<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
<channel><title>Cryptology ePrint Archive</title>
<link>http://eprint.iacr.org/</link>
<description>Recently modified papers in the IACR Cryptology ePrint Archive</description>
<language>en-us</language>
<lastBuildDate>Thu, 09 Feb 2012 18:11:02 -0700</lastBuildDate>
<webMaster>webmaster@iacr.org</webMaster>
<managingEditor>eprint-editor@iacr.org</managingEditor>
<generator>None of your business</generator>
<ttl>60</ttl>
<item>
<link>http://eprint.iacr.org/2012/056</link>
<title><![CDATA[A New Pseudorandom Generator from Collision-Resistant Hash Functions]]>, by Alexandra Boldyreva and Virendra Kumar</title>
<description><![CDATA[We present a new hash-function-based pseudorandom generator (PRG). Our PRG is reminiscent of the classical constructions iterating a function on a random seed and extracting Goldreich-Levin hardcore bits at each iteration step. The latest PRG of this type that relies on reasonable assumptions (regularity and one-wayness) is due to Haitner et al. In addition to a regular one-way function, each iteration in their ``randomized iterate'' scheme uses a new pairwise-independent function, whose descriptions are part of the seed of the PRG. Our construction does not use pairwise-independent functions and is thus more efficient, requiring less computation and a significantly shorter seed. Our scheme's security relies on the standard notions of collision-resistance and regularity of the underlying hash function, where the collision-resistance is required to be {\em exponential}. In particular, any polynomial-time adversary should have less than $2^{-n/2}$ probability of finding collisions, where $n$ is the output size of the hash function. We later show how to relax the regularity assumption by introducing a new notion that we call {\em worst-case regularity}, which lower bounds the size of primages of different elements from the range (while the  common regularity assumption requires all such sets to be of equal size). Unlike previous results, we provide a concrete security statement.
]]></description>
<guid>http://eprint.iacr.org/2012/056</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/055</link>
<title><![CDATA[Cryptanalysis of Mun et al.'s anonymous authentication scheme for roaming service in global mobility networks]]>, by Hongbin Tang and Xinsong Liu</title>
<description><![CDATA[An anonymous user authentication scheme allows the user and the remote server to authenticate each other, and should preserve user anonymity. In 2011, Mun et al. proposed an enhanced secure anonymous user authentication scheme for roaming service in global mobility networks. They claimed that their scheme was more secure and efficient than others. However, we demonstrate that their scheme is vulnerable to the insider, impersonation, server spoofing, and denial of service attacks along with the efficiency and password issues. Meanwhile, it cannot provide any user anonymity. Thus it is not feasible for the real-life implementation.
]]></description>
<guid>http://eprint.iacr.org/2012/055</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/054</link>
<title><![CDATA[On the performance of certain Private Set Intersection protocols. (And some remarks on the recent paper by Huang et al. in NDSS'12)]]>, by Emiliano De Cristofaro and Gene Tsudik</title>
<description><![CDATA[Private Set Intersection (PSI) is a well-known cryptographic primitive that allows one party ("client") to compute an intersection of its input set with that of another party ("server"), such that the client learns nothing other than the set intersection, while the server learns nothing beyond client input size. This paper reports on the implementation and performance evaluation of a specific PSI construction [DT10]. First, we discuss implementation choices that significantly impact real-life protocol performance (and that should be taken into account when deploying or benchmarking it). Then, we present a comprehensive experimental analysis, including micro-benchmarking, with various input sizes. Finally, we comment on some results presented at NDSS'12 paper titled: "Private Set Intersection: Are Garbled Circuits Better Than Custom Protocols?" [HEK12].

]]></description>
<guid>http://eprint.iacr.org/2012/054</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/053</link>
<title><![CDATA[Beating Shannon requires BOTH efficient adversaries AND non-zero advantage]]>, by Yevgeniy Dodis</title>
<description><![CDATA[In this note we formally show a "folklore" (but, to the best of our knowledge, not documented) fact that in order to beat the famous Shannon lower bound on key length for one-time-secure encryption, one must *simultaneously* restrict the attacker to be efficient, and also allow the attacker to break the system with some non-zero (i.e., negligible) probability. Despite being "folklore", we were unable to find a clean and simple proof of this result, despite asking several experts in the field. We hope that cryptography instructors will find this note useful when justifying the transition from information-theoretic to computational cryptography.

We note that our proof cleanly handles *probabilistic* encryption, as well as a small *decryption error*.

]]></description>
<guid>http://eprint.iacr.org/2012/053</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/052</link>
<title><![CDATA[Identity-based Encryption with Efficient Revocation]]>, by Alexandra Boldyreva and Vipul Goyal and Virendra Kumar</title>
<description><![CDATA[Identity-based encryption (IBE) is an exciting
alternative to public-key encryption, as IBE eliminates the need for
a Public Key Infrastructure (PKI). Any setting,
PKI- or identity-based, must provide a means to revoke users from
the system.  Efficient revocation is a well-studied problem in the
traditional PKI setting. However in the setting of IBE, there has
been little work on studying the revocation mechanisms. The most
practical solution requires the senders to also use time periods
when encrypting, and all the receivers (regardless of whether their
keys have been compromised or not) to update their private keys
regularly by contacting the trusted authority. We note that this
solution does not scale well -- as the number of users increases,
the work on key updates becomes  a bottleneck. We propose an IBE
scheme that significantly improves key-update efficiency on the side
of the trusted party (from linear to logarithmic in the number of
users), while staying efficient for the users. Our scheme builds on
the ideas of the Fuzzy IBE primitive and binary tree data structure,
and is provably secure. 
]]></description>
<guid>http://eprint.iacr.org/2012/052</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/051</link>
<title><![CDATA[Eavesdropping on Satellite Telecommunication Systems]]>, by Benedikt Driessen</title>
<description><![CDATA[While communication infrastructures rapidly intertwine with our daily lives, public understanding of underlying technologies and privacy implications is often limited by their closed-source nature. Lacking the funding and resources of corporations and the intelligence community, developing and expanding this understanding is a sometimes tedious, but nonetheless important process. In this sense, we document how we have decrypted our own communication in the Thuraya satellite network. We have used open-source software to build on recent work which reverse-engineered and cryptanalized both stream ciphers currently used in the competing satellite communication standards GMR-1 and GMR-2. To break Thuraya's encryption (which implements the GMR-1 standard) in a real-world scenario, we have enhanced an existing ciphertext-only attack. We have used common and moderately expensive equipment to capture a live call session and executed the described attack. We show that, after computing less than an hour on regular PC-hardware, we were able to obtain the session key from a handful of speech data frames. This effectively allows decryption of the entire session, thus demonstrating that the Thuraya system (and probably also SkyTerra and TerreStar, who are currently implementing GMR-1) is weak at protecting privacy.
]]></description>
<guid>http://eprint.iacr.org/2012/051</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/050</link>
<title><![CDATA[Investigating the Potential of Custom Instruction Set Extensions for SHA-3 Candidates on a 16-bit Microcontroller Architecture]]>, by Jeremy Constantin and Andreas Burg and Frank K. Gurkaynak</title>
<description><![CDATA[In this paper, we investigate the benefit of instruction set extensions for software implementations of all five SHA-3 candidates. To this end, we start from optimized assembly code for a common 16-bit microcontroller instruction set architecture. By themselves, these implementations provide reference for complexity of the algorithms on 16-bit architectures, commonly used in embedded systems. For each algorithm, we then propose suitable instruction set extensions and implement the modified processor core. We assess the gains in throughput, memory consumption, and the area overhead. Our results show that with less than 10% additional area, it is possible to increase the execution speed on average by almost 40%, while reducing memory requirements on average by more than 40%. In particular, the Gr{\o}stl algorithm, which was one of the slowest algorithms in previous reference implementations, ends up being the fastest implementation by some margin, once minor (but dedicated) instruction
set extensions are taken into account.
]]></description>
<guid>http://eprint.iacr.org/2012/050</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/049</link>
<title><![CDATA[2-Dimension Sums: Distinguishers Beyond Three Rounds of RIPEMD-128 and RIPEMD-160]]>, by Yu Sasaki and Lei Wang</title>
<description><![CDATA[This paper presents differential-based distinguishers against
ISO standard hash functions RIPEMD-128 and RIPEMD-160.
The compression functions of RIPEMD-128/-160 adopt the double-branch structure,
which updates a chaining variable
by computing two functions and merging their outputs.
Due to the double size of the internal state and
difficulties of controlling two functions simultaneously,
only few results were published before.
In this paper, second-order differential paths are constructed on reduced RIPEMD-128 and -160.
This leads to a practical 4-sum attack on 47 steps (out of 64 steps) of RIPEMD-128 and
40 steps (out of 80 steps) of RIPEMD-160.
We then extend the distinguished property from the 4-sum to other properties,
which we call \emph{a 2-dimension sum} and \emph{a partial 2-dimension sum}.
As a result, the practical partial 2-dimension sum is generated on 48 steps of RIPEMD-128 and 42 steps of RIPEMD-160,
with a complexity of $2^{35}$ and $2^{36}$, respectively.
Theoretically, $2$-dimension sums are generated faster than the exhaustive search
up to 52 steps of RIPEMD-128 and 51 steps of RIPEMD-160,
with a complexity of $2^{101}$ and $2^{158}$, respectively.
The practical attacks are implemented,
and examples of generated (partial) 2-dimension sums are presented.
]]></description>
<guid>http://eprint.iacr.org/2012/049</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/048</link>
<title><![CDATA[Designing Integrated Accelerator for Stream Ciphers with Structural Similarities]]>, by Sourav Sen Gupta and Anupam Chattopadhyay and Ayesha Khalid</title>
<description><![CDATA[Till date, the basic idea for implementing stream ciphers has been confined to individual standalone designs. In this paper, we introduce the notion of integrated implementation of multiple stream ciphers within a single architecture, where the goal is to achieve area and throughput efficiency by exploiting the structural similarities of the ciphers at an algorithmic level. We present two case studies to support our idea.

