<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
<channel><title>Cryptology ePrint Archive</title>
<link>http://eprint.iacr.org/</link>
<description>Recently modified papers in the IACR Cryptology ePrint Archive</description>
<language>en-us</language>
<lastBuildDate>Tue, 09 Feb 2010 16:11:01 -0700</lastBuildDate>
<webMaster>webmaster@iacr.org</webMaster>
<managingEditor>eprint-editor@iacr.org</managingEditor>
<generator>None of your business</generator>
<ttl>60</ttl>
<item>
<link>http://eprint.iacr.org/2010/066</link>
<title><![CDATA[Some Observations on TWIS Block Cipher]]>, by Bozhan Su and Wenling Wu and Lei Zhang and Yanjun Li</title>
<description><![CDATA[The 128-bit block cipher TWIS was proposed by Ojha et al in
2009. It is a lightweight block cipher and its design is inspired
from CLEFIA. In this paper, we first study the properties of TWIS
structure, and as an extension we also considered the generalized
TWIS-type structure which can be called G-TWIS cipher, where the
block size and round number can be arbitrary values. Then we
present a series of 10-round differential distinguishers for TWIS
and a n-round differential distinguisher for G-TWIS whose
probabilities are all equal to 1. Therefore, by utilizing these
kinds of differential distinguishers, we can break the full
10-round TWIS cipher and n-round G-TWIS cipher.
]]></description>
<guid>http://eprint.iacr.org/2010/066</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/065</link>
<title><![CDATA[An Anonymous ID-based Encryption Revisited]]>, by Zhengjun Cao</title>
<description><![CDATA[In 2006, Boyen and Waters proposed an anonymous ID-based encryption. It is impressive that in the scheme the system secret key is a tuple of five numbers. The user's secret key is also a tuple of five elements. The authors did not explain why it should introduce so many parameters. In this paper, we simulate a general attempt to attack the scheme. It shows us which parameters are essential  to the scheme and which parameters can be reasonably discarded. Based on the analysis we present a simplified version and an efficient version of the Boyen-Waters scheme. The analyzing technique developed in this paper is helpful to better other cryptographic protocols.
]]></description>
<guid>http://eprint.iacr.org/2010/065</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/064</link>
<title><![CDATA[New Advances on Privacy-Preserving Policy Reconciliation]]>, by Ulrike Meyer and Susanne Wetzel and Sotiris Ioannidis</title>
<description><![CDATA[Entities define their own set of rules under which they are willing to collaborate, e.g., interact, share
and exchange resources or information with others. Typically, these individual policies differ for different
parties. Thus, collaboration requires the resolving of differences and reaching a consensus. This process
is generally referred to as policy reconciliation.
Current solutions for policy reconciliation do not take into account the privacy concerns of reconciliating
parties. This paper addresses the problem of preserving privacy during policy reconciliation. We
introduce new protocols that meet the privacy requirements of the organizations and allow parties to
find a common policy rule which optimizes their individual preferences.
]]></description>
<guid>http://eprint.iacr.org/2010/064</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/063</link>
<title><![CDATA[Differential Fault Analysis on SMS4 Using a Single Fault]]>, by Ruilin Li and Bing Sun and Chao Li and JianXiong You</title>
<description><![CDATA[Differential Fault Analysis (DFA) attack is a powerful cryptanalytic
technique that could be used to retrieve the secret key by
exploiting computational errors in the encryption (decryption)
procedure. In the present paper, we propose a new DFA attack on SMS4
using a single fault. We show that if a random byte fault is induced
into either the second, third, or forth word register at the input
of the $28$-th round, the 128-bit master key could be recovered with
an exhaustive search of $22.11$ bits on average. The proposed attack
makes use of the characteristic of the cipher's structure, the
