<?xml version="1.0" encoding="iso-8859-1" ?>
<feed xmlns="http://www.w3.org/2005/Atom">
<title>Cryptology ePrint Archive</title>
<link rel="self" href="http://eprint.iacr.org/rss/atom.xml" />
<updated>2012-02-11T20:51:02Z</updated>
<id>http://eprint.iacr.org/rss/atom.xml</id>
<author><name>Kevin McCurley</name></author>
<category term="science"/>
<category term="mathematics"/>
<category term="computer science"/>
<category term="cryptology"/>
<category term="cryptography"/>
<generator version="2.0">None of your business</generator>
<rights>All rights reserved by authors</rights>
<entry>
<title><![CDATA[A Pairing Based Strong Designated Verifier Signature Scheme without Random Oracles]]></title>
<updated>2012-02-10T00:16:41Z</updated>
<author><name><![CDATA[Maryam Rajabzadeh Asaar]]></name></author>
<author><name><![CDATA[Mahmoud Salmasizadeh]]></name></author>
<id>http://eprint.iacr.org/2012/061</id>
<category term="public-key cryptography / "/>
<content><![CDATA[In this study, a novel strong designated verifier signature scheme based on bilinear pairings with provable security in the standard model is proposed, while the existing ones are secure in the random oracle model. In 2007 and 2011, two strong designated verifier signature schemes in the standard model are proposed by Huang et al.
and Zhang et al., respectively; in the former, the property of privacy of the signer's
identity is not proved and the security of the latter is based on the security of a pseudorandom
function. Our proposal can deal with the aforementioned drawbacks of the
previous schemes. Furthermore, it satisfies non-delegatability for signature verification
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/061" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Improved Security for Linearly Homomorphic Signatures: A Generic Framework]]></title>
<updated>2012-02-10T00:14:55Z</updated>
<author><name><![CDATA[David Mandell Freeman]]></name></author>
<id>http://eprint.iacr.org/2012/060</id>
<category term="public-key cryptography / Homomorphic signatures"/>
<category term="standard model"/>
<category term="bilinear groups"/>
<category term="CDH"/>
<category term="RSA"/>
<content><![CDATA[We propose a general framework that converts (ordinary) signature schemes
having certain properties into linearly homomorphic signature schemes, i.e.,
schemes that allow authentication of linear functions on signed data. The
security of the homomorphic scheme follows from the same computational
assumption as is used to prove security of the underlying signature scheme. We
show that the following signature schemes have the required properties and
thus give rise to secure homomorphic signatures in the standard model:

   - The scheme of Waters (Eurocrypt 2005), secure under the computational Diffie-Hellman asumption in bilinear groups.

   - The scheme of Boneh and Boyen (Eurocrypt 2004,  J. Cryptology 2008), secure under the $q$-strong Diffie-Hellman assumption in bilinear groups.

   - The scheme of Gennaro, Halevi, and Rabin (Eurocrypt 1999), secure under the strong RSA assumption.

   - The scheme of Hohenberger and Waters (Crypto 2009), secure under the RSA assumption.


Our systems not only allow weaker security assumptions than were previously
available for homomorphic signatures in the standard model, but also are
secure in a model that allows a stronger adversary than in other proposed
schemes.
Our framework also leads to efficient linearly homomorphic signatures that are
secure against our stronger adversary under weak assumptions (CDH or RSA) in
the random oracle model; all previous proofs of security in the random oracle
model break down completely when faced with our stronger adversary.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/060" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Message Authentication, Revisited]]></title>
<updated>2012-02-10T00:13:30Z</updated>
<author><name><![CDATA[Yevgeniy Dodis]]></name></author>
<author><name><![CDATA[Eike Kiltz]]></name></author>
<author><name><![CDATA[Krzysztof Pietrzak]]></name></author>
<author><name><![CDATA[Daniel Wichs]]></name></author>
<id>http://eprint.iacr.org/2012/059</id>
<category term="secret-key cryptography / MAC"/>
<category term="identification protocols"/>
<category term="LPN"/>
<content><![CDATA[Traditionally, symmetric-key message authentication codes (MACs) are easily built from pseudorandom functions (PRFs). In this work we propose a wide variety of other approaches to building efficient MACs, without going through a PRF first. In particular, unlike deterministic PRF-based MACs, where each message has a unique valid tag, we give a number of probabilistic MAC constructions from various other primitives/assumptions. Our main results are summarized as follows:


* We show several new probabilistic MAC constructions from a variety of general assumptions, including CCA-secure encryption, Hash Proof Systems and key-homomorphic weak PRFs. By instantiating these frameworks under concrete number theoretic assumptions, we get several schemes which are more efficient than just using a state-of-the-art PRF instantiation under the corresponding assumption. For example, we obtain elegant DDH-based MACs with much shorter keys than the quadratic-sized key of the Naor-Reingold PRF. We also show that several natural (probabilistic) digital signature schemes, such as those by Boneh-Boyen and Waters, can be significantly optimized when "downgraded" into a MAC, both in terms of their efficiency (e.g., no bilinear pairings) and security assumptions (e.g., standard CDH instead of bilinear CDH).

* For probabilistic MACs, unlike deterministic ones, unforgeability against a chosen message attack (uf-cma) alone does not imply security if the adversary can additionally make verification queries (uf-cmva). In fact, a number of elegant constructions, such as recently constructed MACs based on Learning Parity with Noise (LPN) and some of the new MACs constructed in this work, are uf-cma but not not uf-cmva secure by themselves. We give an efficient generic transformation from any uf-cma secure MAC which is "message-hiding" into a uf-cmva secure MAC. Applied to LPN-based MACs, this resolves the main open problem of Kiltz et al. from Eurocrypt '11.

* While all our new MAC constructions immediately give efficient actively secure, two-round symmetric-key identification schemes, we also show a very simple, three-round actively secure identification protocol from any weak PRF. In particular, the resulting protocol is much more efficient than the trivial approach of building a regular PRF from a weak PRF.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/059" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Key recycling in authentication]]></title>
<updated>2012-02-10T00:13:14Z</updated>
<author><name><![CDATA[Christopher Portmann]]></name></author>
<id>http://eprint.iacr.org/2012/058</id>
<category term="secret-key cryptography / authentication"/>
<category term="composability"/>
<content><![CDATA[In their seminal work on authentication, Wegman and Carter propose that to authenticate multiple messages, it is sufficient to reuse the same hash function as long as each tag is encrypted with a one-time pad. They argue that because the one-time pad is perfectly hiding, the hash function used remains completely unknown to the adversary.

Since their proof is not composable, we revisit it using a universally composable framework. It turns out that the above argument is insufficient: information about the hash function is in fact leaked in every round to the adversary, and after a bounded finite amount of rounds it is completely known. We show however that this leak is very small, and Wegman and Carter's protocol is still $\epsilon$-secure, if $\epsilon$-almost strongly universal hash functions are used.

