiations in offline computation and the restriction that one party is not allowed to establish a key with itself. SMEN&#8722; takes 1.29 exponentiations in online computation, but SMEN&#8722; does not use the static private key to compute the ephemeral public key (as does in SMEN, NAXOS, CMQV, and NETS), and hence reduces the risk of leaking the static private key.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/288" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Generic Attacks on Alternating Unbalanced Feistel Schemes]]></title>
<updated>2009-06-16T14:18:18Z</updated>
<author><name><![CDATA[Valerie Nachef]]></name></author>
<id>http://eprint.iacr.org/2009/287</id>
<category term="secret-key cryptography / unbalanced Feistel permutations"/>
<category term="pseudorandom permutations"/>
<category term="generic attacks "/>
<content><![CDATA[
\begin{abstract}
Generic attacks against classical (balanced) Feistel schemes, unbalanced Feistel schemes with contracting functions and unbalanced Feistel schemes with expanding functions have been studied in \cite {P01}, \cite{Jut}, \cite{PNB06}, \cite{PNB07}. In this paper we study schemes where we use alternatively contracting random functions and expanding random functions. We name these schemes ``Alternating Unbalanced Feistel Schemes''. They allow constructing pseudo-random permutations from $kn$ bits to $kn$ bits where $k \geq 3$. At each round, we use either a random function from $n$ bits to $(k-1)n$ bits or a random function from $(k-1)n$ bits to $n$ bits. We describe the best generic attacks we have found. We present``known plaintext attacks'' (KPA) and ``non-adaptive chosen plaintext attacks'' (CPA-1). Let $d$ be the number of rounds. We show that if $d \leq k$, there are CPA-1 with 2 messages and KPA with $m$ the number of messages about $2^{\frac {(d-1)n}{4}}$. For $d \geq k+1$ we have to distinguish $k$ even and $k$ odd. For $k$ even, we have $m=2$ in CPA-1 and $m \simeq 2^{\frac {kn}{4}}$ in KPA. When $k$ is odd, we show that there exist CPA-1 for $d \leq 2k-1$ and KPA for $d \leq 2k+3$ with less than $2^{kn}$ messages and computations. Beyond these values, we give KPA against generators of permutations.

\end{abstract}
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/287" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On Privacy Losses in the Trusted Agent Model (Abstract)]]></title>
<updated>2009-06-16T14:17:25Z</updated>
<author><name><![CDATA[Paulo Mateus]]></name></author>
<author><name><![CDATA[Serge Vaudenay]]></name></author>
<id>http://eprint.iacr.org/2009/286</id>
<category term="foundations / tamper-proof resistance"/>
<category term="setup assumptions"/>
<content><![CDATA[Tamper-proof devices are pretty powerful. They typically make security applications simpler (provided that the tamper-proof assumption is not violated). For application requiring privacy, we observe that some properties may become harder (if possible at all) to achieve when devices are maliciously used. We take the example of deniability, receipt-freeness, and anonymity.

We formalize the trusted agent model which assumes tamper-proof hardware in a way which captures the notion of programmable secure hardware. This model defines a functionality relative to which deniability requires provers to use a tamper proof hardware. Otherwise, any asymmetric situation in which the malicious verifiers have more powerful tamper-proof devices than the honest ones makes deniability impossible.

We conclude by observing that the ability to put boundaries in computing devices prevents from providing full control on how private information spreads: the concept of sealing a device is in some sense incompatible with some privacy notions. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/286" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Efficient Public Key Encryption Based on Ideal Lattices]]></title>
<updated>2009-06-16T14:17:07Z</updated>
<author><name><![CDATA[Damien Stehlé, Ron Steinfeld, Keisuke Tanaka, Keita Xagawa]]></name></author>
<id>http://eprint.iacr.org/2009/285</id>
<category term="public-key cryptography / Public-Key Encryption"/>
<category term="Lattices"/>
<category term="Provable Security"/>
<category term="  Post-Quantum Cryptography"/>
<content><![CDATA[The potential high efficiency of public-key encryption based on
structured lattices was first indicated by the NTRU cryptosystem,
which was proposed about 10 years ago. Unfortunately, the security of
NTRU is only heuristic. Thus, it remained an important research challenge to construct an efficient encryption scheme based on structured lattices which admits a proof of security relative to a well established cryptographic assumption.  We make progress in addressing the above challenge. We show how to construct a CPA-secure public-key encryption scheme with security provably based on the worst case hardness of the approximate Shortest Vector Problem in structured ideal lattices. Under the assumption that the latter is exponentially hard to solve even with a quantum computer, our scheme resists any subexponential attack and offers (quasi-)optimal asymptotic performance: if $n$ is the security parameter, both keys are of bit-length $\softO(n)$ and the amortized costs of both encryption and decryption are $\softO(1)$ per message
bit. Our construction adapts the trapdoor one-way function of Gentry,
Peikert and Vaikuntanathan (STOC 2008), based on the Learning With
Errors problem, to structured lattices. Our main technical tools are
an adaptation of Ajtai's trapdoor key generation algorithm
(ICALP 1999) to structured ideal lattices, and a re-interpretation of
Regev's quantum reduction between the Closest Vector Problem and
sampling short lattice vectors. We think these techniques are very
likely to find further applications in the future.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/285" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Privacy-aware Attribute-based Encryption with User Accountability]]></title>
<updated>2009-06-16T14:16:43Z</updated>
<author><name><![CDATA[Jin Li,  Kui Ren, Bo Zhu,]]></name></author>
<author><name><![CDATA[Zhiguo Wan]]></name></author>
<id>http://eprint.iacr.org/2009/284</id>
<category term="public-key cryptography / Access control"/>
<category term="  Anonymity"/>
<category term="Attribute-based"/>
<category term="Ciphertext-policy"/>
<category term="Accountability"/>
<content><![CDATA[As a new public key primitive, attribute-based encryption (ABE) is envisioned to be a promising tool for implementing fine-grained access control. To further address the concern of user access privacy, privacy-aware ABE schemes are being developed to achieve hidden access policy recently. For the purpose of secure access control, there is, however, still one critical functionality missing in the existing ABE schemes, which is user accountability. Currently, no ABE scheme can completely prevent the problem of illegal key sharing among users. In this paper, we tackle this problem by firstly proposing the notion of accountable, anonymous, and ciphertext-policy ABE (CP-A$^3$BE, in short) and then giving out a concrete construction. We start by improving the state-of-the-art of anonymous CP-ABE to obtain shorter public parameters and ciphertext length. In the proposed CP-A$^3$BE construction, user accountability  can be achieved in black-box model by embedding additional user-specific information into the attribute private key issued to that user, while still maintaining hidden access policy. The proposed constructions are provably secure.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/284" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Short and Stateless Signatures from the RSA Assumption]]></title>
<updated>2009-06-16T15:02:13Z</updated>
<author><name><![CDATA[Susan Hohenberger]]></name></author>
<author><name><![CDATA[Brent Waters]]></name></author>
<id>http://eprint.iacr.org/2009/283</id>
<category term="public-key cryptography / "/>
<content><![CDATA[We present the first signature scheme which is ``short'', stateless and secure under the RSA assumption in the standard model. Prior short, standard model signatures in the RSA setting required either a strong complexity assumption such as Strong RSA or (recently) that the signer maintain state. A signature in our scheme is comprised of one element in Z_N and one integer. The public key is also short, requiring only the modulus N, one element of Z_N, one integer and one PRF seed.