First, we propose the merger of SNOW 3G and ZUC stream ciphers, which constitute a part of the 3GPP LTE-Advanced security suite. We propose HiPAcc-LTE, a high performance integrated design that combines the two ciphers in hardware, based on their structural similarities. The integrated architecture reduces the area overhead significantly compared to two distinct cores, and also provides almost double throughput in terms of keystream generation, compared with the state-of-the-art implementations of the individual ciphers.

As our second case study, we present IntAcc-RCHC, an integrated accelerator for the stream ciphers RC4 and HC-128. We show that the integrated accelerator achieves a slight reduction in area without any loss in throughput compared to our standalone implementations. We also achieve at least 1.5 times better throughput compared to general purpose processors. Long term vision of this hardware integration approach for cryptographic primitives is to build a flexible core supporting multiple designs having similar algorithmic structures.

]]></description>
<guid>http://eprint.iacr.org/2012/048</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/047</link>
<title><![CDATA[Incremental Deterministic Public-Key Encryption]]>, by Ilya Mironov and Omkant Pandey and Omer Reingold and Gil Segev</title>
<description><![CDATA[Motivated by applications in large storage systems, we initiate the study of incremental deterministic public-key encryption. Deterministic public-key encryption, introduced by Bellare, Boldyreva, and O'Neill (CRYPTO '07), provides a realistic alternative to randomized public-key encryption in various scenarios where the latter exhibits inherent drawbacks. A deterministic encryption algorithm, however, cannot satisfy any meaningful notion of security for low-entropy plaintexts distributions, and Bellare et al. demonstrated that a strong notion of security can in fact be realized for relatively high-entropy plaintext distributions.

In order to achieve a meaningful level of security, a deterministic encryption algorithm should be typically used for encrypting rather long plaintexts for ensuring a sufficient amount of entropy. This requirement may be at odds with efficiency constraints, such as communication complexity and computation complexity in the presence of small updates. Thus, a highly desirable property of deterministic encryption algorithms is incrementality: small changes in the plaintext translate into small changes in the corresponding ciphertext.

We present a framework for modeling the incrementality of deterministic public-key encryption. Within our framework we propose two schemes, which we prove to enjoy an optimal tradeoff between their security and incrementality up to small polylogarithmic factors. Our first scheme is a generic method which can be based on any deterministic public-key encryption scheme, and in particular, can be instantiated with any semantically-secure (randomized) public-key encryption scheme in the random oracle model. Our second scheme is based on the Decisional Diffie-Hellman assumption in the standard model.