This implies that the secret key corresponding to the choice of hash function can be recycled for any task without any additional error than this $\epsilon$. For example, if all the messages from many rounds of quantum key distribution
are authenticated in this way, the error increases linearly in the number of rounds.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/058" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Constant-Size Ciphertext HIBE From Asymmetric Pairings Using the Dual-System Technique]]></title>
<updated>2012-02-10T00:07:59Z</updated>
<author><name><![CDATA[Somindu C. Ramanna]]></name></author>
<author><name><![CDATA[Palash Sarkar]]></name></author>
<id>http://eprint.iacr.org/2012/057</id>
<category term="public-key cryptography / identity-based encryption(IBE)"/>
<category term="constant-size ciphertext  hierarchical IBE"/>
<category term="asymmetric pairings"/>
<category term="dual-system encryption"/>
<content><![CDATA[We present a new hierarchical identity based encryption (HIBE) scheme with 
constant-size ciphertext that can be implemented using the most efficient
bilinear pairings, namely, Type-3 pairings. Security argument is based on
the dual-system technique of Waters. As a result, security can be proved
under adaptive-identity attack and the security does not degrade with
increase in the depth of the HIBE. The HIBE is obtained in two steps. In the 
first step, we simplify an earlier IBE scheme due to Lewko and Waters and show 
that its security can be based on weaker assumptions than originally used. The 
second step extends the IBE scheme to a HIBE scheme following an approach earlier 
used by Boneh, Boyen and Goh. The resulting HIBE is the only known scheme
using Type-3 pairings achieving constant-size ciphertext and security against
adaptive-identity attacks without using random oracles.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/057" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A New Pseudorandom Generator from Collision-Resistant Hash Functions]]></title>
<updated>2012-02-06T14:43:13Z</updated>
<author><name><![CDATA[Alexandra Boldyreva]]></name></author>
<author><name><![CDATA[Virendra Kumar]]></name></author>
<id>http://eprint.iacr.org/2012/056</id>
<category term="foundations / Pseudorandom generator"/>
<category term="hash function"/>
<category term="collision-resistance"/>
<category term="provable security."/>
<content><![CDATA[We present a new hash-function-based pseudorandom generator (PRG). Our PRG is reminiscent of the classical constructions iterating a function on a random seed and extracting Goldreich-Levin hardcore bits at each iteration step. The latest PRG of this type that relies on reasonable assumptions (regularity and one-wayness) is due to Haitner et al. In addition to a regular one-way function, each iteration in their ``randomized iterate'' scheme uses a new pairwise-independent function, whose descriptions are part of the seed of the PRG. Our construction does not use pairwise-independent functions and is thus more efficient, requiring less computation and a significantly shorter seed. Our scheme's security relies on the standard notions of collision-resistance and regularity of the underlying hash function, where the collision-resistance is required to be {\em exponential}. In particular, any polynomial-time adversary should have less than $2^{-n/2}$ probability of finding collisions, where $n$ is the output size of the hash function. We later show how to relax the regularity assumption by introducing a new notion that we call {\em worst-case regularity}, which lower bounds the size of primages of different elements from the range (while the  common regularity assumption requires all such sets to be of equal size). Unlike previous results, we provide a concrete security statement.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/056" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cryptanalysis of Mun et al.'s anonymous authentication scheme for roaming service in global mobility networks]]></title>
<updated>2012-02-07T17:13:28Z</updated>
<author><name><![CDATA[Hongbin Tang]]></name></author>
<author><name><![CDATA[Xinsong Liu]]></name></author>
<id>http://eprint.iacr.org/2012/055</id>
<category term="cryptographic protocols / cryptanalysis"/>
<content><![CDATA[An anonymous user authentication scheme allows the user and the remote server to authenticate each other, and should preserve user anonymity. In 2011, Mun et al. proposed an enhanced secure anonymous user authentication scheme for roaming service in global mobility networks. They claimed that their scheme was more secure and efficient than others. However, we demonstrate that their scheme is vulnerable to the insider, impersonation, server spoofing, and denial of service attacks along with the efficiency and password issues. Meanwhile, it cannot provide any user anonymity. Thus it is not feasible for the real-life implementation.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/055" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the performance of certain Private Set Intersection protocols. (And some remarks on the recent paper by Huang et al. in NDSS'12)]]></title>
<updated>2012-02-11T05:10:07Z</updated>
<author><name><![CDATA[Emiliano De Cristofaro]]></name></author>
<author><name><![CDATA[Gene Tsudik]]></name></author>
<id>http://eprint.iacr.org/2012/054</id>
<content><![CDATA[Private Set Intersection (PSI) is a well-known cryptographic primitive that allows one party ("client") to compute an intersection of its input set with that of another party ("server"), such that the client learns nothing other than the set intersection, while the server learns nothing beyond client input size. This paper reports on the implementation and performance evaluation of a specific PSI construction [DT10]. First, we discuss implementation choices that significantly impact real-life protocol performance (and that should be taken into account when deploying or benchmarking it). Then, we present a comprehensive experimental analysis, including micro-benchmarking, with various input sizes. Finally, we comment on some results presented at NDSS'12 paper titled: "Private Set Intersection: Are Garbled Circuits Better Than Custom Protocols?" [HEK12].

]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/054" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Beating Shannon requires BOTH efficient adversaries AND non-zero advantage]]></title>
<updated>2012-02-06T08:56:55Z</updated>
<author><name><![CDATA[Yevgeniy Dodis]]></name></author>
<id>http://eprint.iacr.org/2012/053</id>
<category term="foundations / one-time pad"/>
<category term="Shannon bound"/>
<content><![CDATA[In this note we formally show a "folklore" (but, to the best of our knowledge, not documented) fact that in order to beat the famous Shannon lower bound on key length for one-time-secure encryption, one must *simultaneously* restrict the attacker to be efficient, and also allow the attacker to break the system with some non-zero (i.e., negligible) probability. Despite being "folklore", we were unable to find a clean and simple proof of this result, despite asking several experts in the field. We hope that cryptography instructors will find this note useful when justifying the transition from information-theoretic to computational cryptography.

We note that our proof cleanly handles *probabilistic* encryption, as well as a small *decryption error*.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/053" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Identity-based Encryption with Efficient Revocation]]></title>
<updated>2012-02-06T08:54:23Z</updated>
<author><name><![CDATA[Alexandra Boldyreva]]></name></author>
<author><name><![CDATA[Vipul Goyal]]></name></author>
<author><name><![CDATA[Virendra Kumar]]></name></author>
<id>http://eprint.iacr.org/2012/052</id>
<category term="public-key cryptography / Identity-based encryption"/>
<category term="revocation"/>
<category term="provable security."/>
<content><![CDATA[Identity-based encryption (IBE) is an exciting
alternative to public-key encryption, as IBE eliminates the need for
a Public Key Infrastructure (PKI). Any setting,
PKI- or identity-based, must provide a means to revoke users from
the system.  Efficient revocation is a well-studied problem in the
traditional PKI setting. However in the setting of IBE, there has
been little work on studying the revocation mechanisms. The most
practical solution requires the senders to also use time periods
when encrypting, and all the receivers (regardless of whether their
keys have been compromised or not) to update their private keys
regularly by contacting the trusted authority. We note that this
solution does not scale well -- as the number of users increases,
the work on key updates becomes  a bottleneck. We propose an IBE
scheme that significantly improves key-update efficiency on the side
of the trusted party (from linear to logarithmic in the number of
users), while staying efficient for the users. Our scheme builds on
the ideas of the Fuzzy IBE primitive and binary tree data structure,
and is provably secure. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/052" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Eavesdropping on Satellite Telecommunication Systems]]></title>
<updated>2012-02-08T01:52:25Z</updated>
<author><name><![CDATA[Benedikt Driessen]]></name></author>
<id>http://eprint.iacr.org/2012/051</id>
<category term="implementation / "/>
<content><![CDATA[While communication infrastructures rapidly intertwine with our daily lives, public understanding of underlying technologies and privacy implications is often limited by their closed-source nature. Lacking the funding and resources of corporations and the intelligence community, developing and expanding this understanding is a sometimes tedious, but nonetheless important process. In this sense, we document how we have decrypted our own communication in the Thuraya satellite network. We have used open-source software to build on recent work which reverse-engineered and cryptanalized both stream ciphers currently used in the competing satellite communication standards GMR-1 and GMR-2. To break Thuraya's encryption (which implements the GMR-1 standard) in a real-world scenario, we have enhanced an existing ciphertext-only attack. We have used common and moderately expensive equipment to capture a live call session and executed the described attack. We show that, after computing less than an hour on regular PC-hardware, we were able to obtain the session key from a handful of speech data frames. This effectively allows decryption of the entire session, thus demonstrating that the Thuraya system (and probably also SkyTerra and TerreStar, who are currently implementing GMR-1) is weak at protecting privacy.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/051" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Investigating the Potential of Custom Instruction Set Extensions for SHA-3 Candidates on a 16-bit Microcontroller Architecture]]></title>
<updated>2012-02-06T08:30:16Z</updated>
<author><name><![CDATA[Jeremy Constantin]]></name></author>
<author><name><![CDATA[Andreas Burg]]></name></author>
<author><name><![CDATA[Frank K. Gurkaynak]]></name></author>
<id>http://eprint.iacr.org/2012/050</id>
<category term="implementation / SHA-3"/>
<category term="Hash Functions"/>
<category term="Implementation"/>
<category term="VLSI"/>
<category term="Instruction Set Extensions"/>
<category term="Assembler"/>
<content><![CDATA[In this paper, we investigate the benefit of instruction set extensions for software implementations of all five SHA-3 candidates. To this end, we start from optimized assembly code for a common 16-bit microcontroller instruction set architecture. By themselves, these implementations provide reference for complexity of the algorithms on 16-bit architectures, commonly used in embedded systems. For each algorithm, we then propose suitable instruction set extensions and implement the modified processor core. We assess the gains in throughput, memory consumption, and the area overhead. Our results show that with less than 10% additional area, it is possible to increase the execution speed on average by almost 40%, while reducing memory requirements on average by more than 40%. In particular, the Gr{\o}stl algorithm, which was one of the slowest algorithms in previous reference implementations, ends up being the fastest implementation by some margin, once minor (but dedicated) instruction
set extensions are taken into account.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/050" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[2-Dimension Sums: Distinguishers Beyond Three Rounds of RIPEMD-128 and RIPEMD-160]]></title>
<updated>2012-02-06T08:17:41Z</updated>
<author><name><![CDATA[Yu Sasaki]]></name></author>
<author><name><![CDATA[Lei Wang]]></name></author>
<id>http://eprint.iacr.org/2012/049</id>
<category term="secret-key cryptography / RIPEMD-128"/>
<category term="RIPEMD-160"/>
<category term="double-branch structure"/>
<category term="$N$-dimension sum"/>
<category term="distinguisher"/>
<content><![CDATA[This paper presents differential-based distinguishers against
ISO standard hash functions RIPEMD-128 and RIPEMD-160.
The compression functions of RIPEMD-128/-160 adopt the double-branch structure,
which updates a chaining variable
by computing two functions and merging their outputs.
Due to the double size of the internal state and
difficulties of controlling two functions simultaneously,
only few results were published before.
In this paper, second-order differential paths are constructed on reduced RIPEMD-128 and -160.
This leads to a practical 4-sum attack on 47 steps (out of 64 steps) of RIPEMD-128 and
40 steps (out of 80 steps) of RIPEMD-160.
We then extend the distinguished property from the 4-sum to other properties,
which we call \emph{a 2-dimension sum} and \emph{a partial 2-dimension sum}.
As a result, the practical partial 2-dimension sum is generated on 48 steps of RIPEMD-128 and 42 steps of RIPEMD-160,
with a complexity of $2^{35}$ and $2^{36}$, respectively.
Theoretically, $2$-dimension sums are generated faster than the exhaustive search
up to 52 steps of RIPEMD-128 and 51 steps of RIPEMD-160,
with a complexity of $2^{101}$ and $2^{158}$, respectively.
The practical attacks are implemented,
and examples of generated (partial) 2-dimension sums are presented.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/049" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Designing Integrated Accelerator for Stream Ciphers with Structural Similarities]]></title>
<updated>2012-01-31T21:17:41Z</updated>
<author><name><![CDATA[Sourav Sen Gupta]]></name></author>
<author><name><![CDATA[Anupam Chattopadhyay]]></name></author>
<author><name><![CDATA[Ayesha Khalid]]></name></author>
<id>http://eprint.iacr.org/2012/048</id>
<category term="implementation / Stream Ciphers"/>
<category term="Integrated Accelerator"/>
<category term="ASIC"/>
<category term="Area Efficiency"/>
<category term="High Throughput"/>
<category term="3GPP LTE-Advanced"/>
<category term="SNOW 3G"/>
<category term="ZUC"/>
<category term="RC4"/>
<category term="HC-128."/>
<content><![CDATA[Till date, the basic idea for implementing stream ciphers has been confined to individual standalone designs. In this paper, we introduce the notion of integrated implementation of multiple stream ciphers within a single architecture, where the goal is to achieve area and throughput efficiency by exploiting the structural similarities of the ciphers at an algorithmic level. We present two case studies to support our idea.