To design our signature, we employ the known generic construction of fully-secure signatures from weakly-secure signatures and a chameleon hash. We then introduce a new proof technique for reasoning about weakly-secure signatures. This technique enables the simulator to predict a prefix of the message on which the adversary will forge and to use knowledge of this prefix to embed the challenge. This technique has wider applications beyond RSA.

We also use it to provide an entirely new analysis of the security of the Waters signatures: the only short, stateless signatures known to be secure under the Computational Diffie-Hellman assumption in the standard model.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/283" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Enabling Public Verifiability and Data Dynamics for Storage Security in Cloud Computing]]></title>
<updated>2009-06-16T19:41:28Z</updated>
<author><name><![CDATA[Qian Wang]]></name></author>
<author><name><![CDATA[Cong Wang]]></name></author>
<author><name><![CDATA[Jin Li]]></name></author>
<author><name><![CDATA[Kui Ren]]></name></author>
<author><name><![CDATA[Wenjing Lou]]></name></author>
<id>http://eprint.iacr.org/2009/281</id>
<category term="cryptographic protocols / "/>
<content><![CDATA[Cloud Computing has been envisioned as the next-generation architecture of IT Enterprise. It moves the application software and databases to the centralized large data centers, where the management of the data and services may not be fully trustworthy. This unique paradigm brings about many new security challenges, which have not been well understood. In this work, we study the problem of ensuring the integrity of data storage in Cloud Computing. In particular, we consider the task of allowing a third party auditor (TPA), on behalf of the cloud client, to verify the storage correctness of the dynamic data stored in the cloud. The introduction of TPA eliminates the involvement of client through the auditing of whether his data stored in the cloud is indeed intact, which can be important in achieving economies of scale for Cloud Computing. The support to handle dynamic data via the most general forms of data operation, such as block modification, insertion and deletion, is also a significant step toward practicality, since services in Cloud Computing are not limited to archive or backup data only. While prior works on ensuring remote data integrity often lacks the support of either public verifiability or dynamic data operations, we achieve them both. We identify the difficulties and potential security problems of direct
extensions with fully dynamic data updates from prior works and show how to construct an elegant verification scheme for seamless integration of these two salient features in our protocol design. In particular, to achieve efficient data dynamics, we improve the Proof of Retrievability model [1] by manipulating the classic Merkle Hash Tree (MHT) construction for block tag authentication. Extensive security and performance analysis show that the proposed scheme is highly efficient and proven secure in the strongest security model.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/281" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Multi-core Implementation of the Tate Pairing over Supersingular Elliptic Curves]]></title>
<updated>2009-06-16T20:33:53Z</updated>
<author><name><![CDATA[Jean-Luc Beuchat]]></name></author>
<author><name><![CDATA[Emmanuel López-Trejo]]></name></author>
<author><name><![CDATA[Luis Martínez-Ramos]]></name></author>
<author><name><![CDATA[Shigeo Mitsunari]]></name></author>
<author><name><![CDATA[Francisco Rodríguez-Henríquez]]></name></author>
<id>http://eprint.iacr.org/2009/276</id>
<category term="implementation / "/>
<content><![CDATA[This paper describes the design of a fast multi-core library for the cryptographic Tate pairing over supersingular elliptic curves. For the computation of the reduced modified Tate pairing over $\mathbb{F}_{3^{509}}$, we report calculation times of just $2.94$ ms and $1.87$ ms on the Intel Core2 and Intel Core i7 architectures, respectively. We also try to answer one important design question that surges: how many cores should be utilized for a given application?
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/276" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Formally and Practically Relating the CK, CK-HMQV, and eCK Security Models for Authenticated Key Exchange]]></title>
<updated>2009-06-25T02:59:17Z</updated>
<author><name><![CDATA[Cas J.F. Cremers]]></name></author>
<id>http://eprint.iacr.org/2009/253</id>
<category term="cryptographic protocols / "/>
<content><![CDATA[Many recent protocols for Authenticated Key Exchange have been proven
correct in the CK, CK-HMQV, or eCK security models. The exact relation
between the security models, and hence between the security guarantees
provided by the protocols, is unclear. We show that the CK, CK-HMQV, and
eCK security models are not only formally incomparable but also
practically incomparable, by providing for each model attacks on
existing protocols that are not considered by the other models. We
analyse a set of recent key exchange protocols with respect to the
models.  Finally, we present the first two-message authenticated key
exchange protocol that is correct in the CK-HMQV and eCK models and also
provides Perfect Forward Secrecy.