The approach underpinning our schemes is inspired by the fundamental ``sample-then-extract'' technique due to Nisan and Zuckerman (JCSS '96) and refined by Vadhan (J. Cryptology '04), and by the closely related notion of ``locally-computable extractors'' due to Vadhan. Most notably, whereas Vadhan used such extractors to construct private-key encryption schemes in the bounded-storage model, we show that techniques along these lines can also be used to construct incremental public-key encryption schemes.
]]></description>
<guid>http://eprint.iacr.org/2012/047</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/046</link>
<title><![CDATA[Modifying Boolean Functions to Ensure Maximum Algebraic Immunity]]>, by Konstantinos Limniotis and Nicholas Kolokotronis and Nicholas Kalouptsidis</title>
<description><![CDATA[The algebraic immunity of cryptographic Boolean functions  is studied in this paper. Proper modifications of  functions achieving maximum algebraic immunity are proved, in order to yield new functions of also maximum  algebraic immunity. It is shown that the derived results apply to known classes of  functions. Moreover, two new efficient algorithms to produce functions of guaranteed maximum algebraic immunity are developed, which further extend and generalize known constructions of functions with maximum algebraic immunity.
]]></description>
<guid>http://eprint.iacr.org/2012/046</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/045</link>
<title><![CDATA[Signature Schemes Secure against Hard-to-Invert Leakage]]>, by Sebastian Faust and Carmit Hazay and Jesper Buus Nielsen and Peter Sebastian Nordholt and Angela Zottarel</title>
<description><![CDATA[In the auxiliary input model an adversary is allowed to see a \emph{computationally hard-to-invert function} of the secret key. The auxiliary input model weakens the bounded leakage assumption commonly made in leakage resilient cryptography as the hard-to-invert function may information-theoretically reveal the entire secret key. In this work, we propose the \emph{first} constructions of digital signature schemes that are secure in the auxiliary input model. Our main contribution is a digital signature scheme that is secure against \emph{chosen message attacks} when given an \emph{exponentially hard-to-invert function} of the secret key. As a second contribution, we construct a signature scheme that achieves security for \emph{random messages} assuming that the adversary is given a \emph{polynomial-time} hard to invert function. Here, polynomial-hardness is required even when given the entire public-key -- so called \emph{weak} auxiliary input security. We show that such signature schemes readily give us auxiliary input secure identification schemes.
]]></description>
<guid>http://eprint.iacr.org/2012/045</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/044</link>
<title><![CDATA[PSCPA: Patient Self-controllable Privacy-preserving Cooperative Authentication in Distributed m-Healthcare Systems]]>, by Jun Zhou, Zhenfu Cao</title>
<description><![CDATA[Distributed m-healthcare systems significantly facilitate efficient patient treatment of high quality, while bringing about the challenge of keeping both the confidentiality of the personal health information and the patients' identity privacy simultaneously. It makes many existing data access control and anonymous authentication schemes inefficient in distributed m-healthcare systems. To solve the problem, in this paper, a novel authorized accessible privacy model (AAPM) is established. Patients can authorize physicians by setting an access tree supporting flexible threshold predicates. Then, based on it, a patient self-controllable privacy-preserving cooperative authentication scheme (PSCPA) realizing three levels of security and privacy requirement in distributed m-healthcare system is proposed. The directly authorized physicians can both decipher the personal health information and authenticate patients' identities by satisfying the access tree with their attribute sets. Due to the indistinguishability of the transcript simulation from the patients and physicians for the indirectly authorized physicians, they can only decipher the personal health information rather than authenticate patients' identities. The unauthorized persons can obtain neither. Moreover, PSCPA is extended in emergent cases and to resist Denial of Service (Dos) attacks. Finally, the formal security proof and simulation results show our scheme far outperforms the previous ones in terms of computational, communication and storage overhead.
]]></description>
<guid>http://eprint.iacr.org/2012/044</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/043</link>
<title><![CDATA[A novel Group Key Transfer Protocol]]>, by Chingfang Hsu and  Bing Zeng  and  Qi Cheng  and   Guohua Cui</title>
<description><![CDATA[Group key transfer protocols depend on a mutually trusted key generation center (KGC) to transport the group key to all group members secretly. This approach requires that a trusted sever be set up, and it incurs communication overhead costs. In addition, the existing group key transfer protocols based on secret sharing all use threshold schemes that need to compute a  -degree interpolating polynomial to encrypt and decrypt the secret group key, then it increases the computational complexity of system. In this paper, we first present a novel group key transfer protocol without an online KGC, which is based on DH key agreement and a perfect linear secret sharing scheme (LSSS). The confidentiality of the group key transfer phase of this protocol is information theoretically secure, which is ensured by this LSSS. Furthermore, this protocol can resist potential attacks and also reduce the overhead of system implementation. Goals and security threats of our proposed group key transfer protocol will be analyzed in detail.
]]></description>
<guid>http://eprint.iacr.org/2012/043</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/042</link>
<title><![CDATA[Key Length Estimation of Pairing-based Cryptosystems using $\eta_T$ Pairing]]>, by Naoyuki Shinohara and Takeshi Shimoyama and Takuya Hayashi and Tsuyoshi Takagi </title>
<description><![CDATA[The security of pairing-based cryptosystems depends on the difficulty of the discrete logarithm problem (DLP) over certain types of finite fields. One of the most efficient algorithms for computing a pairing is the $\eta_T$ pairing over supersingular curves on finite fields whose characteristic is $3$. Indeed many high-speed implementations of this pairing have been reported, and it is an attractive candidate for practical deployment of pairing-based cryptosystems. The embedding degree of the $\eta_T$ pairing is 6, so we deal with the difficulty of a DLP over the finite field $ GF(3^{6n})$, where the function field sieve (FFS) is known as the asymptotically fastest algorithm of solving it. Moreover, several efficient algorithms are employed for implementation of the FFS, such as the large prime variation. In this paper, we estimate the time complexity of solving the DLP for the extension degrees $n=97,163, 193,239,313,353,509$, 
when we use the improved FFS. To accomplish our aim, we present several new computable estimation formulas to compute the explicit number of special polynomials used in the improved FFS. Our estimation contributes to the evaluation for the key length of pairing-based cryptosystems using the $\eta_T$ pairing. 
]]></description>
<guid>http://eprint.iacr.org/2012/042</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/041</link>
<title><![CDATA[STITCH-256: A NEW DEDICATED CRYPTOGRAPHIC HASH FUNCTION]]>, by Norziana Jamil and Ramlan Mahmood and Muhammad Reza Z'aba and Nur Izura Udzir and Zuriati Ahmad Zukarnaen</title>
<description><![CDATA[Recent progress in cryptanalysis on cryptographic hash functions has shown that the most of the hash functions based on the design principles of MD4 are susceptible to differential attack. This paper describes a new 256-bit hash function which is based on parallel branches having a stronger compression function. It is designed to have higher security than that of MD family and its variant. The performance of the new hash functions are evaluated and compared with SHA-256 and FORK-256. It is shown that STITCH-256 exhibit the desired cryptographic properties and comparable with SHA-256 and FORK-256 in its compression function. 
]]></description>
<guid>http://eprint.iacr.org/2012/041</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/040</link>
<title><![CDATA[Single-block collision attack on MD5]]>, by Marc Stevens</title>
<description><![CDATA[In 2010, Tao Xie and Dengguo Feng [ePrint 2010/643] constructed the first single-block collision for MD5 consisting of two 64-byte messages that have the same MD5 hash. 
Details of their attack, developed using what they call an evolutionary approach, has not been disclosed ``for security reasons''.
Instead they have posted a challenge to the cryptology community to find a new different single-block collision attack for MD5. 
This paper answers that challenge by presenting a single-block collision attack based on other message differences together with an example colliding message pair.
The attack is based on a new collision finding algorithm that exploits the low number of bitconditions in the first round.
It uses a new way to choose message blocks that satisfy bitconditions up to step 22 and additionally uses three known tunnels to correct bitconditions up to step 25.
The attack has an average runtime complexity equivalent to $2^{49.8}$ calls to MD5's compression function.
]]></description>
<guid>http://eprint.iacr.org/2012/040</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/039</link>
<title><![CDATA[Security Analysis of a Multi-Factor Authenticated Key Exchange Protocol]]>, by Feng Hao and Dylan Clarke</title>
<description><![CDATA[This paper shows several security weaknesses of a Multi-Factor Authenticated Key Exchange (MK-AKE) protocol, proposed by Pointcheval and Zimmer at ACNS'08. The Pointcheval-Zimmer scheme was designed to combine three authentication factors in one system, including a password, a secure token (that stores a private key) and biometrics. In a formal model, Pointcheval and Zimmer formally proved that an attacker had to break all three factors to win. However, the formal model only considers the threat that an attacker may impersonate the client; it however does not discuss what will happen if the attacker impersonates the server. We fill the gap by analyzing the case of the server impersonation, which is a realistic threat in practice. We assume that an attacker has already compromised the password, and we then present two further attacks: in the first attack, an attacker is able to steal a fresh biometric sample from the victim without being noticed; in the second attack, he can discover the victim's private key based on the Chinese Remainder theorem. Both attacks have been experimentally verified. In summary, an attacker actually only needs to compromise a single password factor in order to break the entire system. We also discuss the deficiencies in the Pointcheval-Zimmer formal model and countermeasures to our attacks.
]]></description>
<guid>http://eprint.iacr.org/2012/039</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/038</link>
<title><![CDATA[Cryptanalysis of the CHES 2009/2010 Random Delay Countermeasure]]>, by François Durvaux and Mathieu Renauld and François-Xavier Standaert and Loic van Oldeneel tot Oldenzeel and Nicolas Veyrat-Charvillon</title>
<description><![CDATA[Inserting random delays in cryptographic implementations is often used as a countermeasure against side-channel attacks. Most previous works on the topic focus on improving the statistical distribution of these delays. For example, efficient random delay generation algorithms have been proposed at CHES 2009/2010. These solutions increase security against attacks that solve the lack of synchronization between different leakage traces by integrating them. In this paper, we demonstrate that integration may not be the best tool to evaluate random delay insertions. For this purpose, we first describe different attacks exploiting pattern recognition techniques and Hidden Markov Models. Using these tools, we succeed in cryptanalyzing a (straightforward) implementation of the CHES 2009/2010 proposal in an Atmel microcontroller, with the same data complexity as an unprotected implementation of the AES Rijndael. In other words, we completely cancel the countermeasure in this case. Next, we show that our cryptanalysis tools are remarkably robust to attack improved variants of the countermeasure, e.g. with additional noise or irregular dummy operations. We also exhibit that the attacks remain applicable in a non-profiled adversarial scenario. Overall, these results suggest that the use of random delays may not be effective for protecting small embedded devices against side-channel leakage. They also confirm the need of worst-case analysis in physical security evaluations. 
]]></description>
<guid>http://eprint.iacr.org/2012/038</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/037</link>
<title><![CDATA[Recent Results on Generalized q-ary Bent Functions]]>, by Deep Singh, Maheshanand Bhaintwal and Brajesh Kumar Singh</title>
<description><![CDATA[Boolean bent functions were introduced by Rothaus in 1976. In 1985, Kumar et al. extended the notion of bent functions in generalized setup on $\BBZ_q^n$. Then provided an analogue of classical Maiorana-McFarland type bent functions. In this paper, we study the crosscorrelation of a
subclass of such generalized Maiorana-McFarland (\mbox{GMMF}) type
bent functions. We provide some constructions on balanced quaternary
functions ($q = 4$) with high nonlinearity under Lee metric. Further, we provide a construction of quaternary bent functions in $n+1$ variables in terms of their subfunctions in $n$-variables.
]]></description>
<guid>http://eprint.iacr.org/2012/037</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/036</link>
<title><![CDATA[Efficient Leakage-free Authentication of Trees, Graphs and Forests]]>, by Ashish Kundu, Mikhail Atallah, Elisa Bertino</title>
<description><![CDATA[Leakage-free authentication of trees and graphs have been studied in the literature. Such schemes have several practical applications especially in the cloud computing area. In this paper, we propose an authentication scheme that computes only one signature (optimal). Our scheme is not only super-efficient in the number of signatures it computes and in its runtime, but also is highly versatile -- it can be applied not only to trees, but also to graphs and forests (disconnected trees and graphs). While achieving such efficiency and versatility, we must also mention that our scheme achieves  the desired security -- leakage-free authentication of data objects represented as trees, graphs and forests. This is achieved by another novel scheme that we have proposed in this paper -- a secure naming scheme for nodes of such data structures. Such a scheme assigns "secure names" to nodes such that these secure names can be used to verify the order between the nodes efficiently without leaking information about other nodes. As far as we know, our scheme is the first such scheme in literature that is optimal in its efficiency, supports two important security concerns -- authenticity and leakage-free (privacy-preserving/confidentiality), and is versatile in its applicability as it is to trees, graphs as well as forests. We have carried out complexity as well as experimental analysis of this scheme that corroborates its performance.