First, we propose the merger of SNOW 3G and ZUC stream ciphers, which constitute a part of the 3GPP LTE-Advanced security suite. We propose HiPAcc-LTE, a high performance integrated design that combines the two ciphers in hardware, based on their structural similarities. The integrated architecture reduces the area overhead significantly compared to two distinct cores, and also provides almost double throughput in terms of keystream generation, compared with the state-of-the-art implementations of the individual ciphers.

As our second case study, we present IntAcc-RCHC, an integrated accelerator for the stream ciphers RC4 and HC-128. We show that the integrated accelerator achieves a slight reduction in area without any loss in throughput compared to our standalone implementations. We also achieve at least 1.5 times better throughput compared to general purpose processors. Long term vision of this hardware integration approach for cryptographic primitives is to build a flexible core supporting multiple designs having similar algorithmic structures.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/048" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Incremental Deterministic Public-Key Encryption]]></title>
<updated>2012-01-31T21:14:16Z</updated>
<author><name><![CDATA[Ilya Mironov]]></name></author>
<author><name><![CDATA[Omkant Pandey]]></name></author>
<author><name><![CDATA[Omer Reingold]]></name></author>
<author><name><![CDATA[Gil Segev]]></name></author>
<id>http://eprint.iacr.org/2012/047</id>
<category term="public-key cryptography / "/>
<content><![CDATA[Motivated by applications in large storage systems, we initiate the study of incremental deterministic public-key encryption. Deterministic public-key encryption, introduced by Bellare, Boldyreva, and O'Neill (CRYPTO '07), provides a realistic alternative to randomized public-key encryption in various scenarios where the latter exhibits inherent drawbacks. A deterministic encryption algorithm, however, cannot satisfy any meaningful notion of security for low-entropy plaintexts distributions, and Bellare et al. demonstrated that a strong notion of security can in fact be realized for relatively high-entropy plaintext distributions.

In order to achieve a meaningful level of security, a deterministic encryption algorithm should be typically used for encrypting rather long plaintexts for ensuring a sufficient amount of entropy. This requirement may be at odds with efficiency constraints, such as communication complexity and computation complexity in the presence of small updates. Thus, a highly desirable property of deterministic encryption algorithms is incrementality: small changes in the plaintext translate into small changes in the corresponding ciphertext.

We present a framework for modeling the incrementality of deterministic public-key encryption. Within our framework we propose two schemes, which we prove to enjoy an optimal tradeoff between their security and incrementality up to small polylogarithmic factors. Our first scheme is a generic method which can be based on any deterministic public-key encryption scheme, and in particular, can be instantiated with any semantically-secure (randomized) public-key encryption scheme in the random oracle model. Our second scheme is based on the Decisional Diffie-Hellman assumption in the standard model.

