<?xml version="1.0" encoding="iso-8859-1" ?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title>Cryptology ePrint Archive</title>
	<link rel="self" href="http://eprint.iacr.org/rss/atom.xml" />
<updated>2008-05-11T17:31:01Z</updated>
<id>http://eprint.iacr.org/rss/atom.xml</id>
<author><name>Kevin McCurley</name></author>
<category term="science"/>
<category term="mathematics"/>
<category term="computer science"/>
<category term="cryptology"/>
<category term="cryptography"/>
<generator version="2.0">None of your business</generator>
<rights>All rights reserved by authors</rights>
<entry>
	<title><![CDATA[Endomorphisms for faster elliptic curve cryptography on general curves]]></title>
<updated>2008-05-03T06:37:44Z</updated>
<author><name><![CDATA[Steven D. Galbraith]]></name></author>
<author><name><![CDATA[Xibin Lin]]></name></author>
<author><name><![CDATA[Michael Scott]]></name></author>
<id>http://eprint.iacr.org/2008/194</id>
<category term="public-key cryptography / elliptic curves"/>
<category term="point multiplication"/>
<category term="GLV method"/>
<category term="Isogenies"/>
<content><![CDATA[We present efficiently computable homomorphisms for general elliptic
curves by working over quadratic extensions. This allows point
multiplication to be accelerated using the Gallant-Lambert-Vanstone
method.  Our preliminary results give up to a 74 percent speedup for elliptic curve cryptography using general curves.  Further speedups are possible when using special curves.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/194" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[A Tamper-Evident Voting Machine Resistant to Covert Channels]]></title>
<updated>2008-05-03T06:23:40Z</updated>
<author><name><![CDATA[Wei Han]]></name></author>
<author><name><![CDATA[Tao Hao]]></name></author>
<author><name><![CDATA[Dong Zheng]]></name></author>
<author><name><![CDATA[Ke-fei Chen]]></name></author>
<author><name><![CDATA[Xiaofeng Chen]]></name></author>
<id>http://eprint.iacr.org/2008/193</id>
<category term="applications / electronic voting"/>
<category term="covert channel"/>
<category term="tamper-evident"/>
<category term="receipt-free"/>
<content><![CDATA[To provide a high level of security guarantee cryptography is introduced into the design of the voting machine. The voting machine based on cryptography is vulnerable to attacks through covert channels. An adversary may inject malicious codes into the voting machine and make it leak vote information unnoticeably by exploiting the randomness used in encryptions and zero-knowledge proofs. In this paper a voting machine resistant to covert channels is designed. It has the following properties: Firstly, it is tamper-evident. The randomness used by the voting machine is generated by the election authority. The inconsistent use of the randomness can be detected by the voter from examining a destroyable verification code. Even if malicious codes are run in the voting machine attacks through subliminal channels are thwarted. Next, it is voter-verifiable. The voter has the ability to verify if the ballot cast by the machine is consistent with her intent without doing complicated cryptographic computation. Finally, the voting system is receipt-free. Vote-buying and coercion are prevented.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/193" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Investigating the DPA-Resistance Property of Charge Recovery Logics]]></title>
<updated>2008-04-29T09:40:48Z</updated>
<author><name><![CDATA[Amir Moradi]]></name></author>
<author><name><![CDATA[Mehrdad Khatir]]></name></author>
<author><name><![CDATA[Mahmoud Salmasizadeh]]></name></author>
<author><name><![CDATA[Mohammad T. Manzuri Shalmani]]></name></author>
<id>http://eprint.iacr.org/2008/192</id>
<category term="implementation / DPA-Resistant Logic Style"/>
<category term="Charge Recovery Logic"/>
<category term="Adiabatic Logic"/>
<content><![CDATA[The threat of DPA attacks is of crucial importance when designing cryptographic hardware. As a result, several DPA countermeasures at the cell level have been proposed in the last years, but none of them offers perfect protection against DPA attacks. Moreover, all of these DPA-resistant logic styles increase the power consumption and the area consumption significantly. On the other hand, there are some logic styles which provide less power dissipation (so called charge recovery logic) that can be considered as a DPA countermeasure. In this article we examine them from the DPA-resistance point of view. As an example of charge recovery logic styles, 2N-2N2P is evaluated. It is shown that the usage of this logic style leads to an improvement of the DPA-resistance and at the same time reduces the energy consumption which make it especially suitable for pervasive devices. In fact, it is the first time that a proposed DPA-resistant logic style consumes less power than the corresponding standard CMOS circuit.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/192" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Cryptanalysis of Self-Generated-Certificate Public Key Encryption without Pairing in PKC07]]></title>
<updated>2008-05-07T14:58:45Z</updated>
<author><name><![CDATA[Xu An Wang]]></name></author>
<author><name><![CDATA[ Xiaoyuan Yang]]></name></author>
<author><name><![CDATA[Yiliang Han  ]]></name></author>
<id>http://eprint.iacr.org/2008/191</id>
<category term="public key cryptography/ Certificateless public key cryptography"/>
<category term="Self-generated-certificate public key encryption"/>
<category term="Man-in-the-middle attack"/>
<content><![CDATA[In PKC07, Junzuo Lai and Weidong Kou proposed a self-generated-certificate public key encryption without pairing scheme. In this paper, we show that this scheme cannot resist man-in-the-middle attack. We further point out the reason for successfully attacking is binding the user's secret key with the multiply of partial public key from KGC and user's self-generated public key instead of binding with partial public key from KGC and user's self-generated public key independently. At last, we give a rescue SGC-PKE scheme by giving little change to Lai and Kou's scheme which can resist this attack. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/191" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[User-Sure-and-Safe Key Retrieval]]></title>
<updated>2008-04-29T09:31:25Z</updated>
<author><name><![CDATA[Daniel R. L. Brown]]></name></author>
<id>http://eprint.iacr.org/2008/190</id>
<category term="cryptographic protocols / user security"/>
<content><![CDATA[In a key retrieval scheme, a human user interacts with a client
computer to retrieve a key.  A scheme is user-sure if any adversary
without access to the the user cannot distinguish the retrieved key
from a random key.  A scheme is user-safe if any adversary without
access to the client's keys, or simultaneous user and client access,
cannot exploit the user to distinguish the retrieved key from a random
key.  A multiple-round key retrieval scheme, where the user is given
informative prompts to which the user responds, is proved to be
user-sure and user-safe.
  