]]></description>
<guid>http://eprint.iacr.org/2012/036</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/035</link>
<title><![CDATA[Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations]]>, by Andrey Bogdanov, Lars R. Knudsen, Gregor Leander, Francois-Xavier Standaert, John Steinberger, Elmar Tischhauser</title>
<description><![CDATA[This paper considers---for the first time---the concept of
key-alternating ciphers in a provable security setting.
Key-alternating ciphers can be seen as a generalization of a
construction proposed by Even and Mansour in 1991. This
construction builds a block cipher $PX$ from an $n$-bit permutation $P$
and two $n$-bit keys $k_0$ and $k_1$, setting $PX_{k_0,k_1}(x)=k_1\oplus P(x\oplus k_0)$.
Here we consider a (natural) extension of the Even-Mansour construction
with $t$ permutations $P_1,\ldots,P_t$ and $t+1$ keys, $k_0,\ldots,
k_t$. We demonstrate in a formal model that such a cipher is secure in the
sense that an attacker needs to make at least $2^{2n/3}$ queries to
the underlying permutations to be able to distinguish the construction
from random. We argue further that the bound is tight for $t=2$ but
there is a gap in the bounds for $t>2$, which is left as an open and
interesting problem. Additionally, in terms of statistical attacks, we show that the distribution of Fourier
coefficients for the cipher over all keys is close to ideal.
Lastly, we define a practical instance of the construction with $t=2$
using AES referred to as AES$^2$. Any attack on AES$^2$ with complexity below $2^{85}$ will have to make use of AES with a fixed known key in a non-black box manner. However, we conjecture its security is $2^{128}$.
]]></description>
<guid>http://eprint.iacr.org/2012/035</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/034</link>
<title><![CDATA[Automatic Quantification of Cache Side-Channels]]>, by Boris Köpf and Laurent Mauborgne and Martin Ochoa</title>
<description><![CDATA[The latency gap between caches and main memory has been successfully exploited for recovering sensitive input to programs, such as cryptographic keys from implementation of AES and RSA. So far, there are no practical general-purpose countermeasures against this threat.  In this paper we propose a novel method for automatically deriving upper bounds on the amount of information about the input that an adversary can extract from a program by observing the CPU's cache behavior.  At the heart of our approach is a novel technique for efficient counting of concretizations of abstract cache states that enables us to connect state-of-the-art techniques for static cache analysis and quantitative information-flow.  We implement our counting procedure on top of the AbsInt TimingExplorer, one of the most advanced engines for static cache analysis. We use our tool to perform a case study where we derive upper bounds on the cache leakage of a 128-bit AES executable on an ARM processor with a realistic cache configuration. We also analyze this implementation with a commonly suggested (but until now heuristic) countermeasure applied, obtaining a formal account of the corresponding increase in security.
]]></description>
<guid>http://eprint.iacr.org/2012/034</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/033</link>
<title><![CDATA[A note on hyper-bent functions via Dillon-like exponents]]>, by Sihem Mesnager and Jean-Pierre Flori</title>
<description><![CDATA[This note is devoted to hyper-bent functions with multiple trace terms (including binomial functions) via Dillon-like exponents. We show how the approach developed by Mesnager to extend the Charpin-Gong family and subsequently extended by Wang et al. fits in a much more general setting.
To this end, we first explain how the original restriction for Charpin-Gong criterion can be weakened before generalizing the Mesnager approach to arbitrary Dillon-like exponents.
Afterward, we tackle the problem of devising infinite families of extension degrees for which a given exponent is valid and apply these results not only to reprove straightforwardly the results of Mesnager and Wang et al., but also to characterize the hyper-bentness of new infinite classes of Boolean functions.

]]></description>
<guid>http://eprint.iacr.org/2012/033</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/032</link>
<title><![CDATA[Counterexamples to Hardness Amplification Beyond Negligible]]>, by Yevgeniy Dodis and Abhishek Jain and Tal Moran and Daniel Wichs</title>
<description><![CDATA[If we have a problem that is mildly hard, can we create a problem that is significantly harder? A natural approach to hardness amplification is the ``direct product''; instead of asking an attacker to solve a single instance of a problem, we ask the attacker to solve several independently generated ones. Interestingly, proving that the direct product amplifies hardness is often highly non-trivial, and in some cases may be false. For example, it is known that the direct product (i.e. ``parallel repetition'') of general interactive games may not amplify hardness at all. On the other hand, positive results show that the direct product does amplify hardness for many basic primitives such as one-way functions/relations, weakly-verifiable puzzles, and signatures.