The approach underpinning our schemes is inspired by the fundamental ``sample-then-extract'' technique due to Nisan and Zuckerman (JCSS '96) and refined by Vadhan (J. Cryptology '04), and by the closely related notion of ``locally-computable extractors'' due to Vadhan. Most notably, whereas Vadhan used such extractors to construct private-key encryption schemes in the bounded-storage model, we show that techniques along these lines can also be used to construct incremental public-key encryption schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/047" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Modifying Boolean Functions to Ensure Maximum Algebraic Immunity]]></title>
<updated>2012-01-31T21:13:31Z</updated>
<author><name><![CDATA[Konstantinos Limniotis]]></name></author>
<author><name><![CDATA[Nicholas Kolokotronis]]></name></author>
<author><name><![CDATA[Nicholas Kalouptsidis]]></name></author>
<id>http://eprint.iacr.org/2012/046</id>
<category term="secret-key cryptography / "/>
<content><![CDATA[The algebraic immunity of cryptographic Boolean functions  is studied in this paper. Proper modifications of  functions achieving maximum algebraic immunity are proved, in order to yield new functions of also maximum  algebraic immunity. It is shown that the derived results apply to known classes of  functions. Moreover, two new efficient algorithms to produce functions of guaranteed maximum algebraic immunity are developed, which further extend and generalize known constructions of functions with maximum algebraic immunity.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/046" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Signature Schemes Secure against Hard-to-Invert Leakage]]></title>
<updated>2012-01-31T21:07:35Z</updated>
<author><name><![CDATA[Sebastian Faust]]></name></author>
<author><name><![CDATA[Carmit Hazay]]></name></author>
<author><name><![CDATA[Jesper Buus Nielsen]]></name></author>
<author><name><![CDATA[Peter Sebastian Nordholt]]></name></author>
<author><name><![CDATA[Angela Zottarel]]></name></author>
<id>http://eprint.iacr.org/2012/045</id>
<category term="public-key cryptography / leakage"/>
<category term="auxiliary input"/>
<category term="signature"/>
<content><![CDATA[In the auxiliary input model an adversary is allowed to see a \emph{computationally hard-to-invert function} of the secret key. The auxiliary input model weakens the bounded leakage assumption commonly made in leakage resilient cryptography as the hard-to-invert function may information-theoretically reveal the entire secret key. In this work, we propose the \emph{first} constructions of digital signature schemes that are secure in the auxiliary input model. Our main contribution is a digital signature scheme that is secure against \emph{chosen message attacks} when given an \emph{exponentially hard-to-invert function} of the secret key. As a second contribution, we construct a signature scheme that achieves security for \emph{random messages} assuming that the adversary is given a \emph{polynomial-time} hard to invert function. Here, polynomial-hardness is required even when given the entire public-key -- so called \emph{weak} auxiliary input security. We show that such signature schemes readily give us auxiliary input secure identification schemes.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/045" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[PSCPA: Patient Self-controllable Privacy-preserving Cooperative Authentication in Distributed m-Healthcare Systems]]></title>
<updated>2012-01-30T06:44:47Z</updated>
<author><name><![CDATA[Jun Zhou, Zhenfu Cao]]></name></author>
<id>http://eprint.iacr.org/2012/044</id>
<category term="applications / Attribute-based DVS"/>
<category term="Secret sharing"/>
<category term="Privacy-preserving authentication"/>
<category term="Distributed m-Healthcare system"/>
<content><![CDATA[Distributed m-healthcare systems significantly facilitate efficient patient treatment of high quality, while bringing about the challenge of keeping both the confidentiality of the personal health information and the patients' identity privacy simultaneously. It makes many existing data access control and anonymous authentication schemes inefficient in distributed m-healthcare systems. To solve the problem, in this paper, a novel authorized accessible privacy model (AAPM) is established. Patients can authorize physicians by setting an access tree supporting flexible threshold predicates. Then, based on it, a patient self-controllable privacy-preserving cooperative authentication scheme (PSCPA) realizing three levels of security and privacy requirement in distributed m-healthcare system is proposed. The directly authorized physicians can both decipher the personal health information and authenticate patients' identities by satisfying the access tree with their attribute sets. Due to the indistinguishability of the transcript simulation from the patients and physicians for the indirectly authorized physicians, they can only decipher the personal health information rather than authenticate patients' identities. The unauthorized persons can obtain neither. Moreover, PSCPA is extended in emergent cases and to resist Denial of Service (Dos) attacks. Finally, the formal security proof and simulation results show our scheme far outperforms the previous ones in terms of computational, communication and storage overhead.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/044" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A novel Group Key Transfer Protocol]]></title>
<updated>2012-01-29T22:04:50Z</updated>
<author><name><![CDATA[Chingfang Hsu]]></name></author>
<author><name><![CDATA[ Bing Zeng ]]></name></author>
<author><name><![CDATA[ Qi Cheng ]]></name></author>
<author><name><![CDATA[  Guohua Cui]]></name></author>
<id>http://eprint.iacr.org/2012/043</id>
<category term="cryptographic protocols / "/>
<content><![CDATA[Group key transfer protocols depend on a mutually trusted key generation center (KGC) to transport the group key to all group members secretly. This approach requires that a trusted sever be set up, and it incurs communication overhead costs. In addition, the existing group key transfer protocols based on secret sharing all use threshold schemes that need to compute a  -degree interpolating polynomial to encrypt and decrypt the secret group key, then it increases the computational complexity of system. In this paper, we first present a novel group key transfer protocol without an online KGC, which is based on DH key agreement and a perfect linear secret sharing scheme (LSSS). The confidentiality of the group key transfer phase of this protocol is information theoretically secure, which is ensured by this LSSS. Furthermore, this protocol can resist potential attacks and also reduce the overhead of system implementation. Goals and security threats of our proposed group key transfer protocol will be analyzed in detail.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/043" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Key Length Estimation of Pairing-based Cryptosystems using $\eta_T$ Pairing]]></title>
<updated>2012-01-28T22:07:58Z</updated>
<author><name><![CDATA[Naoyuki Shinohara]]></name></author>
<author><name><![CDATA[Takeshi Shimoyama]]></name></author>
<author><name><![CDATA[Takuya Hayashi]]></name></author>
<author><name><![CDATA[Tsuyoshi Takagi ]]></name></author>
<id>http://eprint.iacr.org/2012/042</id>
<category term="public-key cryptography / pairing-based cryptosystems"/>
<category term="discrete logarithm problem"/>
<category term="finite field"/>
<category term="key length"/>
<category term="suitable values"/>
<content><![CDATA[The security of pairing-based cryptosystems depends on the difficulty of the discrete logarithm problem (DLP) over certain types of finite fields. One of the most efficient algorithms for computing a pairing is the $\eta_T$ pairing over supersingular curves on finite fields whose characteristic is $3$. Indeed many high-speed implementations of this pairing have been reported, and it is an attractive candidate for practical deployment of pairing-based cryptosystems. The embedding degree of the $\eta_T$ pairing is 6, so we deal with the difficulty of a DLP over the finite field $ GF(3^{6n})$, where the function field sieve (FFS) is known as the asymptotically fastest algorithm of solving it. Moreover, several efficient algorithms are employed for implementation of the FFS, such as the large prime variation. In this paper, we estimate the time complexity of solving the DLP for the extension degrees $n=97,163, 193,239,313,353,509$, 
when we use the improved FFS. To accomplish our aim, we present several new computable estimation formulas to compute the explicit number of special polynomials used in the improved FFS. Our estimation contributes to the evaluation for the key length of pairing-based cryptosystems using the $\eta_T$ pairing. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/042" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[STITCH-256: A NEW DEDICATED CRYPTOGRAPHIC HASH FUNCTION]]></title>
<updated>2012-01-28T22:06:58Z</updated>
<author><name><![CDATA[Norziana Jamil]]></name></author>
<author><name><![CDATA[Ramlan Mahmood]]></name></author>
<author><name><![CDATA[Muhammad Reza Z'aba]]></name></author>
<author><name><![CDATA[Nur Izura Udzir]]></name></author>
<author><name><![CDATA[Zuriati Ahmad Zukarnaen]]></name></author>
<id>http://eprint.iacr.org/2012/041</id>
<category term="cryptographic protocols / hash function"/>
<content><![CDATA[Recent progress in cryptanalysis on cryptographic hash functions has shown that the most of the hash functions based on the design principles of MD4 are susceptible to differential attack. This paper describes a new 256-bit hash function which is based on parallel branches having a stronger compression function. It is designed to have higher security than that of MD family and its variant. The performance of the new hash functions are evaluated and compared with SHA-256 and FORK-256. It is shown that STITCH-256 exhibit the desired cryptographic properties and comparable with SHA-256 and FORK-256 in its compression function. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/041" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Single-block collision attack on MD5]]></title>
<updated>2012-01-29T15:14:50Z</updated>
<author><name><![CDATA[Marc Stevens]]></name></author>
<id>http://eprint.iacr.org/2012/040</id>
<category term="MD5 single-block collision attack differential cryptanalysis challenge"/>
<content><![CDATA[In 2010, Tao Xie and Dengguo Feng [ePrint 2010/643] constructed the first single-block collision for MD5 consisting of two 64-byte messages that have the same MD5 hash. 
Details of their attack, developed using what they call an evolutionary approach, has not been disclosed ``for security reasons''.
Instead they have posted a challenge to the cryptology community to find a new different single-block collision attack for MD5. 
This paper answers that challenge by presenting a single-block collision attack based on other message differences together with an example colliding message pair.
The attack is based on a new collision finding algorithm that exploits the low number of bitconditions in the first round.
It uses a new way to choose message blocks that satisfy bitconditions up to step 22 and additionally uses three known tunnels to correct bitconditions up to step 25.
The attack has an average runtime complexity equivalent to $2^{49.8}$ calls to MD5's compression function.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/040" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Security Analysis of a Multi-Factor Authenticated Key Exchange Protocol]]></title>
<updated>2012-01-28T22:03:21Z</updated>
<author><name><![CDATA[Feng Hao]]></name></author>
<author><name><![CDATA[Dylan Clarke]]></name></author>
<id>http://eprint.iacr.org/2012/039</id>
<category term="cryptographic protocols / authenticated key exchange"/>
<content><![CDATA[This paper shows several security weaknesses of a Multi-Factor Authenticated Key Exchange (MK-AKE) protocol, proposed by Pointcheval and Zimmer at ACNS'08. The Pointcheval-Zimmer scheme was designed to combine three authentication factors in one system, including a password, a secure token (that stores a private key) and biometrics. In a formal model, Pointcheval and Zimmer formally proved that an attacker had to break all three factors to win. However, the formal model only considers the threat that an attacker may impersonate the client; it however does not discuss what will happen if the attacker impersonates the server. We fill the gap by analyzing the case of the server impersonation, which is a realistic threat in practice. We assume that an attacker has already compromised the password, and we then present two further attacks: in the first attack, an attacker is able to steal a fresh biometric sample from the victim without being noticed; in the second attack, he can discover the victim's private key based on the Chinese Remainder theorem. Both attacks have been experimentally verified. In summary, an attacker actually only needs to compromise a single password factor in order to break the entire system. We also discuss the deficiencies in the Pointcheval-Zimmer formal model and countermeasures to our attacks.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/039" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cryptanalysis of the CHES 2009/2010 Random Delay Countermeasure]]></title>
<updated>2012-01-28T22:01:52Z</updated>
<author><name><![CDATA[François Durvaux]]></name></author>
<author><name><![CDATA[Mathieu Renauld]]></name></author>
<author><name><![CDATA[François-Xavier Standaert]]></name></author>
<author><name><![CDATA[Loic van Oldeneel tot Oldenzeel]]></name></author>
<author><name><![CDATA[Nicolas Veyrat-Charvillon]]></name></author>
<id>http://eprint.iacr.org/2012/038</id>
<category term="implementation / side-channel analysis"/>
<content><![CDATA[Inserting random delays in cryptographic implementations is often used as a countermeasure against side-channel attacks. Most previous works on the topic focus on improving the statistical distribution of these delays. For example, efficient random delay generation algorithms have been proposed at CHES 2009/2010. These solutions increase security against attacks that solve the lack of synchronization between different leakage traces by integrating them. In this paper, we demonstrate that integration may not be the best tool to evaluate random delay insertions. For this purpose, we first describe different attacks exploiting pattern recognition techniques and Hidden Markov Models. Using these tools, we succeed in cryptanalyzing a (straightforward) implementation of the CHES 2009/2010 proposal in an Atmel microcontroller, with the same data complexity as an unprotected implementation of the AES Rijndael. In other words, we completely cancel the countermeasure in this case. Next, we show that our cryptanalysis tools are remarkably robust to attack improved variants of the countermeasure, e.g. with additional noise or irregular dummy operations. We also exhibit that the attacks remain applicable in a non-profiled adversarial scenario. Overall, these results suggest that the use of random delays may not be effective for protecting small embedded devices against side-channel leakage. They also confirm the need of worst-case analysis in physical security evaluations. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/038" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Recent Results on Generalized q-ary Bent Functions]]></title>
<updated>2012-01-28T22:00:44Z</updated>
<author><name><![CDATA[Deep Singh, Maheshanand Bhaintwal]]></name></author>
<author><name><![CDATA[Brajesh Kumar Singh]]></name></author>
<id>http://eprint.iacr.org/2012/037</id>
<category term="Generalized $q$-ary bent functions"/>
<category term="GMMF type bent functions"/>
<category term="Crosscorrelation"/>
<category term="Generalized Walsh-Hadamard transform"/>
<content><![CDATA[Boolean bent functions were introduced by Rothaus in 1976. In 1985, Kumar et al. extended the notion of bent functions in generalized setup on $\BBZ_q^n$. Then provided an analogue of classical Maiorana-McFarland type bent functions. In this paper, we study the crosscorrelation of a
subclass of such generalized Maiorana-McFarland (\mbox{GMMF}) type
bent functions. We provide some constructions on balanced quaternary
functions ($q = 4$) with high nonlinearity under Lee metric. Further, we provide a construction of quaternary bent functions in $n+1$ variables in terms of their subfunctions in $n$-variables.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/037" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Efficient Leakage-free Authentication of Trees, Graphs and Forests]]></title>
<updated>2012-01-28T21:58:41Z</updated>
<author><name><![CDATA[Ashish Kundu, Mikhail Atallah, Elisa Bertino]]></name></author>
<id>http://eprint.iacr.org/2012/036</id>
<category term="cryptographic protocols / digital signatures"/>
<content><![CDATA[Leakage-free authentication of trees and graphs have been studied in the literature. Such schemes have several practical applications especially in the cloud computing area. In this paper, we propose an authentication scheme that computes only one signature (optimal). Our scheme is not only super-efficient in the number of signatures it computes and in its runtime, but also is highly versatile -- it can be applied not only to trees, but also to graphs and forests (disconnected trees and graphs). While achieving such efficiency and versatility, we must also mention that our scheme achieves  the desired security -- leakage-free authentication of data objects represented as trees, graphs and forests. This is achieved by another novel scheme that we have proposed in this paper -- a secure naming scheme for nodes of such data structures. Such a scheme assigns "secure names" to nodes such that these secure names can be used to verify the order between the nodes efficiently without leaking information about other nodes. As far as we know, our scheme is the first such scheme in literature that is optimal in its efficiency, supports two important security concerns -- authenticity and leakage-free (privacy-preserving/confidentiality), and is versatile in its applicability as it is to trees, graphs as well as forests. We have carried out complexity as well as experimental analysis of this scheme that corroborates its performance.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/036" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations]]></title>
<updated>2012-01-30T02:16:33Z</updated>
<author><name><![CDATA[Andrey Bogdanov, Lars R. Knudsen, Gregor Leander, Francois-Xavier Standaert, John Steinberger, Elmar Tischhauser]]></name></author>
<id>http://eprint.iacr.org/2012/035</id>
<category term="secret-key cryptography / Block ciphers"/>
<category term="provable security"/>
<category term="Even-Mansour construction"/>
<category term="AES"/>
<content><![CDATA[This paper considers---for the first time---the concept of
key-alternating ciphers in a provable security setting.
Key-alternating ciphers can be seen as a generalization of a
construction proposed by Even and Mansour in 1991. This
construction builds a block cipher $PX$ from an $n$-bit permutation $P$
and two $n$-bit keys $k_0$ and $k_1$, setting $PX_{k_0,k_1}(x)=k_1\oplus P(x\oplus k_0)$.
Here we consider a (natural) extension of the Even-Mansour construction
with $t$ permutations $P_1,\ldots,P_t$ and $t+1$ keys, $k_0,\ldots,
k_t$. We demonstrate in a formal model that such a cipher is secure in the
sense that an attacker needs to make at least $2^{2n/3}$ queries to
the underlying permutations to be able to distinguish the construction
from random. We argue further that the bound is tight for $t=2$ but
there is a gap in the bounds for $t>2$, which is left as an open and
interesting problem. Additionally, in terms of statistical attacks, we show that the distribution of Fourier
coefficients for the cipher over all keys is close to ideal.
Lastly, we define a practical instance of the construction with $t=2$
using AES referred to as AES$^2$. Any attack on AES$^2$ with complexity below $2^{85}$ will have to make use of AES with a fixed known key in a non-black box manner. However, we conjecture its security is $2^{128}$.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/035" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Automatic Quantification of Cache Side-Channels]]></title>
<updated>2012-01-28T21:55:27Z</updated>
<author><name><![CDATA[Boris Köpf]]></name></author>
<author><name><![CDATA[Laurent Mauborgne]]></name></author>
<author><name><![CDATA[Martin Ochoa]]></name></author>
<id>http://eprint.iacr.org/2012/034</id>
<category term="implementation / Cache Attacks"/>
<category term=" Quantitative Information-flow Analysis"/>
<category term="AES"/>
<content><![CDATA[The latency gap between caches and main memory has been successfully exploited for recovering sensitive input to programs, such as cryptographic keys from implementation of AES and RSA. So far, there are no practical general-purpose countermeasures against this threat.  In this paper we propose a novel method for automatically deriving upper bounds on the amount of information about the input that an adversary can extract from a program by observing the CPU's cache behavior.  At the heart of our approach is a novel technique for efficient counting of concretizations of abstract cache states that enables us to connect state-of-the-art techniques for static cache analysis and quantitative information-flow.  We implement our counting procedure on top of the AbsInt TimingExplorer, one of the most advanced engines for static cache analysis. We use our tool to perform a case study where we derive upper bounds on the cache leakage of a 128-bit AES executable on an ARM processor with a realistic cache configuration. We also analyze this implementation with a commonly suggested (but until now heuristic) countermeasure applied, obtaining a formal account of the corresponding increase in security.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/034" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[A note on hyper-bent functions via Dillon-like exponents]]></title>
<updated>2012-01-28T21:51:18Z</updated>
<author><name><![CDATA[Sihem Mesnager]]></name></author>
<author><name><![CDATA[Jean-Pierre Flori]]></name></author>
<id>http://eprint.iacr.org/2012/033</id>
<category term="foundations / Boolean functions"/>
<category term="hyper-bent functions"/>
<category term="Walsh-Hadamard transform"/>
<category term="exponential sums"/>
<category term="Kloosterman sums"/>
<category term="Dickson polynomial"/>
<category term="finite field permutations"/>
<category term="Dillon exponent."/>
<content><![CDATA[This note is devoted to hyper-bent functions with multiple trace terms (including binomial functions) via Dillon-like exponents. We show how the approach developed by Mesnager to extend the Charpin-Gong family and subsequently extended by Wang et al. fits in a much more general setting.
To this end, we first explain how the original restriction for Charpin-Gong criterion can be weakened before generalizing the Mesnager approach to arbitrary Dillon-like exponents.
Afterward, we tackle the problem of devising infinite families of extension degrees for which a given exponent is valid and apply these results not only to reprove straightforwardly the results of Mesnager and Wang et al., but also to characterize the hyper-bentness of new infinite classes of Boolean functions.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/033" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Counterexamples to Hardness Amplification Beyond Negligible]]></title>
<updated>2012-01-28T22:19:18Z</updated>
<author><name><![CDATA[Yevgeniy Dodis]]></name></author>
<author><name><![CDATA[Abhishek Jain]]></name></author>
<author><name><![CDATA[Tal Moran]]></name></author>
<author><name><![CDATA[Daniel Wichs]]></name></author>
<id>http://eprint.iacr.org/2012/032</id>
<category term="foundations /  hardness amplification"/>
<category term="direct product"/>
<content><![CDATA[If we have a problem that is mildly hard, can we create a problem that is significantly harder? A natural approach to hardness amplification is the ``direct product''; instead of asking an attacker to solve a single instance of a problem, we ask the attacker to solve several independently generated ones. Interestingly, proving that the direct product amplifies hardness is often highly non-trivial, and in some cases may be false. For example, it is known that the direct product (i.e. ``parallel repetition'') of general interactive games may not amplify hardness at all. On the other hand, positive results show that the direct product does amplify hardness for many basic primitives such as one-way functions/relations, weakly-verifiable puzzles, and signatures.