]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/253" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Cryptanalysis of the MST_3 Public Key Cryptosystem]]></title>
<updated>2009-06-16T09:14:06Z</updated>
<author><name><![CDATA[Simon R. Blackburn, Carlos Cid]]></name></author>
<author><name><![CDATA[Ciaran Mullan]]></name></author>
<id>http://eprint.iacr.org/2009/248</id>
<category term="public-key cryptography / cryptanalysis"/>
<content><![CDATA[In this paper we describe a cryptanalysis of MST_3, a public key
cryptosystem based on non-commutative groups recently proposed by
Lempken, Magliveras, van Trung and Wei.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/248" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[The Security of Abreast-DM in the Ideal Cipher Model]]></title>
<updated>2009-06-16T05:45:13Z</updated>
<author><name><![CDATA[Jooyoung Lee]]></name></author>
<author><name><![CDATA[Daesung Kwon]]></name></author>
<id>http://eprint.iacr.org/2009/225</id>
<category term="secret-key cryptography / hash functions"/>
<content><![CDATA[In this paper, we give a security proof for Abreast-DM in terms of collision resistance, preimage resistance and adaptive preimage resistance. As old as Tandem-DM, the compression function Abreast-DM is one of the most well-known constructions for double block length compression functions. The bounds on the number of queries for collision resistance and preimage resistance are given by $O(2^{n}$. The adaptive preimage resistance is guaranteed up to $O(2^{n})$ queries/commitments. Based on a novel technique using \emph{query-response cycles}, our security proof is simpler than those for MDC-2 and Tandem-DM. We also present a wide range of Abreast-DM variants that enjoy a birthday-type security guarantee with a simple proof.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/225" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[PET SNAKE: A Special Purpose Architecture to Implement an Algebraic Attack in Hardware]]></title>
<updated>2009-06-24T03:21:37Z</updated>
<author><name><![CDATA[Willi Geiselmann]]></name></author>
<author><name><![CDATA[Kenneth Matheis]]></name></author>
<author><name><![CDATA[Rainer Steinwandt]]></name></author>
<id>http://eprint.iacr.org/2009/222</id>
<category term="secret-key cryptography / block cipher"/>
<category term="algebraic attack"/>
<category term="cryptanalytic hardware"/>
<category term="MRHS"/>
<content><![CDATA[In [Solving Multiple Right Hand Sides linear equations. Designs, Codes and Cryptography, 49:147–160, 2008] Raddum and Semaev propose a technique to solve systems of polynomial equations over GF(2) as occurring in algebraic attacks on block ciphers. This approach is known as MRHS, and we present a special purpose architecture to implement MRHS in a dedicated hardware device. Our preliminary performance analysis of this Parallel Elimination Technique Supporting Nice Algebraic Key Elimination shows that the use of ASICs seems to enable significant performance gains over a software implementation of MRHS. The main parts of the proposed architecture are scalable, the limiting factor being mainly the available bandwidth for interchip communication. Our focus is on a design choice that can be implemented within the limits of available fab technology. The proposed design can be expected to offer a running time improvement in the order of several magnitudes over a software implementation.

We do not make any claims about the practical feasibility of an attack against ciphers like AES or PRESENT with our design, however, as we do not see the necessary theoretical tools to be available:
deriving reliable running time estimates for an algebraic attack with MRHS when being applied to a full-round version of block ciphers like AES or PRESENT is still an open problem.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/222" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[PUBLIC KEY CRYPTOGRAPHY USING PERMUTATION P-POLYNOMIALS OVER FINITE FIELDS]]></title>
<updated>2009-06-24T02:45:47Z</updated>
<author><name><![CDATA[Rajesh P Singh]]></name></author>
<author><name><![CDATA[ B.K.Sarma ]]></name></author>
<author><name><![CDATA[ A.Saikia]]></name></author>
<id>http://eprint.iacr.org/2009/208</id>
<category term="Public Key Cryptography"/>
<category term="Multivariate Cryptography"/>
<category term="Permutation Polynomials"/>
<category term=" Linearized Polynomials"/>
<content><![CDATA[In this paper we propose an efficient multivariate
public key cryptosystem based on permutation p-polynomials over
finite fields. We first characterize a class of permutation
p-polynomials over finite fields $F_{q^{m}}$ and then construct a
trapdoor function using this class of permutation p-polynomials.
The complexity of encryption in our public key cryptosystem is
$O(m^{3})$ multiplication which is equivalent to other
multivariate public key cryptosystems. However the decryption is
much faster than other multivariate public key cryptosystems. In
decryption we need $O(m^{2})$ left cyclic shifts and $O(m^{2})$
xor operations.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/208" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Secure Evaluation of Private Linear Branching Programs with Medical Applications]]></title>
<updated>2009-06-29T06:14:37Z</updated>
<author><name><![CDATA[Mauro Barni]]></name></author>
<author><name><![CDATA[Pierluigi Failla]]></name></author>
<author><name><![CDATA[Vladimir Kolesnikov]]></name></author>
<author><name><![CDATA[Riccardo Lazzeretti]]></name></author>
<author><name><![CDATA[Ahmad-Reza Sadeghi]]></name></author>
<author><name><![CDATA[Thomas Schneider]]></name></author>
<id>http://eprint.iacr.org/2009/195</id>
<category term="cryptographic protocols / "/>
<content><![CDATA[Diagnostic and classification algorithms play an important role
in data analysis, with applications in  areas such as health
care, fault diagnostics, or benchmarking.  Branching programs (BP) is a
 popular representation model for describing the
underlying classification/diagnostics algorithms. Typical application
scenarios involve a client who provides data and a service provider
(server) whose diagnostic program is run on client's data.  Both parties need to keep their inputs private.