Remote key retrieval involves a keyless client and a remote, keyed
server.  User-sure and user-safe are defined similarly for remote key
retrieval.  The scheme is user-anonymous if the server cannot identify
the user.  A remote version of the multiple-round key retrieval scheme
is proved to be user-sure, user-safe and user-anonymous.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/190" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[How to Build a Hash Function from any Collision-Resistant Function]]></title>
<updated>2008-04-29T09:29:29Z</updated>
<author><name><![CDATA[Thomas Ristenpart]]></name></author>
<author><name><![CDATA[Thomas Shrimpton]]></name></author>
<id>http://eprint.iacr.org/2008/189</id>
<category term="Hash functions"/>
<category term="random oracle"/>
<category term="collision-resistance"/>
<category term="pseudorandom oracles"/>
<category term="indifferentiability"/>
<content><![CDATA[Recent collision-finding attacks against hash functions such as MD5 and SHA-1 motivate the use of provably collision-resistant (CR) functions in their place.  Finding a collision in a provably CR function implies the ability to solve some hard problem (e.g., factoring). Unfortunately, existing provably CR functions make poor replacements for hash functions as they fail to deliver behaviors demanded by practical use.  In particular, they are easily distinguished from a random oracle. We initiate an investigation into building hhash functions from provably CR functions.  As a method for achieving this, we present the Mix-Compress-Mix (MCM) construction; it envelopes any provably CR function H (with suitable regularity properties) between two injective ``mixing'' stages. The MCM construction simultaneously enjoys (1) provable collision-resistance in the standard model, and (2) indifferentiability from a monolithic random oracle when the mixing stages themselves are indifferentiable from a random oracle that observes injectivity. We instantiate our new design approach by specifying a blockcipher-based construction that appropriately realizes the mixing stages. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/189" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Information Leakage of Flip-Flops in DPA-Resistant Logic Styles]]></title>
<updated>2008-05-04T04:07:09Z</updated>
<author><name><![CDATA[Amir Moradi]]></name></author>
<author><name><![CDATA[Thomas Eisenbarth]]></name></author>
<author><name><![CDATA[Axel Poschmann]]></name></author>
<author><name><![CDATA[Carsten Rolfes]]></name></author>
<author><name><![CDATA[Christof Paar]]></name></author>
<author><name><![CDATA[Mohammad T. Manzuri Shalmani]]></name></author>
<author><name><![CDATA[Mahmoud Salmasizadeh]]></name></author>
<id>http://eprint.iacr.org/2008/188</id>
<category term="implementation / Side-Channel Attack"/>
<category term="DPA-Resistant Logic Style"/>
<category term="MDPL"/>
<category term="iMDPL"/>
<content><![CDATA[This contribution discusses the information leakage of flip-flops for different DPA-resistant logic styles. We show that many of the proposed side-channel resistant logic styles still employ flip-flops that leak data-dependent information. Furthermore, we apply simple models for the leakage of masked flip-flops to design a new attack on circuits implemented using masked logic styles. Contrary to previous attacks on masked logic styles, our attack does not predict the mask bit and does not need detailed knowledge about the attacked device, e.g., the circuit layout. Moreover, our attack works even if all the load capacitances of the complementary logic signals are perfectly balanced and even if the PRNG is ideally unbiased. Finally, after performing the attack on DRSL, MDPL, and iMDPL circuits we show that single-bit masks do not influence the exploitability of the revealed leakage of the masked flip-flops.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/188" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[An Efficient and Provably Secure ID-Based Threshold Signcryption Scheme]]></title>
<updated>2008-04-29T09:25:04Z</updated>
<author><name><![CDATA[Fagen Li]]></name></author>
<author><name><![CDATA[Yong Yu]]></name></author>
<id>http://eprint.iacr.org/2008/187</id>
<category term="public-key cryptography / "/>
<content><![CDATA[Signcryption is a cryptographic primitive that performs digital
signature and public key encryption simultaneously, at a lower
computational costs and communication overheads than the
signature-then-encryption approach. Recently, two identity-based
threshold signcryption schemes[12],[26] have been
proposed by combining the concepts of identity-based threshold
signature and signcryption together. However, the formal models and
security proofs for both schemes are not considered. In this paper,
we formalize the concept of identity-based threshold signcryption
and give a new scheme based on the bilinear pairings. We prove its
confidentiality under the Decisional Bilinear Diffie-Hellman
assumption and its unforgeability under the Computational
Diffie-Hellman assumption in the random oracle model. Our scheme
turns out to be more efficient than the two previously proposed
schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/187" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Privacy-Preserving Audit and Extraction of Digital Contents]]></title>
<updated>2008-04-29T09:22:15Z</updated>
<author><name><![CDATA[Mehul A. Shah]]></name></author>
<author><name><![CDATA[Ram Swaminathan]]></name></author>
<author><name><![CDATA[Mary Baker]]></name></author>
<id>http://eprint.iacr.org/2008/186</id>
<category term="applications / storage"/>
<category term="auditing"/>
<category term="extraction"/>
<category term="retrievability"/>
<category term="digital preservation"/>
<category term="privacy"/>
<content><![CDATA[A growing number of online services, such as Google, Yahoo!, and Amazon, are starting to charge users for their storage. Customers often use these services to store valuable data such as email, family photos and videos, and disk backups. Today, a customer must entirely trust such external services to maintain the integrity of hosted data and return it intact. Unfortunately, no service is infallible.