Even when positive direct product theorems are shown to hold for some primitive, the parameters are surprisingly weaker than what we may have expected. For example, if we start with a weak one-way function that no poly-time attacker can break with probability $> \frac{1}{2}$, then the direct product provably amplifies hardness to some negligible probability. Naturally, we would expect that we can amplify hardness exponentially, all the way to $2^{-n}$ probability, or at least to some fixed/known negligible such as $n^{-\log n}$ in the security parameter $n$, just by taking sufficiently many instances of the weak primitive. Although it is known that such parameters cannot be proven via black-box reductions, they may seem like reasonable conjectures, and, to the best of our knowledge, are widely believed to hold. In fact, a conjecture along these lines was introduced in a survey of Goldreich, Nisan and Wigderson (ECCC '95). In this work, we show that such conjectures are false by providing simple but surprising counterexamples. In particular, we construct weakly secure signatures and one-way functions, for which standard hardness amplification results are known to hold, but for which hardness does not amplify beyond just negligible. That is, for any negligible function $\eps(n)$, we instantiate these primitives so that the direct product can always be broken with probability $\eps(n)$, no matter how many copies we take.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/032" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Fault Analysis of the KATAN Family of Block Ciphers]]></title>
<updated>2012-02-02T23:42:26Z</updated>
<author><name><![CDATA[Shekh Faisal Abdul-Latip]]></name></author>
<author><name><![CDATA[Mohammad Reza Reyhanitabar]]></name></author>
<author><name><![CDATA[Willy Susilo]]></name></author>
<author><name><![CDATA[Jennifer Seberry]]></name></author>
<id>http://eprint.iacr.org/2012/030</id>
<category term="secret-key cryptography / Block Ciphers"/>
<category term="Cube Attack"/>
<category term="Differential Fault Analysis"/>
<category term="KATAN"/>
<content><![CDATA[In this paper, we investigate security of the KATAN family of block ciphers against differential fault attacks. KATAN consists of three variants with 32, 48 and 64-bit block sizes, called KATAN32, KATAN48 and KATAN64, respectively. All three variants have the same key length of 80 bits. We assume a single-bit fault injection model where the adversary is supposed to be able to corrupt a single random bit of the internal state of the cipher and this fault induction process can be repeated (by resetting the cipher); i.e., the
faults are transient rather than permanent. First, we show how to identify the exact position of faulty bits within the internal state by precomputing difference characteristics for each bit position at a given round and comparing these characteristics with ciphertext differences (XOR of faulty and non-faulty ciphertexts) during the online phase of the attack.
Then, we determine suitable rounds for effective fault inductions by analyzing distributions of low-degree (mainly, linear and quadratic) polynomial equations obtainable using the cube and extended cube attack techniques. The complexity of our attack on KATAN32 is $2^{59}$ computations and about 115 fault injections. For KATAN48 and KATAN64, the attack requires $2^{55}$ computations (for both variants), while the required number of fault injections is 211 and 278, respectively. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/030" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Breaking the provably secure SAKE-C authenticated key exchange protocol with Extended Key Compromise Impersonation (E-KCI) Attack ]]></title>
<updated>2012-01-31T21:40:08Z</updated>
<author><name><![CDATA[Ali Mackvandi]]></name></author>
<author><name><![CDATA[Maryam Saeed]]></name></author>
<author><name><![CDATA[Mansour Naddafiun]]></name></author>
<id>http://eprint.iacr.org/2012/027</id>
<category term="AKE (Authenticated Key Exchange)"/>
<category term="Cryptographic protocols"/>
<category term="Extended KCI attack"/>
<category term="Security Analysis."/>
<content><![CDATA[Authenticated Key Exchange (AKE) protocols are those protocols that allow two or more entities to concur with a common session key in an authentic manner in which this key is used to encrypt the proceeding communications. In 2010, Zhao et al. proposed Provably Secure Authenticated Key Exchange Protocol under the CDH Assumption (referred to as SAKE and SAKE-C). Despite the fact that the security of the proposed protocol is proved in the formal model, due to not considering all the prerequisite queries in defining and designing formal security model, in this letter it is shown that the so-called secure protocol is vulnerable to Extended Key Compromise Impersonation (E-KCI) attack so that this attack is a practicable flaw that was signaled by Tang et al. for the first time in 2011. Unfortunately, it is conspicuously perspicuous that most of the AKE and PAKE protocols are vulnerable to E-KCI attack which is a new-introduced flaw in this field, because even one of the most famous, secure, and efficient PAKE protocols such as the 3-pass HMQV protocol suffers from this vulnerability. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/027" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Secondary constructions on generalized bent functions]]></title>
<updated>2012-02-03T12:32:52Z</updated>
<author><name><![CDATA[Brajesh Kumar Singh]]></name></author>
<id>http://eprint.iacr.org/2012/017</id>
<category term="secret-key cryptography / Generalized Boolean functions; generalized bent functions; Walsh--Hadamard transform."/>
<content><![CDATA[In this paper, we construct generalized bent Boolean functions in $n+ 2$ variables from $4$ generalized Boolean functions in $n$ variables. We also show that the direct sum of two generalized bent Boolean functions is generalized bent. Finally, we identify a set of affine functions in which every function is generalized bent.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/017" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Efficient Mix-Net Verication by Proofs of Random Blocks]]></title>
<updated>2012-02-07T03:20:47Z</updated>
<author><name><![CDATA[Denise Demirel]]></name></author>
<author><name><![CDATA[Melanie Volkamer]]></name></author>
<author><name><![CDATA[Hugo Jonker]]></name></author>
<id>http://eprint.iacr.org/2012/016</id>
<category term="mix-net"/>
<category term="efficient verification"/>
<category term="batch verification"/>
<category term="privacy"/>
<category term="randomized partial checking"/>
<category term="optimistic mixing"/>
<category term="eVoting"/>
<content><![CDATA[In order for a mix-net to be usable in practice (e.g. in electronic
voting), efficient verification is a must. Despite many advances in the
last decade, zero-knowledge proofs remain too computationally intense.
Two alternative proof approaches have been suggested: optimistic mix-net
verification and randomized partial checking. Puiggal\'i et al. proposed a
verification method combining these two approaches. This paper
investigates their mix-net and proposes a verification method which
offers both improved efficiency and more privacy.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/016" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Indifferentiable Hash Functions in the Multi-Stage Security Games]]></title>
<updated>2012-02-08T02:19:16Z</updated>
<author><name><![CDATA[Yusuke Naito]]></name></author>
<id>http://eprint.iacr.org/2012/014</id>
<category term="indifferentiability"/>
<category term="reset indifferentiability"/>
<category term="multi-stage security game"/>
<content><![CDATA[It had been widely believed that the indifferentiability framework ensures composition in any security game. 
However, Ristenpart, Shacham, and Shrimpton (EUROCRYPT 2011) demonstrated that for some multi-stage security,
there exists a cryptosystem which is secure in the random oracle (RO) model but is broken when some indifferentiable hash function is used.  
However, this does not imply that for any multi-stage security, any cryptosystem is broken when a RO is replaced with the indifferentiable hash function. 
They showed that the important multi-stage security: the chosen-distribution attack (CDA) security is preserved for some public key encryption (PKE) schemes
when a RO is replaced with the indifferentiable hash function proposed by Dodis, Ristenpart, and Shrimpton (EUROCRYPT 2009). 
An open problem from their result is the multi-stage security when a RO is replaced with other indifferentiable hash functions. 
We show the following for the important indifferentiable hash functions, Prefix-free Merkle-Damg{\aa}rd, Sponge, and chop Merkle-Damg{\aa}rd. 