Even when positive direct product theorems are shown to hold for some primitive, the parameters are surprisingly weaker than what we may have expected. For example, if we start with a weak one-way function that no poly-time attacker can break with probability $> \frac{1}{2}$, then the direct product provably amplifies hardness to some negligible probability. Naturally, we would expect that we can amplify hardness exponentially, all the way to $2^{-n}$ probability, or at least to some fixed/known negligible such as $n^{-\log n}$ in the security parameter $n$, just by taking sufficiently many instances of the weak primitive. Although it is known that such parameters cannot be proven via black-box reductions, they may seem like reasonable conjectures, and, to the best of our knowledge, are widely believed to hold. In fact, a conjecture along these lines was introduced in a survey of Goldreich, Nisan and Wigderson (ECCC '95). In this work, we show that such conjectures are false by providing simple but surprising counterexamples. In particular, we construct weakly secure signatures and one-way functions, for which standard hardness amplification results are known to hold, but for which hardness does not amplify beyond just negligible. That is, for any negligible function $\eps(n)$, we instantiate these primitives so that the direct product can always be broken with probability $\eps(n)$, no matter how many copies we take.
]]></description>
<guid>http://eprint.iacr.org/2012/032</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/031</link>
<title><![CDATA[An error in "On a new formal proof model for RFID location privacy"]]>, by Da-Zhi Sun</title>
<description><![CDATA[In Information Processing Letters 110 (2) (2009) 57-61, Deursen and Radomirovi&#263; evaluated five formal RFID privacy models. One main result is that Ha et al.'s RFID privacy model is incorrect. The supporting fact is that a constant-response protocol cannot pass the test of Ha et al.'s RFID privacy model. However, we demonstrate that the constant-response protocol is artificial, and the corresponding result is therefore unwarranted. It means that Ha et al.'s RFID privacy model is not a trivial model. Hence, more effort still can be made to improve Ha et al.'s RFID privacy model.
]]></description>
<guid>http://eprint.iacr.org/2012/031</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/030</link>
<title><![CDATA[Fault Analysis of the KATAN Family of Block Ciphers]]>, by Shekh Faisal Abdul-Latip and Mohammad Reza Reyhanitabar and Willy Susilo and Jennifer Seberry</title>
<description><![CDATA[In this paper, we investigate security of the KATAN family of block ciphers against differential fault attacks. KATAN consists of three variants with 32, 48 and 64-bit block sizes, called KATAN32, KATAN48 and KATAN64, respectively. All three variants have the same key length of 80 bits. We assume a single-bit fault injection model where the adversary is supposed to be able to corrupt a single random bit of the internal state of the cipher and this fault induction process can be repeated (by resetting the cipher); i.e., the
faults are transient rather than permanent. First, we show how to identify the exact position of faulty bits within the internal state by precomputing difference characteristics for each bit position at a given round and comparing these characteristics with ciphertext differences (XOR of faulty and non-faulty ciphertexts) during the online phase of the attack.
Then, we determine suitable rounds for effective fault inductions by analyzing distributions of low-degree (mainly, linear and quadratic) polynomial equations obtainable using the cube and extended cube attack techniques. The complexity of our attack on KATAN32 is $2^{59}$ computations and about 115 fault injections. For KATAN48 and KATAN64, the attack requires $2^{55}$ computations (for both variants), while the required number of fault injections is 211 and 278, respectively. 
]]></description>
<guid>http://eprint.iacr.org/2012/030</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/029</link>
<title><![CDATA[On the Exact Security of Schnorr-Type Signatures in the Random Oracle Model]]>, by Yannick Seurin</title>
<description><![CDATA[The Schnorr signature scheme has been known to be provably secure in the Random Oracle Model under the Discrete Logarithm (DL) assumption since the work of Pointcheval and Stern (EUROCRYPT '96), at the price of a very loose reduction though: if there is a forger making at most $q_h$ random oracle queries, and forging signatures with probability $\varepsilon_F$, then the Forking Lemma tells that one can compute discrete logarithms with constant probability by rewinding the forger $\mathcal{O}(q_h/\varepsilon_F)$ times. In other words, the security reduction loses a factor $\mathcal{O}(q_h)$ in its time-to-success ratio. This is rather unsatisfactory since $q_h$ may be quite large. Yet Paillier and Vergnaud (ASIACRYPT 2005) later showed that under the One More Discrete Logarithm (OMDL) assumption, any \emph{algebraic} reduction must lose a factor at least $q_h^{1/2}$ in its time-to-success ratio. This was later improved by Garg~\emph{et al.} (CRYPTO 2008) to a factor $q_h^{2/3}$. Up to now, the gap between $q_h^{2/3}$ and $q_h$ remained open. In this paper, we show that the security proof using the Forking Lemma is essentially the best possible. Namely, under the OMDL assumption, any algebraic reduction must lose a factor $f(\varepsilon_F)q_h$ in its time-to-success ratio, where $f\le 1$ is a function that remains close to 1 as long as $\varepsilon_F$ is noticeably smaller than 1. Using a formulation in terms of expected-time and queries algorithms, we obtain an optimal loss factor $\Omega(q_h)$, independently of $\varepsilon_F$. These results apply to other signature schemes based on one-way group homomorphisms, such as the Guillou-Quisquater signature scheme.
]]></description>
<guid>http://eprint.iacr.org/2012/029</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/027</link>
<title><![CDATA[Breaking the provably secure SAKE-C authenticated key exchange protocol with Extended Key Compromise Impersonation (E-KCI) Attack ]]>, by Ali Mackvandi and Maryam Saeed and Mansour Naddafiun</title>
<description><![CDATA[Authenticated Key Exchange (AKE) protocols are those protocols that allow two or more entities to concur with a common session key in an authentic manner in which this key is used to encrypt the proceeding communications. In 2010, Zhao et al. proposed Provably Secure Authenticated Key Exchange Protocol under the CDH Assumption (referred to as SAKE and SAKE-C). Despite the fact that the security of the proposed protocol is proved in the formal model, due to not considering all the prerequisite queries in defining and designing formal security model, in this letter it is shown that the so-called secure protocol is vulnerable to Extended Key Compromise Impersonation (E-KCI) attack so that this attack is a practicable flaw that was signaled by Tang et al. for the first time in 2011. Unfortunately, it is conspicuously perspicuous that most of the AKE and PAKE protocols are vulnerable to E-KCI attack which is a new-introduced flaw in this field, because even one of the most famous, secure, and efficient PAKE protocols such as the 3-pass HMQV protocol suffers from this vulnerability. 
]]></description>
<guid>http://eprint.iacr.org/2012/027</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/022</link>
<title><![CDATA[Polynomial-Time, Semantically-Secure Encryption Achieving the Secrecy Capacity]]>, by Mihir Bellare and Stefano Tessaro</title>
<description><![CDATA[In the wiretap channel setting, one aims to get
  information-theoretic privacy of communicated data based only on the
  assumption that the channel from sender to adversary is noisier than the one
  from sender to receiver. The secrecy capacity is the optimal (highest
  possible) rate of a secure scheme, and the existence of schemes achieving it
  has been shown. For thirty years the ultimate and unreached goal has been to
  achieve this optimal rate with a scheme that is polynomial-time.  (This means
  both encryption and decryption are proven polynomial time algorithms.)  This
  paper finally delivers such a scheme. In fact it does more. Our scheme not
  only meets the classical notion of security from the wiretap literature,
  called MIS-R (mutual information security for random messages) but achieves
  the strictly stronger notion of semantic security, thus delivering more in
  terms of security without loss of rate.
]]></description>
<category>Information-theoretic security, entropy, extractors</category>
<guid>http://eprint.iacr.org/2012/022</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/017</link>
<title><![CDATA[Secondary constructions on generalized bent functions]]>, by Brajesh Kumar Singh</title>
<description><![CDATA[In this paper, we construct generalized bent Boolean functions in $n+ 2$ variables from $4$ generalized Boolean functions in $n$ variables. We also show that the direct sum of two generalized bent Boolean functions is generalized bent. Finally, we identify a set of affine functions in which every function is generalized bent.
]]></description>
<guid>http://eprint.iacr.org/2012/017</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/016</link>
<title><![CDATA[Efficient Mix-Net Verication by Proofs of Random Blocks]]>, by Denise Demirel and Melanie Volkamer and Hugo Jonker</title>
<description><![CDATA[In order for a mix-net to be usable in practice (e.g. in electronic
voting), efficient verification is a must. Despite many advances in the
last decade, zero-knowledge proofs remain too computationally intense.
Two alternative proof approaches have been suggested: optimistic mix-net
verification and randomized partial checking. Puiggal\'i et al. proposed a
verification method combining these two approaches. This paper
investigates their mix-net and proposes a verification method which
offers both improved efficiency and more privacy.
]]></description>
<guid>http://eprint.iacr.org/2012/016</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/015</link>
<title><![CDATA[A Cryptographic Treatment of the Wiretap Channel]]>, by Mihir Bellare and Stefano Tessaro and Alexander Vardy</title>
<description><![CDATA[The wiretap channel is a setting where one aims to provide information-theoretic privacy of communicated data based solely on the assumption that the channel from sender to adversary is ``noisier'' than the channel from sender to receiver. It has been the subject of decades of work in the information and coding (I&C) community. This paper bridges the gap between this body of work and modern cryptography with contributions along two fronts, namely METRICS (definitions) of security, and SCHEMES. We explain that the metric currently in use is weak and insufficient to guarantee security of applications and propose two replacements. One, that we call mis-security, is a mutual-information based metric in the I&C style. The other, semantic security, adapts to this setting a cryptographic metric that, in the cryptography community, has been vetted by decades of evaluation and endorsed as the target for standards and implementations. We show that they are equivalent (any scheme secure under one is secure under the other), thereby connecting two fundamentally different ways of defining security and providing a strong, unified and well-founded target for designs. Moving on to schemes, results from the wiretap community are mostly non-constructive, proving the existence of schemes without necessarily yielding ones that are explicit, let alone efficient, and only meeting their weak notion of security. We apply cryptographic methods based on extractors to produce explicit, polynomial-time and even practical encryption schemes that meet our new and stronger security target.
]]></description>
<category>Information-theoretic security, entropy, keyless</category>
<guid>http://eprint.iacr.org/2012/015</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/014</link>
<title><![CDATA[On the Indifferentiable Hash Functions in the Multi-Stage Security Games]]>, by Yusuke Naito</title>
<description><![CDATA[It had been widely believed that the indifferentiability framework ensures composition in any security game. 
However, Ristenpart, Shacham, and Shrimpton (EUROCRYPT 2011) demonstrated that for some multi-stage security,
there exists a cryptosystem which is secure in the random oracle (RO) model but is broken when some indifferentiable hash function is used.  
However, this does not imply that for any multi-stage security, any cryptosystem is broken when a RO is replaced with the indifferentiable hash function. 
They showed that the important multi-stage security: the chosen-distribution attack (CDA) security is preserved for some public key encryption (PKE) schemes
when a RO is replaced with the indifferentiable hash function proposed by Dodis, Ristenpart, and Shrimpton (EUROCRYPT 2009). 
An open problem from their result is the multi-stage security when a RO is replaced with other indifferentiable hash functions. 
We show the following for the important indifferentiable hash functions, Prefix-free Merkle-Damg{\aa}rd, Sponge, and chop Merkle-Damg{\aa}rd. 