To make storage services accountable for data loss, we present protocols that allow a third-party auditor to periodically verify the data stored by a service and assist in returning the data intact to the customer. Most importantly, our protocols are privacy-preserving, in that they never reveal the data contents to the auditor. Our solution removes the burden of verification from the customer, alleviates both the customer’s and storage service’s fear of data leakage, and provides a method for independent arbitration of data retention contracts.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/186" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[A New Approach to Secure Logging]]></title>
<updated>2008-04-24T13:07:13Z</updated>
<author><name><![CDATA[Di Ma]]></name></author>
<author><name><![CDATA[Gene Tsudik]]></name></author>
<id>http://eprint.iacr.org/2008/185</id>
<category term="applications / secure logging"/>
<category term="MACs"/>
<category term="signatures"/>
<category term="forward secure stream integrity"/>
<category term="truncation attack"/>
<content><![CDATA[The need for secure logging is well-understood by the security
professionals, including both researchers and practitioners. The
ability to efficiently verify all (or some) log entries is
important to any application employing secure logging techniques.
In this paper, we begin by examining state-of-the-art in secure
logging and identify some problems inherent to systems based on
trusted third-party servers. We then propose a different approach
to secure logging based upon recently developed Forward-Secure
Sequential Aggregate (FssAgg) authentication techniques. Our
approach offers both space-efficiency and provable security. We
illustrate two concrete schemes -- one private-verifiable and one
public-verifiable -- that offer practical secure logging without
any reliance on on-line trusted third parties or secure hardware.
We also investigate the concept of immutability in the context of
forward secure sequential aggregate authentication to provide
finer grained verification. Finally, we report on some experience
with a prototype built upon a popular code version control system.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/185" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On the Secure Obfuscation of Deterministic Finite Automata]]></title>
<updated>2008-04-28T07:15:02Z</updated>
<author><name><![CDATA[W. Erik Anderson]]></name></author>
<id>http://eprint.iacr.org/2008/184</id>
<category term="foundations / Obfuscation"/>
<category term="deterministic finite automata"/>
<category term="state machines"/>
<category term="Turing machines"/>
<category term="authenticated encryption"/>
<category term="oracle machines"/>
<category term="provable security"/>
<category term="game-playing."/>
<content><![CDATA[In this paper, we show how to construct secure obfuscation for Deterministic Finite Automata, assuming non-uniformly strong one-way functions exist. We revisit the software protection approaches originally proposed by [B79,G87,GO96,K80] and revise them to the current obfuscation setting of Barak et al. [BGI+01]. Under this model, we introduce an efficient oracle that retains some ``small" secret about the original program. Using this secret, we can construct an obfuscator and two-party protocol that securely obfuscates Deterministic Finite Automata against malicious adversaries. The security of this model retains the strong ``virtual black box" property originally proposed in [BGI+01] while incorporating the stronger condition of dependent auxiliary inputs in [GTK05]. Additionally, we further show that our techniques remain secure under concurrent self-composition with adaptive inputs and that Turing machines are obfuscatable under this model.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/184" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Preimage Attacks on 3-Pass HAVAL and Step-Reduced MD5]]></title>
<updated>2008-04-30T02:43:01Z</updated>
<author><name><![CDATA[Jean-Philippe Aumasson]]></name></author>
<author><name><![CDATA[Willi Meier]]></name></author>
<author><name><![CDATA[Florian Mendel]]></name></author>
<id>http://eprint.iacr.org/2008/183</id>
<category term="cryptanalysis"/>
<category term="hash function"/>
<category term="preimage attack"/>
<content><![CDATA[  This paper presents preimage attacks for the hash functions 3-pass
  HAVAL and step-reduced MD5. Introduced in 1992 and 1991
  respectively, these functions underwent severe collision attacks,
  but no preimage attack. We describe two preimage attacks on the
  compression function of 3-pass HAVAL. The attacks have a complexity
  of about $2^{224}$ compression function evaluations instead of
  $2^{256}$. Furthermore, we present several preimage attacks on the
  MD5 compression function that invert up to 47 (out of 64) steps
  within $2^{96}$ trials instead of $2^{128}$. Though our attacks are
  not practical, they show that the security margin of 3-pass HAVAL
  and step-reduced MD5 with respect to preimage attacks is not as high
  as expected.