* PKE scheme, the PRIV security, which is a multi-stage security, is preserved when a RO is replaced with the indifferentiable hash functions. 

* {\it All} existing hedged PKE scheme, 
which is CDA-secure in the RO model, are CDA-secure when using the indifferentiable hash function.  
]]></content>
<link rel="self" href="http://eprint.iacr.org/2012/014" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Improved Side Channel Attacks on Pairing Based Cryptography]]></title>
<updated>2012-01-24T02:01:18Z</updated>
<author><name><![CDATA[Johannes Blömer]]></name></author>
<author><name><![CDATA[Peter Günther]]></name></author>
<author><name><![CDATA[Gennadij Liske]]></name></author>
<id>http://eprint.iacr.org/2011/706</id>
<category term="implementation / "/>
<content><![CDATA[Techniques from pairing based cryptography (PBC) are used in an in-
creasing number of cryptographic schemes. With progress regarding efficient implementations, pairings also become interesting for applications on smart cards. With these applications the question of the vulnerability to side channel attacks (SCAs) arises. Several known invasive and non-invasive attacksagainst pairing algorithms only work if the second but not if the &#64257;rst argument of the pairing is the secret. In this paper we extend some of these attacks also to the case where the &#64257;rst argument is the secret. Hence we may conclude that positioning the secret as the &#64257;rst argument of the pairing does
not improve the security against SCAs, as it sometimes has been suggested.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/706" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Security of ID Based Signcryption Schemes]]></title>
<updated>2012-02-08T04:35:31Z</updated>
<author><name><![CDATA[S. Sharmila Deva Selvi]]></name></author>
<author><name><![CDATA[S. Sree Vivek]]></name></author>
<author><name><![CDATA[Dhinakaran Vinayagamurthy]]></name></author>
<author><name><![CDATA[C. Pandu Rangan]]></name></author>
<id>http://eprint.iacr.org/2011/664</id>
<category term="public-key cryptography / cryptanalysis"/>
<category term="provable security"/>
<category term="ID-based signcryption"/>
<content><![CDATA[A signcryption scheme is secure only if it satisfies both the confidentiality and the unforgeability properties. All the ID based signcryption schemes presented in the standard model till now do not have either the confidentiality or the unforgeability or both of these properties. Cryptanalysis of the schemes have been proposed already. In this work, we present the security attack on `Secure ID based signcryption in the standard model' proposed by Li-Takagi and flaws in the proof of security of `Efficient ID based signcryption in the standard model' proposed by Li et al., which are the recently proposed ID based signcryption schemes in the standard model. We also present the cryptanalysis of `Construction of identity based signcryption schemes' proposed by Pandey-Barua, which presents the method of constructing an ID based signcryption scheme in the random oracle model from an ID based signature scheme and an ID based encryption scheme. Since none of the existing schemes in the standard model are found to be provably secure, we analyse the security of signcryption schemes got by directly combining an ID based signature scheme and an ID based encryption scheme in the standard model.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/664" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Formally Assessing Cryptographic Entropy]]></title>
<updated>2012-02-01T14:22:40Z</updated>
<author><name><![CDATA[Daniel R. L. Brown]]></name></author>
<id>http://eprint.iacr.org/2011/659</id>
<category term="foundations / Entropy Assessment"/>
<category term="Key Generation"/>
<content><![CDATA[Cryptography relies on the secrecy of keys.  Measures of information, and thus secrecy, are called entropy.  Previous work does not formally assess the cryptographically appropriate entropy of secret keys.
  