speciality of the diffusion layer, and the differential property of
the S-box. Furthermore, it can be tailored to any block cipher
employing a similar structure and an
SPN-style round function as that of SMS4. 
]]></description>
<guid>http://eprint.iacr.org/2010/063</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/062</link>
<title><![CDATA[Differential Cryptanalysis of SMS4 Block Cipher]]>, by Bozhan Su and  Wenling Wu and  Wentao Zhang</title>
<description><![CDATA[SMS4 is a 128-bit block cipher used in the
WAPI standard for wireless networks in China. In this paper, we
analyze the security of SMS4 block cipher against differential
cryptanalysis. Firstly, we prove three theorems and one corollary
that reflect relationships of 5- and 6-round SMS4. Nextly, by
these relationships, we clarify the minimum number of differentially
active S-boxes in 6-, 7- and 12-round SMS4 respectively.
Finally, based on the above results, we present a family of about
$2^{14}$ differential characteristics for 19-round SMS4, which
leads to an attack on 23-round SMS4 with $2^{115}$ chosen
plaintexts and $2^{124.3}$ encryptions. Our attack is the best known
attack on SMS4 so far.
]]></description>
<guid>http://eprint.iacr.org/2010/062</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/061</link>
<title><![CDATA[Privacy-Preserving Matching Protocols for Attributes and Strings]]>, by Pu Duan, Sanmin Liu, Weiqin Ma, Guofei Gu and Jyh-Charn Liu</title>
<description><![CDATA[In this technical report we present two new privacy-preserving matching protocols for singular attributes and strings, respectively. The first one is used for matching of common attributes without revealing unmatched ones to each other. The second protocol is used to discover the longest common sub-string of two input strings in a privacy-preserving manner. Compared with previous work, our solutions are efficient and suitable to implement for many different applications, e.g., discovery of common worm signatures, computation of similarity of IP payloads.
]]></description>
<guid>http://eprint.iacr.org/2010/061</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/060</link>
<title><![CDATA[Insecure ``Provably Secure Network Coding'' and Homomorphic Authentication Schemes for Network Coding]]>, by Yongge Wang</title>
<description><![CDATA[Network coding allows the routers to mix the received information
before forwarding them to the next nodes. Though this information mixing 
has been proven to maximize network throughput, it also introduces 
security challenges such as pollution attacks. 
A malicious node could insert a malicious packet 
into the system and this corrupted
packet will propagate more quickly than in traditional copy-and-forward 
networks.  Several authors have studied secure network coding from both
information theoretic and probabilistic viewpoints. In this paper, 
we show that there are serious flaws in several of these schemes 
(the security ``proofs'' for these schemes 
were presented in these publications). Furthermore, we will propose a secure
homomorphic authentication scheme for network coding.
]]></description>
<guid>http://eprint.iacr.org/2010/060</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/059</link>
<title><![CDATA[A New Framework for RFID Privacy]]>, by Robert H. Deng, Yingjiu Li, Andrew C. Yao and Moti Yung and Yunlei Zhao</title>
<description><![CDATA[Formal RFID security and privacy frameworks are fundamental to the design and analysis of robust RFID systems. In this paper, we develop a new definitional framework for RFID privacy in a rigorous and precise manner. Our framework is based on a zero-knowledge (ZK) formulation [7, 5] and incorporates the notions of adaptive completeness and mutual authentication. We provide meticulous
justification of the new framework and contrast it with existing ones in the literature. In particular, we prove that our framework is stronger than the ind-privacy model of [14], which answers an open question posed in [14] for developing stronger RFID privacy models. Along the way we also try to clarify certain confusions and rectify several defects in the existing frameworks.