We present new, more efficient privacy-protecting protocols for remote
evaluation of such classification/diagnostic programs. 
In addition to efficiency improvements, we generalize previous solutions -- we securely evaluate private linear
branching programs (LBP), a useful generalization of BP that we introduce.  We show practicality of our solutions: we apply our protocols to the privacy-preserving
classification of medical ElectroCardioGram (ECG) signals and present
implementation results.  Finally, we discover and fix a subtle security weakness of the most recent remote diagnostic proposal, which allowed malicious clients to learn partial information about the program.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/195" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[I shall love you up to the death]]></title>
<updated>2009-06-15T09:33:08Z</updated>
<author><name><![CDATA[Valerie Nachef]]></name></author>
<author><name><![CDATA[Jacques Patarin]]></name></author>
<id>http://eprint.iacr.org/2009/166</id>
<category term="secret-key cryptography / "/>
<content><![CDATA[\begin{abstract}
In this paper, we explain the encryption algorithm used by the Queen of France, Marie-Antoinette, to send letters to Axel von Fersen during the French Revolution. We give the complete deciphering of some letters for which we found differences with the text taken from historical books. We also provide the deciphering of one letter that seems to be unknown so far. The results we get bring new proofs on Marie-Antoinette's deep affection for Fersen. Finally, we mention some open questions about Marie-Antoinette's correspondence with Axel von Fersen. 

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/166" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[CCA-Secure Proxy Re-Encryption without Pairings]]></title>
<updated>2009-06-29T09:15:49Z</updated>
<author><name><![CDATA[Jun Shao]]></name></author>
<author><name><![CDATA[Zhenfu Cao]]></name></author>
<id>http://eprint.iacr.org/2009/164</id>
<category term="public-key cryptography / Unidirectional PRE"/>
<category term="DDH"/>
<category term="random oracle"/>
<category term="CCA security"/>
<category term="collusion-resistance"/>
<content><![CDATA[In a proxy re-encryption scheme, a semi-trusted proxy can transform
a ciphertext under Alice's public key into another ciphertext that
Bob can decrypt. However, the proxy cannot access the plaintext. Due
to its transformation property, proxy re-encryption can be used in
many applications, such as encrypted email forwarding. In this
paper, by using signature of knowledge and Fijisaki-Okamoto
conversion, we propose a proxy re-encryption scheme \emph{without}
pairings, in which the proxy can only transform the ciphertext in
one direction. The proposal is secure against chosen ciphertext
attack (CCA) and collusion attack in the \emph{random oracle model}
based on Decisional Diffie-Hellman (DDH) assumption over
$\mathbb{Z}_{N^2}^*$ and integer factorization assumption,
respectively. To the best of our knowledge, it is the \emph{first}
unidirectional PRE scheme with CCA security and
collusion-resistance.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/164" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Transferable Anonymous Constant-Size Fair E-Cash]]></title>
<updated>2009-06-18T08:43:29Z</updated>
<author><name><![CDATA[Georg Fuchsbauer]]></name></author>
<author><name><![CDATA[David Pointcheval]]></name></author>
<author><name><![CDATA[Damien Vergnaud]]></name></author>
<id>http://eprint.iacr.org/2009/146</id>
<category term="anonymity"/>
<category term="blind signatures"/>
<category term="group signatures"/>
<category term="transferable e-cash"/>
<category term="fair e-cash"/>
<content><![CDATA[We propose a new blind certification protocol that provides interesting properties while remaining efficient.  It falls in the Groth-Sahai framework for WI proofs, thus extended to a certified signature it immediately yields non-frameable group signatures.  We then use it to build an efficient (offline) e-cash system that guarantees user anonymity and transferability of coins without increasing their size.  As required for fair e-cash, in case of fraud, anonymity can be revoked by an authority, which is also crucial to deter from double spending.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/146" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Faster and Timing-Attack Resistant AES-GCM]]></title>
<updated>2009-06-16T07:09:11Z</updated>
<author><name><![CDATA[Emilia Kasper]]></name></author>
<author><name><![CDATA[Peter Schwabe]]></name></author>
<id>http://eprint.iacr.org/2009/129</id>
<category term="implementation / AES"/>
<category term="Galois/Counter mode"/>
<category term="cache-timing attacks"/>
<category term="fast implementations"/>
<content><![CDATA[We present a bitsliced implementation of AES encryption in counter mode for 
64-bit Intel processors. Running at 7.59 cycles/byte on a Core~2, it is up to 25% faster than previous implementations,
while simultaneously offering protection against timing attacks. In
particular, it is the only cache-timing-attack resistant
implementation offering competitive speeds for stream as well as for 
packet encryption: for 576-byte packets, we improve performance over
previous bitsliced implementations by more than a factor of 2. We also report more than 30%
improved speeds for lookup-table based Galois/Counter mode
authentication, achieving 10.68 cycles/byte for authenticated
encryption. Furthermore, we present the first constant-time
implementation of AES-GCM that has a reasonable speed of $21.99$
cycles/byte, thus offering a full suite of timing-analysis resistant software for authenticated encryption.