]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/183" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Proofs of Knowledge with Several Challenge Values]]></title>
<updated>2008-05-08T10:34:18Z</updated>
<author><name><![CDATA[Grzegorz Stachowiak]]></name></author>
<id>http://eprint.iacr.org/2008/181</id>
<category term="cryptographic protocols / "/>
<content><![CDATA[In this paper we consider the problem of increasing
the number of possible challenge values from 2 to $s$
in various zero-knowledge cut and choose protocols.
First we discuss doing this for graph isomorphism protocol.
Then we show how increasing this number improves efficiency
of protocols for double discrete logarithm
and $e$-th root of discrete logarithm.
Double discrete logarithm protocol is potentially a very useful
tool for constructing complex cryptographic protocols. 
Our protocol gives hope that it will find more applications than it has now.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/181" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Possibility and impossibility results for selective decommitments]]></title>
<updated>2008-05-07T14:24:12Z</updated>
<author><name><![CDATA[Dennis Hofheinz]]></name></author>
<id>http://eprint.iacr.org/2008/168</id>
<category term="foundations / cryptography"/>
<category term="commitments"/>
<category term="zero-knowledge"/>
<category term="blackbox separations"/>
<content><![CDATA[The *selective decommitment problem* can be described as follows: assume an adversary receives a number of commitments and then may request openings of, say, half of them. Do the unopened commitments remain secure? Although this question arose more than twenty years ago, no satisfactory answer could be presented so far. We answer the question in several ways:

- If simulation-based security is desired (i.e., if we demand that the adversary's output can be simulated by a machine that does not see the unopened commitments), then security is *not achievable* via blackbox reductions to standard cryptographic assumptions. *However*, we show how to achieve security in this sense with a non-blackbox reduction to one-way permutations.

- If only indistinguishability of the unopened commitments from random commitments is desired, then security is *not achievable* for perfectly binding commitment schemes, via blackbox reductions to standard cryptographic assumptions. *However*, statistically hiding schemes *do* achieve security in this sense, using a blackbox reduction.

Our results give an almost complete picture when and how security under selective openings can be achieved. Applications of our results include:

- Essentially, an encryption scheme *must* be non-committing in order to achieve provable security against an adaptive adversary.

- We show the witness indistinguishability and composability of ``commit-choose-open'' style interactive proofs in a simple and elegant way.