Based on the protocol of [16], we propose an efficient RFID mutual authentication protocol and analyze its security and privacy. The methodology used in our analysis is of independent interest and can be applied to analyze other RFID protocols within the new framework.
]]></description>
<guid>http://eprint.iacr.org/2010/059</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/058</link>
<title><![CDATA[Solinas primes of small weight for fixed sizes]]>, by Jos\'e de Jes\'us Angel Angel and Guillermo Morales-Luna</title>
<description><![CDATA[We give a  list of the Solinas prime numbers of the form $f(2^k)=2^m
- 2^n \pm 1$, $m \leq 2000$, with small modular reduction weight $wt
< 15$, and $k=8,16,32,64$, i.e., $k$ is a multiple of the computer
integer arithmetic word size. These can be useful in the
construction of cryptographic protocols.
]]></description>
<guid>http://eprint.iacr.org/2010/058</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/057</link>
<title><![CDATA[Message Recovery and Pseudo-Preimage Attacks on the Compression Function of Hamsi-256]]>, by Cagdas Calik and Meltem Sonmez Turan</title>
<description><![CDATA[Hamsi is one of the second round candidates of the SHA-3 competition. In this study, we present non-random differential properties for the compression function of the hash function Hamsi-256. Based on these properties, we first demonstrate a distinguishing attack that requires a few evaluations of the compression function and extend the distinguisher to 5 rounds with complexity $2^{83}$. Then, we present a message recovery attack with complexity of $2^{10.48}$ compression function evaluations. Also, we present a pseudo-preimage attack for the compression function with  complexity $2^{254.25}$. The pseudo-preimage attack on the compression function is easily converted to a pseudo second preimage attack on Hamsi-256 hash function with the same complexity. 
]]></description>
<guid>http://eprint.iacr.org/2010/057</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/056</link>
<title><![CDATA[Improved Cache Trace Attack on AES and CLEFIA by Considering Cache Miss and S-box Misalignment]]>, by Xin-jie ZHAO and Tao WANG</title>
<description><![CDATA[This paper presents an improved Cache trace attack on AES and CLEFIA by considering Cache miss trace information and S-box misalignment. In 2006, O. Ac&#305;içmez et al. present a trace driven Cache attack on AES first two rounds, and point out that if the Cache element number of the Cache block is 16, at most 48-bit of AES key can be obtained in the first round attack. Their attack is based on the ideal case when S-box elements are perfected aligned in the Cache block. However, this paper discovers that, the S-box elements are usually misaligned, and due to this feature and by considering Cache miss trace information, about 200 samples are enough to obtain full 128-bit AES key within seconds. In 2010, Chester Rebeiro et al. present the first trace driven Cache attack on C LEFIA by considering Cache hit information and obtain 128-bit key with 243 CLEFIA encryptions. In this paper, we present a new attack on CLEFIA by considering Cache miss information and S-box misalignment features, finally successfully obtain CLEFIA-128 key for about 220 samples within seconds. 
]]></description>
<guid>http://eprint.iacr.org/2010/056</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/055</link>
<title><![CDATA[Credential Authenticated Identification and Key Exchange]]>, by Jan Camenisch and Nathalie Casati and Thomas Gross and Victor Shoup</title>
<description><![CDATA[Secure two-party authentication and key exchange are fundamental problems.
Traditionally, the parties authenticate each other by means of
their identities, using a public-key infrastucture (PKI).
However, this is not always feasible or desirable:
an appropriate PKI may not be available,
or the parties may want to remain anonymous, and not reveal
their identities.