]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/129" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Hardware Accelerator for the Tate Pairing in Characteristic Three Based on Karatsuba-Ofman Multipliers]]></title>
<updated>2009-06-15T18:09:11Z</updated>
<author><name><![CDATA[Jean-Luc Beuchat]]></name></author>
<author><name><![CDATA[Jérémie Detrey]]></name></author>
<author><name><![CDATA[Nicolas Estibals]]></name></author>
<author><name><![CDATA[Eiji Okamoto]]></name></author>
<author><name><![CDATA[Francisco Rodríguez-Henríquez]]></name></author>
<id>http://eprint.iacr.org/2009/122</id>
<category term="implementation / Tate pairing"/>
<category term="$\eta_T$ pairing"/>
<category term="elliptic curve"/>
<category term="finite field arithmetic"/>
<category term="Karatsuba-Ofman multiplier"/>
<category term="hardware accelerator"/>
<category term="FPGA"/>
<content><![CDATA[This paper is devoted to the design of fast parallel accelerators
for the cryptographic Tate pairing in characteristic three over
supersingular elliptic curves. We propose here a novel hardware
implementation of Miller's loop based on a pipelined Karatsuba-Ofman
multiplier. Thanks to a careful selection of algorithms for computing the tower field arithmetic associated to the Tate pairing, we manage to keep the pipeline busy. We also describe the strategies we
considered to design our parallel multiplier. They are included in a
VHDL code generator allowing for the exploration of a wide range of
operators. Then, we outline the architecture of a coprocessor for
the Tate pairing over $\mathbb{F}_{3^m}$. However, a final
exponentiation is still needed to obtain a unique value, which is
desirable in most of the cryptographic protocols. We supplement our
pairing accelerator with a coprocessor responsible for this task. An
improved exponentiation algorithm allows us to save hardware
resources.

According to our place-and-route results on Xilinx FPGAs, our design
improves both the computation time and the area-time trade-off
compared to previoulsy published coprocessors.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/122" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Deterministic Polynomial-Time Equivalence of Computing the CRT-RSA Secret Keys and Factoring]]></title>
<updated>2009-06-29T07:05:40Z</updated>
<author><name><![CDATA[Subhamoy Maitra]]></name></author>
<author><name><![CDATA[Santanu Sarkar]]></name></author>
<id>http://eprint.iacr.org/2009/062</id>
<category term="public-key cryptography / CRT-RSA"/>
<category term="Cryptanalysis"/>
<category term="Factorization"/>
<category term="LLL Algorithm"/>
<category term="RSA."/>
<content><![CDATA[Let $N = pq$ be the product of two large primes. Consider CRT-RSA with
the public encryption exponent $e$ and private decryption exponents $d_p, d_q$. It is well known that given any one of $d_p$ or $d_q$ (or both) one can factorize $N$ in probabilistic poly$(\log N)$ time with success probability almost equal to 1. Though this serves all the practical purposes, from theoretical point of view, this is not a deterministic polynomial time algorithm. In this paper, we present a lattice based deterministic poly$(\log N)$ time algorithm that uses both $d_p, d_q$ (in addition to the public information $e, N$) to factorize $N$.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/062" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Extensions of the Cube Attack based on Low Degree Annihilators]]></title>
<updated>2009-06-19T00:42:34Z</updated>
<author><name><![CDATA[Aileen Zhang, Chu-Wee Lim, Khoongming Khoo, Wei Lei]]></name></author>
<author><name><![CDATA[Josef Pieprzyk ]]></name></author>
<id>http://eprint.iacr.org/2009/049</id>
<category term="Cube Attack"/>
<category term="Algebraic Attack"/>
<category term="Low-Degree Annihilators."/>
<content><![CDATA[At Crypto 2008, Shamir introduced a new algebraic attack called the cube attack,
which allows us to solve black-box polynomials if we are able to tweak the
inputs by varying an initialization vector. In a stream cipher setting where the filter function is known, we can 
extend it to the cube attack with annihilators: By applying the cube attack to 
Boolean functions for which we can find low-degree multiples (equivalently annihilators), 
the attack complexity can be improved. When the size of the filter function is smaller 
than the LFSR, we can improve the attack complexity further by considering a sliding window 
version of the cube attack with annihilators. Finally, we extend the cube attack to 
vectorial Boolean functions by finding implicit relations with low-degree polynomials.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/049" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Realizing Hash-and-Sign Signatures under Standard Assumptions]]></title>
<updated>2009-06-14T12:48:53Z</updated>
<author><name><![CDATA[Susan Hohenberger]]></name></author>
<author><name><![CDATA[Brent Waters]]></name></author>
<id>http://eprint.iacr.org/2009/028</id>
<category term="public-key cryptography / signatures"/>
<content><![CDATA[Currently, there are relatively few instances of ``hash-and-sign''
signatures in the standard model. Moreover, most current instances
rely on strong and less studied assumptions such as the Strong RSA
and q-Strong Diffie-Hellman assumptions.

In this paper, we present a new approach for realizing hash-and-sign
signatures in the standard model.  In our approach, a signer associates
each signature with an index i that represents how many signatures
that signer has issued up to that point. Then, to make use of this
association, we create simple and efficient techniques that restrict an
adversary which makes q signature requests to forge on an index no
greater than 2q.  Finally, we develop methods
for dealing with this restricted adversary.

Our approach requires that a signer maintains a small amount of state ---
a counter of the number of signatures issued. We achieve two new realizations
for hash-and-sign signatures respectively based on the RSA assumption
and the Computational Diffie-Hellman assumption in bilinear groups.