On the technical side, we develop a technique to show very general impossibility results for blackbox proofs.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/168" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Dynamic SHA-2]]></title>
<updated>2008-05-11T07:39:57Z</updated>
<author><name><![CDATA[Xu Zijie]]></name></author>
<id>http://eprint.iacr.org/2008/146</id>
<category term="hash function"/>
<category term="SHA"/>
<category term="Dynamic SHA-2"/>
<content><![CDATA[In this paper I describe the construction of Dynamic SHA-2 family of cryptographic hash functions. They are built with design components from the SHA-2 family, but I use the bits in message as parameters of function G, R and ROTR operation in the new hash functionh. It enabled us to achieve a novel design principle:  When message is changed, the calculation will be different. It make the system can resistant against all extant attacks.  
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/146" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On the Design of Secure Double Block Length Hash Functions with Rate 1]]></title>
<updated>2008-05-11T08:28:31Z</updated>
<author><name><![CDATA[Zheng Gong]]></name></author>
<author><name><![CDATA[Xuejia Lai]]></name></author>
<author><name><![CDATA[Kefei Chen]]></name></author>
<id>http://eprint.iacr.org/2008/110</id>
<category term="Cryptanalysis"/>
<category term="Block cipher"/>
<category term="Hash construction"/>
<category term="Double block length."/>
<content><![CDATA[This paper reconsiders the security of the rate-1 double block
length hash functions, which based on a block cipher with a block
length of $n$-bit and a key length of $2n$-bit. Two concrete
attacks are designed to break Hirose's two examples which were
left as an open problem. Counter-examples and new attacks are
presented on a general class of double block length hash functions
with rate 1, which disclose there exist uncovered flaws in the
former analysis by Satoh \textit{et al.} and Hirose. Some refined
conditions are proposed for ensuring this general class of the
rate-1 hash functions to be optimally secure against the collision
attack. In particular, two typical examples, which designed under
the proposed conditions, are proven to be indifferentiable from
the random oracle in the ideal cipher model. The security results
are extended to a new class of double block length hash functions
with rate 1, where one block cipher used in the compression
function has the key length is equal to the block length, while
the other is doubled.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/110" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[New Differential-Algebraic Attacks and Reparametrization of Rainbow]]></title>
<updated>2008-04-20T21:09:25Z</updated>
<author><name><![CDATA[Jintai Ding AND Bo-Yin Yang AND Owen Chen AND Ming-Shing Chen AND Doug Cheng]]></name></author>
<id>http://eprint.iacr.org/2008/108</id>
<category term="rank"/>
<category term="differential attack"/>
<category term="algebraic attack"/>
<category term="oil-and-vinegar"/>
<content><![CDATA[  A recently proposed class of multivariate quadratic schemes, the
  Rainbow-Like signature Schemes, in which successive sets of central
  variables are obtained from previous ones by solving linear
  equations, seem to lead to efficient schemes (TTS, TRMS, and
  Rainbow) that perform well on systems of low computational
  resources.  Recently SFLASH ($C^{\ast-}$) was broken by Dubois,
  Fouque, Shamir, and Stern via a differential attack.  In this paper,
  we exhibit similar attacks based on differentials, that will reduce
  published Rainbow-like schemes below their security levels.  We will
  present a new type of construction of Rainbow-Like schemes and
  design signature schemes with new parameters for practical
  applications.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/108" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Homomorphic Encryption with CCA Security]]></title>
<updated>2008-05-01T12:29:54Z</updated>
<author><name><![CDATA[Manoj Prabhakaran]]></name></author>
<author><name><![CDATA[Mike Rosulek]]></name></author>
<id>http://eprint.iacr.org/2008/079</id>
<category term="public-key cryptography / homomorphic encryption"/>
<content><![CDATA[We address the problem of constructing public-key encryption schemes that meaningfully combine useful {\em computability features} with {\em non-malleability}. In particular, we investigate schemes in which anyone can change an encryption of an unknown message $m$ into an encryption of $T(m)$ (as a {\em feature}), for a specific set of allowed functions $T$, but the scheme is ``non-malleable'' with respect to all other operations. We formulate precise definitions that capture these intuitive requirements and also show relationships among our new definitions and other more standard ones (IND-CCA, gCCA, and RCCA). We further justify our definitions by showing their equivalence to a natural formulation of security in the Universally Composable framework. We also consider extending the definitions to features which combine {\em multiple} ciphertexts, and show that a natural definition is unattainable for a useful class of features. Finally, we describe a new family of encryption schemes that satisfy our definitions for a wide variety of allowed transformations $T$, and which are secure under the standard Decisional Diffie-Hellman (DDH) assumption.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/079" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[General Certificateless Encryption and Timed-Release Encryption]]></title>
<updated>2008-04-28T01:31:09Z</updated>
<author><name><![CDATA[Sherman S.M. Chow]]></name></author>
<author><name><![CDATA[Volker Roth]]></name></author>
<author><name><![CDATA[Eleanor G. Rieffel]]></name></author>
<id>http://eprint.iacr.org/2008/023</id>
<category term="public-key cryptography / security-mediated certificateless encryption"/>
<category term="timed-release encryption"/>
<content><![CDATA[Recent non-interactive timed-release encryption (TRE) schemes can be viewed as being supported by a certificateless encryption (CLE) mechanism. However, the security models of CLE and TRE differ and there is no generic transformation that turns a CLE into a TRE. In this paper, we give a generalized model for CLE that is also sufficient to fulfill the requirements of TRE.

Our model is secure against an adversary with adaptive trapdoor extraction capabilities for arbitrary identifiers (instead of selective identifiers), decryption capabilities for arbitrary public keys (as considered in strongly-secure CLE) and partial decryption capabilities (as considered in security-mediated certificateless encryption, or SMCLE). Our model also supports hierarchical identities, which have not been considered formally in paradigms of TRE and CLE.