To address these needs,
we introduce the notions of credential-authenticated identification (CAID) and 
key exchange (CAKE), where the compatibility of the parties'
\emph{credentials} 
is the criteria for authentication, rather than the parties' \emph{identities}
relative to some PKI.
We formalize CAID and CAKE in the universal composability (UC) framework, 
with natural ideal functionalities,
and we give practical, 
modularly designed protocol realizations.
We prove all our protocols UC-secure in the adaptive corruption model 
with erasures, assuming a common reference string (CRS). 
The proofs are based on standard cryptographic assumptions and do not rely on random oracles.


CAKE includes password-authenticated key exchange (PAKE) as a special case,
and we present two new PAKE protocols.
The first one is interesting in that it is uses completly different
techniques than known practical PAKE protocols, and also achieves
UC-security in the adaptive corruption model with erasures;
the second one 
is the 
first practical PAKE protocol 
that provides a meaningful form of resilience against 
server compromise  
without relying on random oracles.

]]></description>
<guid>http://eprint.iacr.org/2010/055</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/054</link>
<title><![CDATA[An Improved Timing Attack with Error Detection on RSA-CRT]]>, by CHEN Cai-Sen, Wang Tao, Tian Jun-Jian</title>
<description><![CDATA[Several types of timing attacks have been published, but they are either in theory or hard to be taken into practice. In order to improve the feasibility of attack, this paper proposes an advance timing attack scheme on RSA-CRT with T-test statistical tool. Similar timing attacks have been presented, such as BB-Attack and Shindler's attack, however none of them applied statistical tool in their methods with such efficiency, and showed the complete recovery in practice by attacking on RSA-CRT. With T-test, we enlarge the 0-1 gap, reduce the neighborhood size and improve the precision of decision. However, the most contribution of this paper is that our algorithm has an error detection property which can detect the erroneous decision of guessing qk and correct it. We could make the success rate of recovering q to be 100% indeed for interprocess timing attack, recovery 1024bits RSA key completely in practice. 
]]></description>
<guid>http://eprint.iacr.org/2010/054</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/053</link>
<title><![CDATA[Logical cryptoanalysis on the example of the cryptosystem DES]]>, by A.D. Plotnikov</title>
<description><![CDATA[In the paper on the example of the cryptosystem DES, the successful method of a cryptanalysis is presented. As a result, it is offered as a criterion of the cryptographic security to use a complexity of building and solving the system of Boolean functions, describing the cipher construction procedure.  

]]></description>
<guid>http://eprint.iacr.org/2010/053</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/052</link>
<title><![CDATA[Cryptanalysis and Improvement of a New Gateway-Oriented Password-Based Authenticated Key Exchange Protocol]]>, by FuShan Wei and QingFeng Cheng  and ChuanGui Ma</title>
<description><![CDATA[Abdalla et al. proposed the first gateway-oriented password-based
authenticated key exchange (GPAKE) protocol. The security goal of
GPAKE is to securely establish a session key between the client and
the gateway by the help of the authentication server without
revealing any information of the password to the gateway. However,
Byun et al. showed that the original GPAKE protocol was suspectable
to an undetectable on-line dictionary attack by a malicious gateway.
Recently, Abdalla et al. presented a new variant of the original
GPAKE protocol to resist Byun et al.'s attack. In this letter, we
show that the new GPAKE protocol is still vulnerable to another
simple but powerful undetectable on-line dictionary attack. We then
make a suggestion for improvement.
]]></description>
<guid>http://eprint.iacr.org/2010/052</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/051</link>
<title><![CDATA[A Principle for  Cryptographic Protocols Beyond Security, Less Parameters]]>, by Zhengjun Cao</title>
<description><![CDATA[Almost cryptographic protocols are presented  with security arguments. None of them, however, did explain why a protocol should like this, not like that. The reason is that there are
short of any principles for designing and analyzing cryptographic
protocols. In this paper, we put forth such a principle beyond
security, called Less Parameters, which says that the
involved parameters should be reduced as less as possible. Actually,
the principle ensures a protocol better cost. In different
scenarios, the principle is not easy to grasp. Intuitively, we
advise to introduce public parameters as less as possible. In the
light of the principle, we investigate some signatures. We
believe the techniques developed in this paper will be helpful to
better some cryptographic protocols.
]]></description>
<guid>http://eprint.iacr.org/2010/051</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/050</link>
<title><![CDATA[Authenticating  Aggregate  Range  Queries over Multidimensional Dataset]]>, by Jia XU  and Ee-Chien CHANG</title>
<description><![CDATA[We are interested in the integrity of the query results from an outsourced database service provider. Alice passes a set $\mathtt{D}$  of $d$-dimensional points,  together with some authentication tag $\mathtt{T}$, to an untrusted service provider Bob. Later, Alice  issues some query over $\mathtt{D}$ to Bob, and Bob should  produce a query result and a proof based on $\mathtt{D}$ and $\mathtt{T}$. Alice wants to verify the integrity of the query result with the help of the proof, using only the private key. 
 In this paper, we consider aggregate query conditional on multidimensional range selection. In its basic form, a  query   asks for the total number of data points within a $d$-dimensional range.  
We are concerned about  the number of communication bits required and the size of the tag $\mathtt{T}$.
 We give a method that requires $O(d^2)$ communication bits to authenticate an aggregate query conditional on $d$-dimensional range selection.  Besides counting, summing and finding of the minimum can also be supported. Furthermore, our scheme can be 
extended slightly to authenticate $d$-dimensional usual (non-aggregate) range selection query with $O(d^2)$ bits communication  overhead, improving known results that require  $O(\log^{d-1} N)$ communication overhead, where $N$ is the 
number of data points in the dataset.
]]></description>
<guid>http://eprint.iacr.org/2010/050</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/049</link>
<title><![CDATA[On Symmetric Encryption and Point Obfuscation]]>, by Ran Canetti and Yael Tauman Kalai and Mayank Varia and Daniel Wichs</title>
<description><![CDATA[We show tight connections between several cryptographic primitives, namely encryption with weakly random keys, encryption with key-dependent messages (KDM), and obfuscation of point functions with multi-bit output(which we call multi-bit point functions, or MBPFs, for short). These primitives, which have been studied mostly separately in recent works, bear some apparent similarities, both in the flavor of their security requirements and in the flavor of their constructions and assumptions. Still, rigorous connections have not been drawn.