]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/028" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Collision Attacks on NaSHA-384/512]]></title>
<updated>2009-06-16T02:03:48Z</updated>
<author><name><![CDATA[Zhimin Li, Licheng Wang, Daofeng Li, Yixian Yang]]></name></author>
<id>http://eprint.iacr.org/2009/026</id>
<category term="Hash function"/>
<category term="NaSHA-384"/>
<category term="NaSHA-512"/>
<category term="collision attack"/>
<content><![CDATA[NaSHA is a family of hash functions submitted by Markovski and
Mileva as a SHA-3 candidate. In this paper, we present a collision
attack on the hash function NaSHA for the output sizes 384-bit and
512-bit. This attack is based on the the weakness in the generate
course of the state words and the fact that the quasigroup operation
used in the compression function is only determined by partial state
words. Its time complexity is about $2^{128}$ with negligible memory
and its probability is more than $(1- \frac{2}{{2^{64} - 1}})^2$
($\gg \frac{1}{2}$). This is currently by far the best known
cryptanalysis result on this SHA-3 candidate.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/026" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Generating Shorter Bases for Hard Random Lattices]]></title>
<updated>2009-06-26T16:41:36Z</updated>
<author><name><![CDATA[Joel Alwen]]></name></author>
<author><name><![CDATA[Chris Peikert]]></name></author>
<id>http://eprint.iacr.org/2008/521</id>
<category term="public-key cryptography / Lattices"/>
<category term="average-case hardness"/>
<category term="Hermite normal form"/>
<category term="cryptography"/>
<content><![CDATA[We revisit the problem of generating a `hard' random lattice together
with a basis of relatively short vectors.  This problem has gained in
importance lately due to new cryptographic schemes that use such a
procedure to generate public/secret key pairs.  In these applications,
a shorter basis directly corresponds to milder underlying complexity
assumptions and smaller key sizes.

The contributions of this work are twofold.  First, we simplify and
modularize an approach originally due to Ajtai (ICALP 1999).  Second,
we improve the construction and its analysis in several ways, most
notably by making the output basis as short as possible (up to a small
constant factor).

]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/521" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Efficient Rational Secret Sharing in Standard Communication Networks]]></title>
<updated>2009-06-30T07:38:59Z</updated>
<author><name><![CDATA[Georg Fuchsbauer]]></name></author>
<author><name><![CDATA[Jonathan Katz]]></name></author>
<author><name><![CDATA[Eric Levieil]]></name></author>
<author><name><![CDATA[David Naccache]]></name></author>
<id>http://eprint.iacr.org/2008/488</id>
<category term="Protocols"/>
<category term="Game Theory"/>
<content><![CDATA[We propose a new methodology for rational secret sharing leading to various instantiations that are simple and efficient in terms of computation, share size, and round complexity. Our protocols do not require physical assumptions or simultaneous channels, and can even be run over asynchronous, point-to-point networks. 

Of additional interest, we propose new equilibrium notions for this setting (namely, computational versions of strict Nash equilibrium and stability with respect to trembles) and prove that our protocols satisfy them.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/488" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Simple and Efficient Asynchronous  Byzantine Agreement with Optimal Resilience]]></title>
<updated>2009-06-29T07:47:05Z</updated>
<author><name><![CDATA[Arpita Patra]]></name></author>
<author><name><![CDATA[Ashish Choudhary]]></name></author>
<author><name><![CDATA[C. Pandu Rangan]]></name></author>
<id>http://eprint.iacr.org/2008/424</id>
<category term="foundations / "/>
<content><![CDATA[Consider a completely asynchronous network consisting of $n$ parties where every two parties are connected by
a private channel. An adversary ${\cal A}_t$ with {\it unbounded computing power} actively controls at most
$t = (\lceil \frac{n}{3} \rceil - 1)$ out of $n$ parties in Byzantine fashion. In this setting, we say that $\pi$ is
 a $t$-resilient,  $(1-\epsilon)$-terminating {\it Asynchronous Byzantine Agreement} (ABA) protocol, if $\pi$ satisfies
 all the properties of Byzantine Agreement (BA) in
 asynchronous settings tolerating ${\cal A}_t$ and  terminates (i.e every honest party terminates $\pi$) with
 probability at least $(1-\epsilon)$. In this work, we present a
new $t$-resilient,  $(1-\epsilon)$-terminating  ABA protocol which {\it privately}
 communicates ${\cal O}({\cal C} n^{6} \kappa)$  bits
and \textsf{A-casts}\footnote{ \textsf{A-Cast} is a primitive in asynchronous world, allowing a party
 to send the same value to all the other parties. Hence \textsf{A-Cast} in asynchronous world is the parallel notion
 of \textsf{broadcast} in synchronous world.}
   ${\cal O}({\cal C} n^{6} \kappa)$ bits, where $\epsilon = 2^{-\Omega(\kappa)}$ and
   ${\cal C}$ is the {\it expected running time} of the protocol.
Moreover, conditioned on the event that our ABA protocol terminates, it does so in constant expected time; i.e.,
 ${\cal C} = {\cal O}(1)$.
 Our ABA protocol is to be compared with the {\it only known} $t$-resilient,  $(1-\epsilon)$-terminating  ABA protocol of
\cite{CanettiSTOC93} in the same settings, which {\it privately} communicates ${\cal O}({\cal C} n^{11} \kappa^{4})$  bits
and \textsf{A-casts}  ${\cal O}({\cal C} n^{11} \kappa^2 \log(n))$ bits, where  $\epsilon = 2^{-\Omega(\kappa)}$
 and ${\cal C} = {\cal O}(1)$.
So our ABA achieves a huge gain in communication complexity in comparison to the ABA of \cite{CanettiSTOC93},
while keeping all other properties in place.
 In another landmark work, in PODC 2008,
 Abraham et. al \cite{DolevAsynchronousBAPODC2008} proposed a $t$-resilient,  $1$-terminating (called as
{\it almost-surely terminating} in \cite{DolevAsynchronousBAPODC2008})  ABA protocol which
 privately communicates ${\cal O}({\cal C} n^{6} \log{n})$  bits
and \textsf{A-casts}  ${\cal O}({\cal C} n^{6} \log{n})$ bits. But ABA protocol of Abraham et. al. takes polynomial
(${\cal C} = {\cal O}(n^2)$) expected time  to terminate. Hence the merits of our ABA protocol over the ABA of Abraham et. al.
are: (i) For any $\kappa < n^2 \log{n}$, our ABA is better in terms of communication complexity (ii)
conditioned on the event that our ABA protocol terminates, it does so in constant expected time (the constant
is independent of $n$, $t$ and $\kappa$), whereas ABA of Abraham et. al.
takes polynomial expected time.
 Summing up, in a practical scenario where a faster and communication efficient ABA protocol is required, our ABA
 fits the bill better than ABA protocols of \cite{CanettiSTOC93,DolevAsynchronousBAPODC2008}.