This report defines several new forms of entropy appropriate for cryptographic situations.  This report defines statistical inference methods appropriate for assessing cryptographic entropy.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/659" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Achieving Short Ciphertexts or Short Secret-Keys for Adaptively Secure General Inner-Product Encryption]]></title>
<updated>2012-01-26T22:24:24Z</updated>
<author><name><![CDATA[Tatsuaki Okamoto]]></name></author>
<author><name><![CDATA[Katsuyuki Takashima]]></name></author>
<id>http://eprint.iacr.org/2011/648</id>
<category term="public-key cryptography / Inner-Product Encryption"/>
<category term="Functional Encryption"/>
<category term="Predicate Encryption"/>
<category term="Attribute-Hiding"/>
<content><![CDATA[In this paper, we present two non-zero inner-product encryption (NIPE) schemes that are adaptively secure under a standard assumption, the decisional linear (DLIN) assumption, in the standard model. One of the proposed NIPE schemes features constant-size ciphertexts and the other features constant-size secret-keys. Our NIPE schemes imply an identity-based revocation (IBR) system
with constant-size ciphertexts or constant-size secret-keys that is adaptively secure under the DLIN assumption. Any previous IBR scheme with constant-size ciphertexts or constant-size secret-keys was not adaptively secure in the standard model. This paper also presents two zero inner-product encryption (ZIPE) schemes each of which has constant-size ciphertexts or constant-size secret-keys and is adaptively secure under the DLIN assumption in the standard model. They imply an identity-based broadcast encryption (IBBE) system with constant-size ciphertexts or constant-size secret-keys that is adaptively secure under the DLIN assumption. We also extend the proposed ZIPE schemes into two directions, one is a fully-attribute-hiding ZIPE scheme with constant-size secret-keys, and the other a hierarchical ZIPE scheme with constant-size ciphertexts.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/648" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption]]></title>
<updated>2012-01-26T22:46:31Z</updated>
<author><name><![CDATA[Tatsuaki Okamoto]]></name></author>
<author><name><![CDATA[Katsuyuki Takashima]]></name></author>
<id>http://eprint.iacr.org/2011/543</id>
<category term="public-key cryptography / Functional Encryption"/>
<category term="Predicate Encryption"/>
<category term="Attribute-Hiding"/>
<content><![CDATA[This paper proposes the first inner product encryption (IPE) scheme that is adaptively secure and fully attribute-hiding (attribute-hiding in the sense of the definition by Katz, Sahai and Waters), while the existing IPE schemes are either fully attribute-hiding but selectively secure or adaptively secure but weakly attribute-hiding. The proposed IPE scheme is proven to be adaptively secure and fully attribute-hiding under the decisional linear assumption in the standard model. The IPE scheme is comparably as efficient as the existing attribute-hiding IPE schemes. We also present a variant of the proposed IPE scheme with the same security that achieves shorter public and secret keys. A hierarchical IPE scheme can be constructed that is also adaptively secure and fully attribute-hiding under the same assumption. In this paper, we extend the dual system encryption
technique by Waters into a more general manner, in which new forms of
ciphertext and secret keys are employed and new types of information
theoretical tricks are introduced along with several forms of computational reduction. 

]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/543" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Random Self-Reducibility Properties of Learning Problems over Burnside Groups of Exponent 3]]></title>
<updated>2012-02-03T15:41:35Z</updated>
<author><name><![CDATA[Nelly Fazio]]></name></author>
<author><name><![CDATA[Kevin Iga]]></name></author>
<author><name><![CDATA[Antonio Nicolosi]]></name></author>
<author><name><![CDATA[Ludovic Perret]]></name></author>
<author><name><![CDATA[William E. Skeith III]]></name></author>
<id>http://eprint.iacr.org/2011/398</id>
<category term="foundations / Random self-reducibility. Learning with errors. Post-quantum cryptography. Non-commutative cryptography. Burnside groups."/>
<content><![CDATA[In this work we investigate the hardness of a computational problem introduced in the recent work of Baumslag et al. In particular, we study the $B_n$-LHN problem, which is a generalized version of the learning with errors (LWE) problem, instantiated with a particular family of non-abelian groups (free Burnside groups of exponent 3). In our main result, we demonstrate a random self-reducibility property for $B_n$-LHN. Along the way, we also prove a sequence of lemmas regarding homomorphisms of free Burnside groups of exponent 3 that may be of independent interest.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/398" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cryptanalysis of an Authenticated Key Agreement Protocol for Wireless Mobile Communications]]></title>
<updated>2012-01-31T07:55:12Z</updated>
<author><name><![CDATA[Debiao He]]></name></author>
<id>http://eprint.iacr.org/2011/336</id>
<category term="Authenticated key agreement; Off-line password guessing attack; Wireless mobile communication; 3GPP2"/>
<content><![CDATA[With the rapid progress of wireless mobile communication, the authenticated key agreement (AKA) protocol has attracted an increasing amount of attention. However, due to the limitations of bandwidth and storage of the mobile devices, most of the existing AKA protocols are not suitable for wireless mobile communication. Recently, Lo et al. presented an efficient authenticated key agreement protocol based on elliptic curve cryptography and included their protocol in 3GPP2 specifications. However, in this letter, we point out that Lo et al.'s protocol is vulnerable to an off-line password guessing attack. To resist the attack, we also propose an efficient countermeasure.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/336" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 family]]></title>
<updated>2012-02-07T08:17:20Z</updated>
<author><name><![CDATA[Dmitry Khovratovich]]></name></author>
<author><name><![CDATA[Christian Rechberger]]></name></author>
<author><name><![CDATA[Alexandra Savelieva]]></name></author>
<id>http://eprint.iacr.org/2011/286</id>
<category term="secret-key cryptography / "/>
<content><![CDATA[We present the new concept of biclique as a tool for preimage attacks, which employs many powerful techniques from differential
cryptanalysis of block ciphers and hash functions.

The new tool has proved to be widely applicable by inspiring many  authors to publish new results of the full versions of AES, KASUMI, IDEA, Square, and others. In this paper, we demonstrate how our concept results in the first cryptanalysis of the Skein hash function, and describe an attack on the SHA-2 hash function with more rounds than before.