Our results can be interpreted as indicating that MBPF obfuscators imply a very strong form of encryption that simultaneously achieves security for weakly-random keys and key-dependent messages as special cases. Similarly, each one of the other primitives implies a certain restricted form of MBPF obfuscation. Our results carry both constructions and impossibility results from one primitive to others. In particular:

The recent impossibility result for KDM security of Haitner and Holenstein (TCC '09) carries over to MBPF obfuscators.

The Canetti-Dakdouk construction of MBPF obfuscators based on a strong variant of the DDH assumption (EC '08) gives an encryption scheme which is secure w.r.t. any weak key distribution of super-logarithmic
min-entropy (and in particular, also has very strong leakage resilient properties).

All the recent constructions of encryption schemes that are secure w.r.t. weak keys imply a weak form of MBPF obfuscators.

]]></description>
<guid>http://eprint.iacr.org/2010/049</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/048</link>
<title><![CDATA[An enhanced ID-based remote mutual authentication with key agreement protocol for mobile devices on elliptic curve cryptosystem]]>, by He Debiao; Chen Jianhua; Hu Jin</title>
<description><![CDATA[Recently, Yoon et al. and Wu proposed two improved  remote mutual authentication and key agreement scheme  for mobile devices on elliptic curve cryptosystem. In this paper, we show that Yoon et al.'s protocol fails to provide explicit key perfect forward secrecy and fails to achieve explicit key confirmation. We also point out Wu's scheme decreases efficiency by using the double secret keys and is vulnerable to the password guessing attack and the forgery attack. In order to overcome the drawback, we proposed and improved scheme. Through the comparison with other protocol, we believe that our improved scheme is more suitable for real-life applications.