* PKE scheme, the PRIV security, which is a multi-stage security, is preserved when a RO is replaced with the indifferentiable hash functions. 

* {\it All} existing hedged PKE scheme, 
which is CDA-secure in the RO model, are CDA-secure when using the indifferentiable hash function.  
]]></description>
<guid>http://eprint.iacr.org/2012/014</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/706</link>
<title><![CDATA[Improved Side Channel Attacks on Pairing Based Cryptography]]>, by Johannes Blömer and Peter Günther and Gennadij Liske</title>
<description><![CDATA[Techniques from pairing based cryptography (PBC) are used in an in-
creasing number of cryptographic schemes. With progress regarding efficient implementations, pairings also become interesting for applications on smart cards. With these applications the question of the vulnerability to side channel attacks (SCAs) arises. Several known invasive and non-invasive attacksagainst pairing algorithms only work if the second but not if the &#64257;rst argument of the pairing is the secret. In this paper we extend some of these attacks also to the case where the &#64257;rst argument is the secret. Hence we may conclude that positioning the secret as the &#64257;rst argument of the pairing does
not improve the security against SCAs, as it sometimes has been suggested.

]]></description>
<guid>http://eprint.iacr.org/2011/706</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/703</link>
<title><![CDATA[Waters Signatures with Optimal Security Reduction]]>, by Dennis Hofheinz and Tibor Jager</title>
<description><![CDATA[Waters signatures (Eurocrypt 2005) can be shown existentially unforgeable under chosen-message attacks under the assumption that the computational Diffie-Hellman problem in the underlying (pairing-friendly) group is hard. The corresponding security proof has a reduction loss of O(l*q), where l is the bitlength of messages, and q is the number of adversarial signature queries. The original reduction could meanwhile be improved to O(\sqrt{l}*q) (Hofheinz and Kiltz, Crypto 2008); however, it is currently unknown whether a better reduction exists. We answer this question as follows:

  (a) We give a simple modification of Waters signatures, where messages are encoded such that each two encoded messages have a suitably large Hamming distance. Somewhat surprisingly, this simple modification suffices to prove security under the CDH assumption with a reduction loss of O(q).

  (b) We also show that any black-box security proof for a signature scheme with re-randomizable signatures must have a reduction loss of at least \Omega(q), or the underlying hardness assumption is false. Since both Waters signatures and our variant from (a) are re-randomizable, this proves our reduction from (a) optimal up to a constant factor.

Understanding and optimizing the security loss of a cryptosystem is important to derive concrete parameters, such as the size of the underlying group. We provide a complete picture for Waters-like signatures: there is an inherent lower bound for the security loss, and we show how to achieve it.
]]></description>
<guid>http://eprint.iacr.org/2011/703</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/664</link>
<title><![CDATA[On the Security of ID Based Signcryption Schemes]]>, by S. Sharmila Deva Selvi and S. Sree Vivek and Dhinakaran Vinayagamurthy and C. Pandu Rangan</title>
<description><![CDATA[A signcryption scheme is secure only if it satisfies both the confidentiality and the unforgeability properties. All the ID based signcryption schemes presented in the standard model till now do not have either the confidentiality or the unforgeability or both of these properties. Cryptanalysis of the schemes have been proposed already. In this work, we present the security attack on `Secure ID based signcryption in the standard model' proposed by Li-Takagi and flaws in the proof of security of `Efficient ID based signcryption in the standard model' proposed by Li et al., which are the recently proposed ID based signcryption schemes in the standard model. We also present the cryptanalysis of `Construction of identity based signcryption schemes' proposed by Pandey-Barua, which presents the method of constructing an ID based signcryption scheme in the random oracle model from an ID based signature scheme and an ID based encryption scheme. Since none of the existing schemes in the standard model are found to be provably secure, we analyse the security of signcryption schemes got by directly combining an ID based signature scheme and an ID based encryption scheme in the standard model.
]]></description>
<guid>http://eprint.iacr.org/2011/664</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/659</link>
<title><![CDATA[Formally Assessing Cryptographic Entropy]]>, by Daniel R. L. Brown</title>
<description><![CDATA[Cryptography relies on the secrecy of keys.  Measures of information, and thus secrecy, are called entropy.  Previous work does not formally assess the cryptographically appropriate entropy of secret keys.
  