We propose a concrete scheme under our
generalized model and prove it secure without random oracles. 
Our proposal yields the first strongly-secure SMCLE and 
the first TRE in the standard model. 
In addition, our technique of partial decryption is different from the previous approach.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/023" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[The Encrypted Elliptic Curve Hash]]></title>
<updated>2008-04-29T12:39:02Z</updated>
<author><name><![CDATA[Daniel R. L. Brown]]></name></author>
<id>http://eprint.iacr.org/2008/012</id>
<category term="secret-key cryptography / Hash function"/>
<category term="collision resistance"/>
<content><![CDATA[Bellare and Micciancio's MuHASH applies a pre-existing hash function
to map indexed message blocks into a secure group.  The resulting hash
is the product.  Bellare and Micciancio proved, in the random oracle
model, that MuHASH is collision-resistant if the group's discrete
logarithm problem is infeasible.  MuHASH, however, relies on a
pre-existing hash being collision resistant.  In this paper, we remove
such a reliance by replacing the pre-existing hash with a block cipher
under a fixed key.  We adapt Bellare and Micciancio's
collision-resistance proof to the ideal cipher model.  Preimage
resistance requires us to add a further modification.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/012" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Efficient One-round Key Exchange in the Standard Model]]></title>
<updated>2008-05-07T06:21:21Z</updated>
<author><name><![CDATA[Colin Boyd]]></name></author>
<author><name><![CDATA[Yvonne Cliff]]></name></author>
<author><name><![CDATA[Juan M. Gonzalez Nieto]]></name></author>
<author><name><![CDATA[Kenneth G. Paterson ]]></name></author>
<id>http://eprint.iacr.org/2008/007</id>
<category term="cryptographic protocols / key establishment"/>
<category term="key encapsulation"/>
<category term="id-based cryptography"/>
<category term="standard model"/>
<content><![CDATA[We consider one-round identity-based key exchange protocols  secure
in the standard model. The security analysis uses the powerful security model of Canetti and
Krawczyk and a natural extension of it to the ID-based setting. It is shown how
 KEMs can be used in a generic way to obtain two different
protocol designs with progressively stronger security guarantees. A detailed
analysis of the performance of the protocols is included; surprisingly, when
instantiated with specific KEM constructions, the resulting protocols are
competitive with the best previous schemes that have proofs only in the random
oracle model.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2008/007" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[MAC-free variant of KD04]]></title>
<updated>2008-05-06T07:25:57Z</updated>
<author><name><![CDATA[Xianhui Lu, Xuejia Lai, Dake He]]></name></author>
<id>http://eprint.iacr.org/2007/481</id>
<category term="hybrid encryption"/>
<category term="IND-CCA"/>
<category term="DEM"/>
<category term="MAC-free"/>
<content><![CDATA[Kurosawa and Desmedt proposed an efficient hybrid encryption scheme(KD04) which is secure
against adaptive chosen ciphertext attacks(IND-CCA) although the underlying KEM(key
encapsulation mechanism) is not IND-CCA secure\cite{Kurosawa2004}. We show a variant of
KD04 which is IND-CCA secure when the the underlying DEM part is IND-CCA secure. We need
a DEM built from one-time symmetric encryption scheme and a MAC in the security reduction
to check if the KEM part of a ciphertext is valid. However in the real situation we can
check if the KEM part of the ciphertext is valid without the help of the MAC. So the
hybrid encryption scheme can also use redundancy-free IND-CCA secure DEMs that avoid the
overhead due to the MAC. When using redundancy-free(MAC-free) IND-CCA secure DEMs, the
new scheme will be more efficient than KD04 in bandwidth.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/481" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Construction of Universal Designated-Verifier Signatures and Identity-Based Signatures from Standard Signatures]]></title>
<updated>2008-05-05T19:04:21Z</updated>
<author><name><![CDATA[Siamak F Shahandashti]]></name></author>
<author><name><![CDATA[Reihaneh Safavi-Naini]]></name></author>
<id>http://eprint.iacr.org/2007/462</id>
<category term="public-key cryptography / Public-Key Cryptography"/>
<category term="Digital Signatures"/>
<category term="Designated Verifier Signature"/>
<category term="Identity-Based Signature"/>
<category term="Signature of Knowledge"/>
<category term="Generic Construction"/>
<content><![CDATA[We give a generic construction for universal designated-verifier signature schemes from a large class, C, of signature schemes. The resulting schemes are efficient and have two important properties. Firstly, they are provably DV-unforgeable, non-transferable and also non-delegatable. Secondly, the signer and the designated verifier can independently choose their cryptographic settings. We also propose a generic construction for identity-based signature schemes from any signature scheme in C and prove that the construction is secure against adaptive chosen message and identity attacks. We discuss possible extensions of our constructions to hierarchical identity-based signatures, identity-based universal designated verifier signatures, and identity-based ring signatures from any signature in C. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/462" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Verifiable Attribute-based Encryption]]></title>
<updated>2008-05-10T02:38:55Z</updated>
<author><name><![CDATA[QiangTang]]></name></author>
<author><name><![CDATA[Dongyao Ji]]></name></author>
<id>http://eprint.iacr.org/2007/461</id>
<category term="public-key cryptography / "/>
<content><![CDATA[Abstract. In this paper, we construct two verifiable attribute-based encryption schemes. One is for a single authority ABE, and the other is for a multi authority ABE. Not only our schemes are proved secure as the previous ABE schemes, they also provide a verifiable property. Adding the verification property has at least two advantages: first, it allows the user to immediately check the correctness of the keys which later would be used to decrypt all authorized ciphertexts at any time, and second, if the keys pass the verification but the user still does not rightly decrypt out the message, something might be wrong with the attributes or ciphertexts. We formalize the notion of verifiable attribute-based encryption and prove our schemes in our model.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/461" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Another Look at Non-Standard Discrete Log and Diffie-Hellman Problems]]></title>
<updated>2008-04-22T12:26:46Z</updated>
<author><name><![CDATA[Neal Koblitz]]></name></author>
<author><name><![CDATA[Alfred Menezes]]></name></author>
<id>http://eprint.iacr.org/2007/442</id>
<category term="public-key cryptography / "/>
<content><![CDATA[We examine several versions of the one-more-discrete-log and
one-more-Diffie-Hellman problems.  In attempting to evaluate
their intractability, we find conflicting evidence of the
relative hardness of the different problems.  Much of this
evidence comes from natural families of groups associated with
curves of genus 2, 3, 4, 5, and 6.  This leads to questions
about how to interpret reductionist security arguments that
rely on these non-standard problems.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/442" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Faster Group Operations on Elliptic Curves]]></title>
<updated>2008-04-29T10:41:24Z</updated>
<author><name><![CDATA[Huseyin Hisil]]></name></author>
<author><name><![CDATA[Kenneth Koon-Ho Wong]]></name></author>
<author><name><![CDATA[Gary Carter]]></name></author>
<author><name><![CDATA[Ed Dawson]]></name></author>
<id>http://eprint.iacr.org/2007/441</id>
<category term="Efficient elliptic curve arithmetic"/>
<category term="unified addition"/>
<category term="side channel attack."/>
<content><![CDATA[This paper is on improving implementation techniques of Elliptic Curve Cryptography. We introduce new addition formulae for Jacobi-quartic, Edwards, Hessian forms and new doubling formulae for Jacobi-quartic and Jacobi-intersection forms of elliptic curves. The new formulae speed up the group operations for each of these forms on suitable coordinate systems. To show this, a comparison is made in respect to their performance evaluations with classic point multiplication algorithms using the previous and current operation counts. The most significant outcomes are obtained from the modified Jacobi-quartic coordinates which provide the fastest timings for most point multiplication strategies and the fastest unified addition which costs 7M+3S+1D. The new unified addition formulae can be used to provide a natural way to protect against side channel attacks which are based on simple power analysis (SPA). 