]]></description>
<guid>http://eprint.iacr.org/2010/048</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/047</link>
<title><![CDATA[Lower Bounds for Factoring Integral-Generically, with Room for Improvement]]>, by Daniel R. L. Brown</title>
<description><![CDATA[An integral-generic factoring algorithm is, loosely speaking, a constant sequence of ring operations that computes an integer whose greatest common divisor with a given integral random variable n, such as an RSA public key, is non-trivial. Formal definitions for generic factoring will be stated. Integral-generic factoring algorithms seem to include versions of trial division and Lenstra's elliptic curve method. Abstract lower bounds on the number of such ring operations
will be given. Concrete lower bounds on the abstract bounds are also given, but prove to be too weak for any cryptologic assurance.
]]></description>
<guid>http://eprint.iacr.org/2010/047</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/046</link>
<title><![CDATA[A New Chaos-Based Cryptosystem for Secure Transmitted Images]]>, by Abir AWAD</title>
<description><![CDATA[This paper presents a novel and robust chaos-based cryptosystem for secure transmitted images and four others versions. In
the proposed block encryption/decryption algorithms, an 2D chaotic map is used to shuffle the image pixel positions. Then, substitution
(confusion) and permutation (diffusion) operations on every block, with multiple rounds, are combined using two perturbed chaotic
PWLCM maps. The perturbing orbit technique improves the dynamical statistical properties of generated chaotic sequences. The
obtained error propagation in various standard cipher block modes demonstrates that the proposed cryptosystem including OFB, or
CTR modes, is suitable to transmit cipher data over a corrupted digital channel. Finally, to quantify the security level of the proposed
cryptosystem, many standard tools are performed and experimental results show that the suggested cryptosystem has a high security
level.
]]></description>
<guid>http://eprint.iacr.org/2010/046</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/045</link>
<title><![CDATA[Efficient chaotic permutations for image encryption algorithms]]>, by Abir AWAD</title>
<description><![CDATA[Permutation is widely used in cryptographic algorithm. Recently, a number of candidate instructions have been proposed to
efficient compute arbitrary bit permutations. Among these, we present the most attractive methods and having good inherent
cryptographic properties. We propose to control it by the perturbed chaotic maps that we studied in [1]. Then, we measure the
efficiency of the obtained chaotic permutation methods on a standard image. This study allows choosing a good chaotic
permutation method to be used in a chaotic cryptosystem.
]]></description>
<guid>http://eprint.iacr.org/2010/045</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/044</link>
<title><![CDATA[A New Chaotic Image Encryption Algorithm using a New Way of Permutation Methods]]>, by Abir AWAD</title>
<description><![CDATA[This paper presents a novel chaos-based cryptosystem for secure transmitted images. In the proposed
block encryption/decryption algorithm, two chaotic permutation methods (key-dependant shift approach and Socek
method) are used to shuffle the image pixel bits. These methods are controlled using a perturbed chaotic PWLCM map.
The perturbing orbit technique improves the dynamical statistical properties of generated chaotic sequences. Our
algorithm is based on tree encryption cryptosystems (Socek, Yang and Xiang algorithms). In this paper, we prove that
the proposed cryptosystem overcomes the drawbacks of these algorithms. Finally, many standard tools are performed
to quantify the security level of the proposed cryptosystem, and experimental results show that the suggested
cryptosystem has a high security level.
]]></description>
<guid>http://eprint.iacr.org/2010/044</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/043</link>
<title><![CDATA[Differential and invertibility properties of BLAKE (full version)]]>, by Jean-Philippe Aumasson and Jian Guo and Simon Knellwolf and Krystian Matusiewicz and Willi Meier</title>
<description><![CDATA[BLAKE is a hash function selected by NIST as one of the 14 second round candidates for the SHA-3 Competition. In this paper, we follow a bottom-up approach to exhibit properties of BLAKE and of its building blocks: based on differential properties of the internal function G, we show that a round of BLAKE is a permutation on the message space, and present an efficient inversion algorithm. For 1.5 rounds we present an algorithm that finds preimages faster than in previous attacks. Discovered properties lead us to describe large classes of impossible differentials for two rounds of BLAKE's internal permutation, and particular impossible differentials for five and six rounds, respectively for BLAKE- 32 and BLAKE-64. Then, using a linear and rotation-free model, we describe near-collisions for four rounds of the compression function. Finally, we discuss the problem of establishing upper bounds on the probability of differential characteristics for BLAKE.
]]></description>
<guid>http://eprint.iacr.org/2010/043</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/042</link>
<title><![CDATA[A modified eCK model with stronger security for tripartite authenticated key exchange]]>, by Qingfeng Cheng and Chuangui Ma and Fushan Wei</title>
<description><![CDATA[Since Bellare and Rogaway presented the first formal security model
for authenticated key exchange (AKE) protocols in 1993, many formal
security models have been proposed. The extended Canetti-Krawczyk
(eCK) model proposed by LaMacchia et al. is currently regarded as
the strongest security model for two-party AKE protocols. In this
paper, we first generalize the eCK model for tripartite AKE
protocols, called teCK model, and enhance the security of the new
model by adding a new reveal query. In the teCK model, the adversary
has stronger powers, and can learn more secret information. Then we
present a new tripartite AKE protocol based on the NAXOS protocol,
called T-NAXOS protocol, and analyze its security in the teCK model
under the random oracle assumption.
]]></description>
<guid>http://eprint.iacr.org/2010/042</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/041</link>
<title><![CDATA[The Effects of the Omission of Last Round's MixColumns on  AES]]>, by Orr Dunkelman and Nathan Keller</title>
<description><![CDATA[The Advanced Encryption Standard (AES) is the most widely deployed block cipher. It follows the modern iterated block cipher approach, iterating a simple round function multiple times. The last round of AES slightly differs from the others, as a linear mixing operation (called MixColumns) is omitted from it.