 For designing our ABA protocol, we present a novel and simple {\it asynchronous verifiable secret sharing} (AVSS) protocol
 which significantly improves the communication complexity of the only known AVSS protocol
 of \cite{CanettiSTOC93} in the same settings. We believe that our AVSS can be used in many other
 applications for improving communication complexity and hence is of independent interest.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/424" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[FPGA and ASIC Implementations of the $\eta_T$ Pairing in Characteristic Three]]></title>
<updated>2009-06-17T01:26:22Z</updated>
<author><name><![CDATA[Jean-Luc Beuchat]]></name></author>
<author><name><![CDATA[Hiroshi Doi]]></name></author>
<author><name><![CDATA[Kaoru Fujita]]></name></author>
<author><name><![CDATA[Atsuo Inomata]]></name></author>
<author><name><![CDATA[Piseth Ith]]></name></author>
<author><name><![CDATA[Akira Kanaoka]]></name></author>
<author><name><![CDATA[Masayoshi Katouno]]></name></author>
<author><name><![CDATA[Masahiro Mambo]]></name></author>
<author><name><![CDATA[Eiji Okamoto]]></name></author>
<author><name><![CDATA[Takeshi Okamoto]]></name></author>
<author><name><![CDATA[Takaaki Shiga]]></name></author>
<author><name><![CDATA[Masaaki Shirase]]></name></author>
<author><name><![CDATA[Ryuji Soga]]></name></author>
<author><name><![CDATA[Tsuyoshi Takagi]]></name></author>
<author><name><![CDATA[Ananda Vithanage]]></name></author>
<author><name><![CDATA[Hiroyasu Yamamoto]]></name></author>
<id>http://eprint.iacr.org/2008/280</id>
<category term="implementation / Tate pairing"/>
<category term="$\eta_T$ pairing"/>
<category term="elliptic curve cryptography"/>
<category term="finite field"/>
<category term="arithmetic"/>
<category term="hardware accelerator"/>
<category term="FPGA"/>
<category term="ASIC"/>
<content><![CDATA[Since their introduction in constructive cryptographic applications, pairings over (hyper)elliptic curves are at the heart of an ever increasing number of protocols. As they rely critically on efficient algorithms and implementations of pairing primitives, the study of hardware accelerators became an active research area.

In this paper, we propose two coprocessors for the reduced $\eta_T$ pairing introduced by Barreto {\it et al.} as an alternative means of computing the Tate pairing on supersingular elliptic curves. We prototyped our architectures on FPGAs. According to our place-and-route results, our coprocessors compare favorably with other solutions described in the open literature. We also present the first ASIC implementation of the reduced $\eta_T$ pairing.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/280" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On the Design of Secure and Fast Double Block Length Hash Functions]]></title>
<updated>2009-06-18T00:22:08Z</updated>
<author><name><![CDATA[Zheng Gong]]></name></author>
<author><name><![CDATA[Xuejia Lai]]></name></author>
<author><name><![CDATA[Kefei Chen]]></name></author>
<id>http://eprint.iacr.org/2008/110</id>
<category term="Cryptanalysis"/>
<category term="Block-cipher-based hash function"/>
<category term="Double block length"/>
<category term="Indifferentiability."/>
<content><![CDATA[In this work the security of double block length hash functions with
rate 1, which are based on a block cipher with a block length of $n$
bits and a key length of $2n$ bits, is reconsidered.
Counter-examples and new attacks are presented on this general class
of fast double block length hash functions, which reveal unnoticed
flaws in the necessary conditions given by Satoh \textit{et al.} and
Hirose. Preimage and second preimage attacks are presented on
Hirose's two examples which were left as an open problem. Our
synthetic analysis show that all rate-1 hash functions in FDBL-II
are failed to be optimally (second) preimage resistant. The
necessary conditions are refined for ensuring a subclass of hash
functions in FDBL-II to be optimally secure against collision
attacks. In particular, one of Hirose's two examples, which
satisfies our refined conditions, is proven to be indifferentiable
from a random oracle in the ideal cipher model. The security results
are extended to a new class of double block length hash functions
with rate 1, where the key length of one block cipher used in the
compression function is equal to the block length, whereas the other
is doubled.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/110" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Efficient Computationally Private Information Retrieval From Anonymity or Trapdoor Groups]]></title>
<updated>2009-06-30T14:49:23Z</updated>
<author><name><![CDATA[Jonathan Trostle]]></name></author>
<author><name><![CDATA[Andy Parrish]]></name></author>
<id>http://eprint.iacr.org/2007/392</id>
<category term="Private Information Retrieval"/>
<content><![CDATA[A Private Information Retrieval (PIR) protocol allows a database user, or client, to obtain information from a database in a manner that prevents the database from knowing which data was retrieved. Although substantial progress has been made in the discovery of
computationally PIR (cPIR) protocols with reduced communication complexity, there has been relatively little work in reducing the
computational complexity of cPIR protocols. In particular, Sion \cite{sion} argues that existing cPIR protocols are slower than the trivial PIR protocol (in overall performance). In this paper, we present a new family of cPIR protocols with a variety of security and performance properties. Our protocols enable much lower CPU overhead for the database server. When the database is viewed as a bit sequence, only addition operations are performed by the database server. We can view our protocol as a middle ground between the trivial protocol (fastest possible computational complexity and slowest possible communication complexity) and protocols such as Gentry-Ramzan \cite{gentry} (fast communication complexity but slower computational complexity). This middle ground enjoys a much better overall performance. The security of the general version of our protocol depends on either a trapdoor group assumption or sender anonymity \cite{pfitzmann}, and we present two specialized versions, the first of which depends on the trapdoor group assumption, and the second which depends on the sender anonymity assumption. We may view both Gentry-Ramzan and our cPIR protocol as instances of a more general new construct: the \textit{trapdoor group}. In a trapdoor group, knowledge of the trapdoor allows efficient computation of an inversion problem, such as computing discrete logarithms. Without the trapdoor, it is computationally hard to solve the inversion problem. For our protocol, we assume, roughly speaking, that given only the elements $be_1, \ldots, be_t$ in the group $\Z_m$, where $e_i < m/t$ and t is small, it is hard to compute low order bits of the group order $m$. One version of our cPIR protocol depends only on sender anonymity, which to our knowledge, is the first cPIR protocol to depend only on an anonymity assumption. Our prototype implementation shows that our performance compares favorably with existing cPIR protocols.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/392" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Secure multi-party computation on incomplete networks]]></title>
<updated>2009-06-23T04:40:35Z</updated>
<author><name><![CDATA[Shailesh Vaya]]></name></author>
<id>http://eprint.iacr.org/2007/346</id>
<category term="simulation paradigm"/>
<category term="secure multi-party computation"/>
<content><![CDATA[  Secure multiparty computation of a multivariate function is a central problem in cryptography. It is known that secure multiparty computation can be realized by a set of $n$ parties iff the connectivity of the underlying (authenticated) communication network is more than twice the number of corrupted parties. This impossibility result makes secure multiparty computation far less applicable in practice, as most deployed networks have a much lower degree than $O(n)$ and one would ideally like to tolerate $\theta(n)$ corrupted parties.