(M: The cost of field multiplication, S: The cost of field squaring, D: The cost of multiplication by a curve constant.) 

]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/441" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Improving the Round Complexity of VSS in Point-to-Point Networks]]></title>
<updated>2008-04-22T11:36:17Z</updated>
<author><name><![CDATA[Jonathan Katz]]></name></author>
<author><name><![CDATA[Chiu-Yuen Koo]]></name></author>
<author><name><![CDATA[Ranjit Kumaresan]]></name></author>
<id>http://eprint.iacr.org/2007/358</id>
<category term="VSS"/>
<category term="distributed computation"/>
<content><![CDATA[We revisit the following question: what is the optimal round complexity of verifiable secret sharing~(VSS)? We focus here on the case of perfectly-secure VSS where the number of corrupted parties~$t$ satisfies $t < n/3$, with $n$ being the total number of parties. Work of Gennaro et al. (STOC~2001) and Fitzi et al. (TCC~2006) shows that, assuming a broadcast channel, 3~rounds are necessary and sufficient for efficient VSS. The efficient 3-round protocol of Fitzi et al., however, treats the broadcast channel as being available ``for free'' and does not attempt to minimize its usage. This approach leads to relatively poor round complexity when protocols are compiled for a point-to-point network.

We show here a VSS protocol that is simultaneously optimal in terms of both the number of rounds and the number of invocations of broadcast. Our protocol also has a certain ``2-level sharing'' property that makes it useful for constructing protocols for general secure computation.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/358" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Time-Memory-Data Trade-off Attack on Stream Ciphers based on Maiorana-McFarland Functions]]></title>
<updated>2008-04-25T02:59:31Z</updated>
<author><name><![CDATA[Khoongming Khoo, Guanhan Chew, Guang Gong]]></name></author>
<author><name><![CDATA[Hian-Kiat Lee]]></name></author>
<id>http://eprint.iacr.org/2007/242</id>
<category term="Time-memory-data trade-off attack"/>
<category term="Maiorana-McFarland functions."/>
<content><![CDATA[In this paper, we present the time-memory-data (TMD) trade-off attack on stream ciphers filtered by Maiorana-McFarland functions. This can be considered as a generalization of the time-memory-data trade-off attack of Mihaljevic and Imai on Toyocrypt. First, we substitute the filter function in Toyocrypt (which has the same size as the LFSR) with a general Maiorana-McFarland function. This allows us to apply the attack to a wider class of stream ciphers. Second, we highlight how the choice of different Maiorana-McFarland functions can affect the effectiveness of our attack. Third, we show that the attack can be modified to apply on filter functions which are smaller than the LFSR and on filter-combiner stream ciphers. This allows us to cryptanalyze other configurations commonly found in practice. Finally, filter functions with vector output are sometimes used in stream ciphers to improve the throughput. Therefore the case when the Maiorana-McFarland functions have vector output is investigated. We found that the extra speed comes at the price of additional weaknesses which make the attacks easier.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/242" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Blind Identity-Based Encryption and Simulatable Oblivious Transfer]]></title>
<updated>2008-05-02T09:56:16Z</updated>
<author><name><![CDATA[Matthew Green]]></name></author>
<author><name><![CDATA[Susan Hohenberger]]></name></author>
<id>http://eprint.iacr.org/2007/235</id>
<category term="cryptographic protocols / identity-based encryption"/>
<category term="oblivious transfer"/>
<category term="blind key extraction"/>
<content><![CDATA[In an identity-based encryption (IBE) scheme, there is a {\em key extraction} protocol where a user submits an identity string to a master authority who then returns the corresponding secret key for that identity.   In this work, we describe how this protocol can be performed efficiently and in a {\em blind} fashion for several known IBE schemes; that is, a user can obtain a secret key for an identity without the master authority learning anything about this identity.