This report defines several new forms of entropy appropriate for cryptographic situations.  This report defines statistical inference methods appropriate for assessing cryptographic entropy.

]]></description>
<guid>http://eprint.iacr.org/2011/659</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/648</link>
<title><![CDATA[Achieving Short Ciphertexts or Short Secret-Keys for Adaptively Secure General Inner-Product Encryption]]>, by Tatsuaki Okamoto and Katsuyuki Takashima</title>
<description><![CDATA[In this paper, we present two non-zero inner-product encryption (NIPE) schemes that are adaptively secure under a standard assumption, the decisional linear (DLIN) assumption, in the standard model. One of the proposed NIPE schemes features constant-size ciphertexts and the other features constant-size secret-keys. Our NIPE schemes imply an identity-based revocation (IBR) system
with constant-size ciphertexts or constant-size secret-keys that is adaptively secure under the DLIN assumption. Any previous IBR scheme with constant-size ciphertexts or constant-size secret-keys was not adaptively secure in the standard model. This paper also presents two zero inner-product encryption (ZIPE) schemes each of which has constant-size ciphertexts or constant-size secret-keys and is adaptively secure under the DLIN assumption in the standard model. They imply an identity-based broadcast encryption (IBBE) system with constant-size ciphertexts or constant-size secret-keys that is adaptively secure under the DLIN assumption. We also extend the proposed ZIPE schemes into two directions, one is a fully-attribute-hiding ZIPE scheme with constant-size secret-keys, and the other a hierarchical ZIPE scheme with constant-size ciphertexts.
]]></description>
<guid>http://eprint.iacr.org/2011/648</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/594</link>
<title><![CDATA[Receipt Freeness of Prêt à Voter Provably Secure]]>, by Dalia Khader and Peter Y.A. Ryan</title>
<description><![CDATA[Prêt à Voter is an end-to-end verifiable voting scheme that is also receipt free. Formal method analysis was used to prove that Prêt à Voter is receipt free. In this paper we use one of the latest versions of Prêt à Voter[XCH+10] to prove receipt freeness of the scheme using computational methods. We use provable security game models for the first time to prove a paper based voting scheme receipt free. In this paper we propose a game model that defines receipt freeness. We show that in order to simulate the game we require IND-CCA2 encryption scheme to create the ballots. The usual schemes used in constructing Prêt à Voter are either exponential ElGamal or Paillier because of their homomorphic properties that are needed for tallying, however both are IND-CPA secure. We propose a new verifiable shuffle ``D-shuffle'' to be used together with an IND-CPA encryption schemes that guarantees that the outputs of the shuffle are IND-CCA2 secure ciphertexts and they are used for constructing the ballots. The idea is based on Naor-Yung transformation[NY95]. We prove that if there exist an adversary that breaks receipt freeness then there exist an adversary that breaks the IND-CCA2 security of Naor-Yung encryption scheme. We further show that the ``D-Shuffle'' provides us with the option of having multiple authorities creating the ballots such that no single authority can break voter's privacy. 
]]></description>
<guid>http://eprint.iacr.org/2011/594</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/543</link>
<title><![CDATA[Adaptively Attribute-Hiding (Hierarchical) Inner Product Encryption]]>, by Tatsuaki Okamoto and Katsuyuki Takashima</title>
<description><![CDATA[This paper proposes the first inner product encryption (IPE) scheme that is adaptively secure and fully attribute-hiding (attribute-hiding in the sense of the definition by Katz, Sahai and Waters), while the existing IPE schemes are either fully attribute-hiding but selectively secure or adaptively secure but weakly attribute-hiding. The proposed IPE scheme is proven to be adaptively secure and fully attribute-hiding under the decisional linear assumption in the standard model. The IPE scheme is comparably as efficient as the existing attribute-hiding IPE schemes. We also present a variant of the proposed IPE scheme with the same security that achieves shorter public and secret keys. A hierarchical IPE scheme can be constructed that is also adaptively secure and fully attribute-hiding under the same assumption. In this paper, we extend the dual system encryption
technique by Waters into a more general manner, in which new forms of
ciphertext and secret keys are employed and new types of information
theoretical tricks are introduced along with several forms of computational reduction. 

]]></description>
<guid>http://eprint.iacr.org/2011/543</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/398</link>
<title><![CDATA[Random Self-Reducibility Properties of Learning Problems over Burnside Groups of Exponent 3]]>, by Nelly Fazio and Kevin Iga and Antonio Nicolosi and Ludovic Perret and William E. Skeith III</title>
<description><![CDATA[In this work we investigate the hardness of a computational problem introduced in the recent work of Baumslag et al. In particular, we study the $B_n$-LHN problem, which is a generalized version of the learning with errors (LWE) problem, instantiated with a particular family of non-abelian groups (free Burnside groups of exponent 3). In our main result, we demonstrate a random self-reducibility property for $B_n$-LHN. Along the way, we also prove a sequence of lemmas regarding homomorphisms of free Burnside groups of exponent 3 that may be of independent interest.
]]></description>
<guid>http://eprint.iacr.org/2011/398</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/336</link>
<title><![CDATA[Cryptanalysis of an Authenticated Key Agreement Protocol for Wireless Mobile Communications]]>, by Debiao He</title>
<description><![CDATA[With the rapid progress of wireless mobile communication, the authenticated key agreement (AKA) protocol has attracted an increasing amount of attention. However, due to the limitations of bandwidth and storage of the mobile devices, most of the existing AKA protocols are not suitable for wireless mobile communication. Recently, Lo et al. presented an efficient authenticated key agreement protocol based on elliptic curve cryptography and included their protocol in 3GPP2 specifications. However, in this letter, we point out that Lo et al.'s protocol is vulnerable to an off-line password guessing attack. To resist the attack, we also propose an efficient countermeasure.
]]></description>
<guid>http://eprint.iacr.org/2011/336</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/286</link>
<title><![CDATA[Bicliques for Preimages: Attacks on Skein-512 and the SHA-2 family]]>, by Dmitry Khovratovich and Christian Rechberger and Alexandra Savelieva</title>
<description><![CDATA[We present the new concept of biclique as a tool for preimage attacks, which employs many powerful techniques from differential
cryptanalysis of block ciphers and hash functions.

The new tool has proved to be widely applicable by inspiring many  authors to publish new results of the full versions of AES, KASUMI, IDEA, Square, and others. In this paper, we demonstrate how our concept results in the first cryptanalysis of the Skein hash function, and describe an attack on the SHA-2 hash function with more rounds than before.