  This work considers a model for (unconditional) secure multiparty computation for networks of low degrees in which authenticated channels are available between very few pairs of parties. Not all honest parties can achieve traditional security guarantees of multiparty computation for this setting. This formulation of secure multiparty computation, which permits some of the honest parties to be "sacrificed" is called almost everywhere secure computation. In this work we show how to realize a.e.s.c., on a few special families of incomplete networks, for the case of Byzantine corruptions.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/346" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS]]></title>
<updated>2009-06-21T22:56:33Z</updated>
<author><name><![CDATA[Berkant Ustaoglu]]></name></author>
<id>http://eprint.iacr.org/2007/123</id>
<category term="cryptographic protocols / key agreement protocols"/>
<category term="provable security"/>
<category term="MQV"/>
<category term="Diffie-Hellman"/>
<content><![CDATA[LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated.

This paper proposes a new authenticated key agreement protocol, called
CMQV (`Combined' MQV), which incorporates design principles from MQV,
HMQV and NAXOS.  The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/123" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On Secret Sharing Schemes, Matroids and Polymatroids]]></title>
<updated>2009-06-30T11:51:53Z</updated>
<author><name><![CDATA[Jaume Marti-Farre]]></name></author>
<author><name><![CDATA[Carles Padro]]></name></author>
<id>http://eprint.iacr.org/2006/077</id>
<category term="cryptographic protocols / Secret sharing"/>
<category term="Ideal secret sharing schemes"/>
<category term="Ideal access structures"/>
<category term="Secret sharing representable matroids"/>
<category term="Information rate."/>
<content><![CDATA[The complexity of a secret sharing scheme is defined as the ratio between the maximum length of the shares and the length of the secret. The optimization of this parameter for general access structures is an important and very difficult open problem in secret sharing. We explore in this paper the connections of this open problem with matroids and polymatroids.

Matroid ports were introduced by Lehman in 1964. A forbidden minor characterization of matroid ports was given by Seymour in 1976. These results are previous to the invention of secret sharing by Shamir in 1979. Important connections between ideal secret sharing schemes and matroids were discovered by Brickell and Davenport in 1991. Their results can be restated as follows: every ideal secret sharing scheme defines a matroid, and its access structure is a port of that matroid. In spite of this, the results by Lehman and Seymour and other subsequent results on matroid ports have not been noticed until now by the researchers interested in secret sharing.

Lower bounds on the optimal complexity of access structures can be found by taking into account that the joint Shannon entropies of a set of random variables define a polymatroid. We introduce a new parameter, which is denoted by $\kappa$, to represent the best lower bound that can be obtained by this method. We prove that every bound that is obtained by this technique for an access structure applies to its dual structure as well.

By using the aforementioned result by Seymour we obtain two new characterizations of matroid ports. The first one refers to the existence of a certain combinatorial configuration in the access structure, while the second one involves the values of the parameter $\kappa$ that is introduced in this paper. Both are related to bounds on the optimal complexity. As a consequence, we generalize the result by Brickell and Davenport by proving that, if the length of every share in a secret sharing scheme is less than 3/2 times the length of the secret, then its access structure is a matroid port. This generalizes and explains a phenomenon that was observed in several families of access structures.

Finally, we present a construction of linear secret sharing schemes for the ports of the Vamos matroid and the non-Desargues matroid, which do not admit any ideal secret sharing scheme. We obtain in this way upper bounds on their optimal complexity. These new bounds are a contribution on the search of examples of access structures whose optimal complexity lies between 1 and 3/2.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2006/077" />
<rights>Copyright held by author</rights>
</entry>
</feed>