We formalize this notion as {\em blind IBE} and discuss the many practical applications of such a scheme.  In particular, we build upon the recent work of Camenisch, Neven, and shelat in Eurocrypt 2007 to construct oblivious transfer (OT) schemes which achieve full simulatability for both sender and receiver.  OT constructions with comparable efficiency prior to Camenisch et al.\ were proven secure in the weaker half-simulation model.   Our OT schemes can be constructed generically from any blind IBE, and thus require only static complexity assumptions (e.g., DBDH) whereas prior comparable schemes require dynamic complexity assumptions (e.g., $q$-PDDH).
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/235" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[On an Improved Correlation Analysis of Stream Ciphers Using Muti-Output Boolean Functions and the Related Generalized Notion of Nonlinearity]]></title>
<updated>2008-04-20T05:58:21Z</updated>
<author><name><![CDATA[Claude Carlet, Khoongming Khoo, Chu-Wee Lim, Chuan-Wen Loe]]></name></author>
<id>http://eprint.iacr.org/2007/207</id>
<category term="secret-key cryptography / Vectorial Boolean Functions"/>
<category term="Unrestricted Nonlinearity"/>
<category term="Generalized Nonlinearity"/>
<content><![CDATA[We investigate the security of $n$-bit to $m$-bit vectorial Boolean functions in stream ciphers. Such stream ciphers have higher throughput than those using single-bit output Boolean functions. However, as shown by Zhang and Chan at Crypto 2000, linear approximations based on composing the vector output with any Boolean functions have higher bias than those based on the usual correlation attack. In this paper, we introduce a new approach for analyzing vector Boolean functions called generalized correlation analysis. It is based on approximate equations which are linear in the input $x$ but of free degree in the output $z=F(x)$. The complexity for computing the generalized nonlinearity for this new attack is reduced from $2^{2^m \times n+n}$ to $2^{2n}$. Based on experimental results, we show that the new generalized correlation attack gives linear approximation with much higher bias than the Zhang-Chan and usual correlation attack. We confirm this with a theoretical upper bound for generalized nonlinearity, which is much lower than for the unrestricted nonlinearity (for Zhang-Chan's attack) and {\em a fortiori} for usual nonlinearity. We also prove a lower bound for generalized nonlinearity which allows us to construct vector Boolean functions with high generalized nonlinearity from bent and almost bent functions. We derive the generalized nonlinearity of some known secondary constructions for secure vector Boolean functions. Finally, we prove that if a vector Boolean function has high nonlinearity or even a high unrestricted nonlinearity, it cannot ensure that it will have high generalized nonlinearity. 

]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/207" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[Note on Design Criteria for Rainbow-Type Multivariates]]></title>
<updated>2008-04-27T18:51:15Z</updated>
<author><name><![CDATA[Jintai Ding]]></name></author>
<author><name><![CDATA[Lei Hu]]></name></author>
<author><name><![CDATA[Bo-Yin Yang]]></name></author>
<author><name><![CDATA[Jiun-Ming Chen]]></name></author>
<id>http://eprint.iacr.org/2006/307</id>
<category term="public-key cryptography / rainbow"/>
<category term="tts"/>
<category term="parameter choice"/>
<content><![CDATA[  This was a short note that deals with the design of Rainbow or
  ``stagewise unbalanced oil-and-vinegar'' multivariate signature
  schemes.  We exhibit new cryptanalysis for current schemes that
  relates to flawed choices of system parameters in current schemes.

  These can be ameliorated according to an updated list of security
  design criteria.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2006/307" />
<rights>Copyright held by author</rights>
</entry>
<entry>
	<title><![CDATA[A general quantitative cryptanalysis of permutation-only multimedia ciphers against plaintext attacks]]></title>
<updated>2008-05-06T05:14:59Z</updated>
<author><name><![CDATA[Shujun Li]]></name></author>
<author><name><![CDATA[Chengqing Li]]></name></author>
<author><name><![CDATA[Guanrong Chen]]></name></author>
<author><name><![CDATA[Nikolaos G. Bourbakis]]></name></author>
<author><name><![CDATA[Kwok-Tung Lo]]></name></author>
<id>http://eprint.iacr.org/2004/374</id>
<category term="permutation-only multimedia encryption"/>
<category term="image"/>
<category term="video"/>
<category term="speech"/>
<category term="cryptanalysis"/>
<category term="known-plaintext attack"/>
<category term="chosen-plaintext attack"/>
<content><![CDATA[In recent years secret permutations have been widely used for protecting different types of multimedia data, including speech files, digital images and videos. Based on a general model of permutation-only multimedia ciphers, this paper performs a quantitative cryptanalysis on the performance of these kind of ciphers against plaintext attacks. When the plaintext is of size $M\times N$ and with $L$ different levels of values, the following quantitative cryptanalytic findings have been concluded under the assumption of a uniform distribution of each element in the plaintext: 1) all permutation-only multimedia ciphers are practically insecure against known/chosen-plaintext attacks in the sense that only $O(log_L(MN))$ known/chosen plaintexts are sufficient to recover not less than (in an average sense) half elements of the plaintext; 2) the computational complexity of the known/chosen-plaintext attack is only $O(n\cdot(MN)^2)$, where n is the number of known/chosen plaintexts used. When the plaintext has a non-uniform distribution, the number of required plaintexts and the computational complexity is also discussed. Experiments are given to demonstrate the real performance of the known-plaintext attack for a typical permutation-only image cipher.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2004/374" />
<rights>Copyright held by author</rights>
</entry>
</feed>