]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/286" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[DDH-like Assumptions Based on Extension Rings]]></title>
<updated>2012-01-23T00:59:31Z</updated>
<author><name><![CDATA[Ronald Cramer]]></name></author>
<author><name><![CDATA[Ivan Damgaard]]></name></author>
<author><name><![CDATA[Eike Kiltz]]></name></author>
<author><name><![CDATA[Sarah Zakarias]]></name></author>
<author><name><![CDATA[Angela Zottarel]]></name></author>
<id>http://eprint.iacr.org/2011/280</id>
<category term="public-key cryptography / DDH"/>
<category term="Public Key Encryption"/>
<category term="PRF"/>
<category term="Leakage Resilient Encryption"/>
<content><![CDATA[We introduce and study a new type of DDH-like assumptions based on
groups of prime order q. Whereas standard DDH is based on encoding
elements of F_{q} ``in the exponent'' of elements in the group, we
ask what happens if instead we put in the exponent elements of the
extension ring R_f= \F_{q}[X]/(f) where f can be any degree-d
polynomial. We show that solving the decision problem that follows
naturally reduces to the case where f is irreducible. This variant
is called the d-DDH problem, where 1-DDH is standard
DDH. Essentially any known cryptographic construction based on DDH can
be immediately generalized to use instead d-DDH, and we show in the
generic group model that d-DDH is harder than DDH. This means that
virtually any application of DDH can now be realized with the same
(amortized) efficiency, but under a potentially weaker assumption. On
the negative side, we also show that d-DDH, just like DDH, is easy
in bilinear groups. This motivates our suggestion of a different type
of assumption, the d-vector DDH problems (VDDH), which are based on
f(X)= X^d, but with a twist to avoid the problems with reducible
polynomials. We show in the generic group model that VDDH is hard in
bilinear groups and that in fact the problems become harder with
increasing d and hence form an infinite hierarchy. We show that
hardness of VDDH implies CCA-secure encryption, efficient
Naor-Reingold style pseudorandom functions, and auxiliary input secure
encryption, a strong form of leakage resilience. This can be seen as
an alternative to the known family of k-linear assumptions.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/280" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cycling Attacks on GCM, GHASH and Other Polynomial MACs and Hashes]]></title>
<updated>2012-01-27T08:36:48Z</updated>
<author><name><![CDATA[Markku-Juhani O. Saarinen]]></name></author>
<id>http://eprint.iacr.org/2011/202</id>
<category term="Cryptanalysis"/>
<category term="Galois/Counter Mode"/>
<category term="AES-GCM"/>
<category term="Cycling Attacks"/>
<category term="Weak Keys."/>
<content><![CDATA[    The Galois/Counter Mode (GCM) of operation has been standardized
    by NIST to provide single-pass authenticated encryption.  
    The GHASH authentication component of GCM belongs to a
    class of Wegman-Carter polynomial hashes that operate
    in the field $\mathrm{GF}(2^{128})$. We present message forgery attacks 
    that are made possible by its extremely smooth-order multiplicative 
    group which splits into 512 subgroups. GCM uses the same block cipher key 
    $K$ to both encrypt data and to derive the generator $H$ of the
    authentication polynomial for GHASH. In present literature, only the 
    trivial weak key $H=0$ has been considered. We show that GHASH has 
    much wider classes of weak keys in its 512 multiplicative subgroups, 
    analyze some of their properties, and give experimental results 
    on AES-GCM weak key search. Our attacks can be used not only to 
    bypass message authentication with garbage but also to target
    specific plaintext bits if a polynomial MAC is used in conjunction
    with a stream cipher. These attacks can also be applied with
    varying efficiency to other polynomial hashes and MACs, depending on 
    their field properties. Our findings show that especially the use of 
    short polynomial-evaluation MACs should be avoided 
    if the underlying field has a smooth multiplicative order.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/202" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[The Parazoa Family: Generalizing the Sponge Hash Functions]]></title>
<updated>2012-02-10T00:52:33Z</updated>
<author><name><![CDATA[Elena Andreeva]]></name></author>
<author><name><![CDATA[Bart Mennink]]></name></author>
<author><name><![CDATA[Bart Preneel]]></name></author>
<id>http://eprint.iacr.org/2011/028</id>
<category term="secret-key cryptography / Parazoa functions"/>
<category term="sponge functions"/>
<category term="hash function design"/>
<category term="indifferentiability"/>
<content><![CDATA[Sponge functions were introduced by Bertoni et al. as an alternative to the classical Merkle-Damgaard design. Many hash function submissions to the SHA-3 competition launched by NIST in 2007, such as CubeHash, Fugue, Hamsi, JH, Keccak and Luffa, derive from the original sponge design, and security guarantees from some of these constructions are typically based on indifferentiability results. Although indifferentiability proofs for these designs often bear significant similarities, these have so far been obtained independently for each construction. In this work, we introduce the parazoa family of hash functions as a generalization of ``sponge-like'' functions. Similarly to the sponge design, the parazoa family consists of compression and extraction phases. The parazoa hash functions, however, extend the sponge construction by enabling the use of a wider class of compression and extraction functions that need to satisfy certain properties. More importantly, we prove that the parazoa functions satisfy the indifferentiability notion of Maurer et al. under the assumption that the underlying permutation is ideal. Not surprisingly, our indifferentiability result confirms the bound on the original sponge function, but it also carries over to a wider spectrum of hash functions and eliminates the need for a separate indifferentiability analysis.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/028" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Cover and Decomposition Index Calculus on Elliptic Curves made practical. Application to a seemingly secure curve over $\F_{p^6}$]]></title>
<updated>2012-01-30T09:12:35Z</updated>
<author><name><![CDATA[Antoine Joux]]></name></author>
<author><name><![CDATA[Vanessa Vitse]]></name></author>
<id>http://eprint.iacr.org/2011/020</id>
<category term="elliptic curve"/>
<category term="discrete logarithm"/>
<category term="index calculus"/>
<category term="Weil descent"/>
<category term="decomposition attack"/>
<content><![CDATA[We present a new variant of cover and decomposition attacks on the elliptic curve discrete logarithm problem, that combines Weil descent and decomposition-based index calculus into a single discrete logarithm algorithm. This variant applies, at least theoretically, to all composite degree extension fields, and is particularly well-suited for curves defined over $\F_{p^6}$. We give a real-size example of discrete logarithm computations on a seemingly secure curve defined over a 130$-bit degree $6$ extension field. 
]]></content>
<link rel="self" href="http://eprint.iacr.org/2011/020" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[No-leak authentication by the Sherlock Holmes method]]></title>
<updated>2012-02-08T06:43:53Z</updated>
<author><name><![CDATA[Dima Grigoriev]]></name></author>
<author><name><![CDATA[Vladimir Shpilrain]]></name></author>
<id>http://eprint.iacr.org/2010/624</id>
<category term="cryptographic protocols / authentication"/>
<category term="zero knowledge"/>
<content><![CDATA[We propose a class of authentication schemes  that are literally zero-knowledge, as compared to what is formally defined as ``zero-knowledge" in cryptographic literature. We call this ``no-leak" authentication to distinguish from an established ``zero-knowledge" concept. The ``no-leak" condition implies ``zero-knowledge" (even ``perfect zero-knowledge"), but it is actually stronger, as we illustrate by examples.
The principal idea behind our schemes is: the verifier challenges the prover with questions that he (the verifier) already knows answers to; therefore, even a computationally unbounded verifier who follows the protocol cannot possibly learn anything new during any number of authentication sessions. This is therefore also true for a computationally unbounded passive adversary.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2010/624" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[On the Analysis of Cryptographic Assumptions in the Generic Ring Model]]></title>
<updated>2012-01-25T14:56:30Z</updated>
<author><name><![CDATA[Tibor Jager]]></name></author>
<author><name><![CDATA[Jörg Schwenk]]></name></author>
<id>http://eprint.iacr.org/2009/621</id>
<category term="foundations / Generic ring model"/>
<category term="analysis of cryptographic assumptions"/>
<content><![CDATA[The generic ring model considers algorithms that operate on elements of an algebraic ring by performing only the ring operations and without exploiting properties of a given representation of ring elements. It is used to analyze the hardness of computational problems defined over rings. For instance, it is known that breaking RSA is equivalent to factoring in the generic ring model (Aggarwal and Maurer, Eurocrypt 2009). Do hardness results in the generic ring model support the conjecture that solving the considered problem is also hard in the standard model, where elements of $\Z_n$ are represented by integers modulo $n$?

We prove in the generic ring model that computing the Jacobi symbol of an integer modulo $n$ is equivalent to factoring. Since there are simple and efficient non-generic algorithms which compute the Jacobi symbol, this provides an example of a natural computational problem which is hard in the generic ring model, but easy to solve if elements of $\Z_n$ are given in their standard representation as integers. Thus, a proof in the generic ring model is unfortunately not a very strong indicator for the hardness of a computational problem in the standard model.

Despite this negative result, generic hardness results still provide a lower complexity bound for a large class of algorithms, namely all algorithms solving a computational problem independent of a given representation of ring elements. Thus, from this point of view results in the generic ring model are still interesting. Motivated by this fact, we show also that solving the quadratic residuosity problem generically is equivalent to factoring.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/621" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[RFID distance bounding protocol with mixed challenges to prevent relay attacks]]></title>
<updated>2012-01-23T09:10:03Z</updated>
<author><name><![CDATA[Chong Hee Kim]]></name></author>
<author><name><![CDATA[Gildas Avoine]]></name></author>
<id>http://eprint.iacr.org/2009/310</id>
<category term="cryptographic protocols / RFID"/>
<category term="authentication"/>
<category term="distance bounding protocol"/>
<category term="relay attack."/>
<content><![CDATA[RFID systems suffer from different location-based attacks such as distance fraud, mafia fraud and terrorist fraud attacks. Among them mafia fraud attack is the most serious since this attack can be mounted without the notice of both the reader and the tag. An adversary performs a kind of man-in-the-middle attack between the reader and the tag. It is very difficult to prevent this attack since the adversary does not change any data between the reader and the tag. Recently distance bounding protocols measuring the round-trip time between the reader and the tag have been researched to prevent this attack.

All the existing distance bounding protocols based on binary challenges, without final signature, provide an adversary success probability equal to (3/4)^n where n is the number of rounds in the protocol. In this paper, we introduce a new protocol based on binary mixed challenges that converges toward the expected and optimal (1/2)^n bound. We prove its security in case of both noisy and non-noisy channels.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2009/310" />
<rights>Copyright held by author</rights>
</entry>
<entry>
<title><![CDATA[Provable-Security Analysis of Authenticated Encryption in Kerberos]]></title>
<updated>2012-02-04T20:50:21Z</updated>
<author><name><![CDATA[Alexandra Boldyreva]]></name></author>
<author><name><![CDATA[Virendra Kumar]]></name></author>
<id>http://eprint.iacr.org/2007/234</id>
<category term="Kerberos"/>
<category term="authenticated encryption"/>
<category term="provable security."/>
<content><![CDATA[Kerberos is a widely deployed network authentication protocol currently being considered for standardization.  Many works have analyzed its security, identifying flaws and often suggesting fixes, thus promoting the protocol's evolution.  Several recent results present successful, formal methods-based verifications of a significant portion of the current version, v.5, and some even imply security in the computational setting.  For these results to hold, encryption in Kerberos should satisfy strong cryptographic security notions.  However, prior to our work, none of the encryption schemes currently deployed as part of Kerberos, nor their proposed revisions, were known to provably satisfy such notions.  We take a close look at Kerberos' encryption, and we confirm that most of the options in the current version provably provide privacy and authenticity, though some require slight modifications which we suggest.  Our results complement the formal methods-based analysis of Kerberos that justifies its current design.
]]></content>
<link rel="self" href="http://eprint.iacr.org/2007/234" />
<rights>Copyright held by author</rights>
</entry>
</feed>