]]></description>
<guid>http://eprint.iacr.org/2011/286</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/280</link>
<title><![CDATA[DDH-like Assumptions Based on Extension Rings]]>, by Ronald Cramer and Ivan Damgaard and Eike Kiltz and Sarah Zakarias and Angela Zottarel</title>
<description><![CDATA[We introduce and study a new type of DDH-like assumptions based on
groups of prime order q. Whereas standard DDH is based on encoding
elements of F_{q} ``in the exponent'' of elements in the group, we
ask what happens if instead we put in the exponent elements of the
extension ring R_f= \F_{q}[X]/(f) where f can be any degree-d
polynomial. We show that solving the decision problem that follows
naturally reduces to the case where f is irreducible. This variant
is called the d-DDH problem, where 1-DDH is standard
DDH. Essentially any known cryptographic construction based on DDH can
be immediately generalized to use instead d-DDH, and we show in the
generic group model that d-DDH is harder than DDH. This means that
virtually any application of DDH can now be realized with the same
(amortized) efficiency, but under a potentially weaker assumption. On
the negative side, we also show that d-DDH, just like DDH, is easy
in bilinear groups. This motivates our suggestion of a different type
of assumption, the d-vector DDH problems (VDDH), which are based on
f(X)= X^d, but with a twist to avoid the problems with reducible
polynomials. We show in the generic group model that VDDH is hard in
bilinear groups and that in fact the problems become harder with
increasing d and hence form an infinite hierarchy. We show that
hardness of VDDH implies CCA-secure encryption, efficient
Naor-Reingold style pseudorandom functions, and auxiliary input secure
encryption, a strong form of leakage resilience. This can be seen as
an alternative to the known family of k-linear assumptions.
]]></description>
<guid>http://eprint.iacr.org/2011/280</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/202</link>
<title><![CDATA[Cycling Attacks on GCM, GHASH and Other Polynomial MACs and Hashes]]>, by Markku-Juhani O. Saarinen</title>
<description><![CDATA[    The Galois/Counter Mode (GCM) of operation has been standardized
    by NIST to provide single-pass authenticated encryption.  
    The GHASH authentication component of GCM belongs to a
    class of Wegman-Carter polynomial hashes that operate
    in the field $\mathrm{GF}(2^{128})$. We present message forgery attacks 
    that are made possible by its extremely smooth-order multiplicative 
    group which splits into 512 subgroups. GCM uses the same block cipher key 
    $K$ to both encrypt data and to derive the generator $H$ of the
    authentication polynomial for GHASH. In present literature, only the 
    trivial weak key $H=0$ has been considered. We show that GHASH has 
    much wider classes of weak keys in its 512 multiplicative subgroups, 
    analyze some of their properties, and give experimental results 
    on AES-GCM weak key search. Our attacks can be used not only to 
    bypass message authentication with garbage but also to target
    specific plaintext bits if a polynomial MAC is used in conjunction
    with a stream cipher. These attacks can also be applied with
    varying efficiency to other polynomial hashes and MACs, depending on 
    their field properties. Our findings show that especially the use of 
    short polynomial-evaluation MACs should be avoided 
    if the underlying field has a smooth multiplicative order.
]]></description>
<guid>http://eprint.iacr.org/2011/202</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/020</link>
<title><![CDATA[Cover and Decomposition Index Calculus on Elliptic Curves made practical. Application to a seemingly secure curve over $\F_{p^6}$]]>, by Antoine Joux and Vanessa Vitse</title>
<description><![CDATA[We present a new variant of cover and decomposition attacks on the elliptic curve discrete logarithm problem, that combines Weil descent and decomposition-based index calculus into a single discrete logarithm algorithm. This variant applies, at least theoretically, to all composite degree extension fields, and is particularly well-suited for curves defined over $\F_{p^6}$. We give a real-size example of discrete logarithm computations on a seemingly secure curve defined over a 130$-bit degree $6$ extension field. 
]]></description>
<guid>http://eprint.iacr.org/2011/020</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/624</link>
<title><![CDATA[No-leak authentication by the Sherlock Holmes method]]>, by Dima Grigoriev and Vladimir Shpilrain</title>
<description><![CDATA[We propose a class of authentication schemes  that are literally zero-knowledge, as compared to what is formally defined as ``zero-knowledge" in cryptographic literature. We call this ``no-leak" authentication to distinguish from an established ``zero-knowledge" concept. The ``no-leak" condition implies ``zero-knowledge" (even ``perfect zero-knowledge"), but it is actually stronger, as we illustrate by examples.
The principal idea behind our schemes is: the verifier challenges the prover with questions that he (the verifier) already knows answers to; therefore, even a computationally unbounded verifier who follows the protocol cannot possibly learn anything new during any number of authentication sessions. This is therefore also true for a computationally unbounded passive adversary.
]]></description>
<guid>http://eprint.iacr.org/2010/624</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/621</link>
<title><![CDATA[On the Analysis of Cryptographic Assumptions in the Generic Ring Model]]>, by Tibor Jager and Jörg Schwenk</title>
<description><![CDATA[The generic ring model considers algorithms that operate on elements of an algebraic ring by performing only the ring operations and without exploiting properties of a given representation of ring elements. It is used to analyze the hardness of computational problems defined over rings. For instance, it is known that breaking RSA is equivalent to factoring in the generic ring model (Aggarwal and Maurer, Eurocrypt 2009). Do hardness results in the generic ring model support the conjecture that solving the considered problem is also hard in the standard model, where elements of $\Z_n$ are represented by integers modulo $n$?

We prove in the generic ring model that computing the Jacobi symbol of an integer modulo $n$ is equivalent to factoring. Since there are simple and efficient non-generic algorithms which compute the Jacobi symbol, this provides an example of a natural computational problem which is hard in the generic ring model, but easy to solve if elements of $\Z_n$ are given in their standard representation as integers. Thus, a proof in the generic ring model is unfortunately not a very strong indicator for the hardness of a computational problem in the standard model.

Despite this negative result, generic hardness results still provide a lower complexity bound for a large class of algorithms, namely all algorithms solving a computational problem independent of a given representation of ring elements. Thus, from this point of view results in the generic ring model are still interesting. Motivated by this fact, we show also that solving the quadratic residuosity problem generically is equivalent to factoring.
]]></description>
<guid>http://eprint.iacr.org/2009/621</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/310</link>
<title><![CDATA[RFID distance bounding protocol with mixed challenges to prevent relay attacks]]>, by Chong Hee Kim and Gildas Avoine</title>
<description><![CDATA[RFID systems suffer from different location-based attacks such as distance fraud, mafia fraud and terrorist fraud attacks. Among them mafia fraud attack is the most serious since this attack can be mounted without the notice of both the reader and the tag. An adversary performs a kind of man-in-the-middle attack between the reader and the tag. It is very difficult to prevent this attack since the adversary does not change any data between the reader and the tag. Recently distance bounding protocols measuring the round-trip time between the reader and the tag have been researched to prevent this attack.

All the existing distance bounding protocols based on binary challenges, without final signature, provide an adversary success probability equal to (3/4)^n where n is the number of rounds in the protocol. In this paper, we introduce a new protocol based on binary mixed challenges that converges toward the expected and optimal (1/2)^n bound. We prove its security in case of both noisy and non-noisy channels.
]]></description>
<guid>http://eprint.iacr.org/2009/310</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/234</link>
<title><![CDATA[Provable-Security Analysis of Authenticated Encryption in Kerberos]]>, by Alexandra Boldyreva and Virendra Kumar</title>
<description><![CDATA[Kerberos is a widely deployed network authentication protocol currently being considered for standardization.  Many works have analyzed its security, identifying flaws and often suggesting fixes, thus promoting the protocol's evolution.  Several recent results present successful, formal methods-based verifications of a significant portion of the current version, v.5, and some even imply security in the computational setting.  For these results to hold, encryption in Kerberos should satisfy strong cryptographic security notions.  However, prior to our work, none of the encryption schemes currently deployed as part of Kerberos, nor their proposed revisions, were known to provably satisfy such notions.  We take a close look at Kerberos' encryption, and we confirm that most of the options in the current version provably provide privacy and authenticity, though some require slight modifications which we suggest.  Our results complement the formal methods-based analysis of Kerberos that justifies its current design.
]]></description>
<guid>http://eprint.iacr.org/2007/234</guid>
</item>
</channel></rss>