Following a statement of the designers, it is widely believed that the omission of the last round MixColumns has no security implications. As a result, the majority of attacks on reduced-round variants of AES assume that the last round of the reduced-round version is free of the MixColumns operation.

In this note we refute this belief, showing that the omission of MixColumns does affect the security of (reduced-round) AES. First, we consider a simple example of 1-round AES, where we show that the omission reduces the time complexity of an attack with a single known plaintext from 2^{48} to 2^{16}. Then, we examine several previously known attacks on 7-round AES-192 and show that the omission reduces their time complexities by a factor of 2^{16}.

]]></description>
<guid>http://eprint.iacr.org/2010/041</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/040</link>
<title><![CDATA[Batch Groth-Sahai]]>, by Olivier Blazy and Georg Fuchsbauer and Malika Izabachène and Amandine Jambert and Hervé Sibert and Damien Vergnaud</title>
<description><![CDATA[In 2008, Groth and Sahai proposed a general methodology for constructing non-interactive zero-knowledge (and witness-indistinguishable) proofs in bilinear groups. While avoiding expensive NP-reductions, these proof systems are still inefficient due to a number of pairing computations required for verification. We apply recent techniques of batch verification to the Groth-Sahai proof systems and manage to improve significantly the complexity of proof verification. We give explicit batch verification formulas for generic Groth-Sahai equations (whose cost is less than a tenth of the original) and also for specific popular protocols relying on their methodology (namely Groth's group signatures and Belenkiy-Chase-Kohlweiss-Lysyanskaya's P-signatures).

]]></description>
<guid>http://eprint.iacr.org/2010/040</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/039</link>
<title><![CDATA[On Exponential Sums, Nowton identities and Dickson Polynomials over Finite Fields]]>, by Xiwang Cao and Lei Hu</title>
<description><![CDATA[Let $\mathbb{F}_{q}$ be a finite field, $\mathbb{F}_{q^s}$ be an extension of $\mathbb{F}_q$, let $f(x)\in \mathbb{F}_q[x]$ be a polynomial of degree $n$ with $\gcd(n,q)=1$. We present a recursive formula for evaluating the exponential sum $\sum_{c\in \mathbb{F}_{q^s}}\chi^{(s)}(f(x))$. Let $a$ and $b$ be two elements in $\mathbb{F}_q$ with $a\neq 0$, $u$ be a positive integer. We obtain an estimate of the exponential sum $\sum_{c\in \mathbb{F}^*_{q^s}}\chi^{(s)}(ac^u+bc^{-1})$, where $\chi^{(s)}$ is the lifting of an additive character $\chi$ of $\mathbb{F}_q$. Some properties of the sequences constructed from these exponential sums are provided also.

]]></description>
<guid>http://eprint.iacr.org/2010/039</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/038</link>
<title><![CDATA[Fault Resistant RSA Signatures: Chinese Remaindering in Both Directions]]>, by Arnaud Boscher and Helena Handschuh and Elena Trichina</title>
<description><![CDATA[Fault attacks are one of the most severe attacks against secure embedded cryptographic implementations. Block ciphers such as AES, DES or public key algorithms such as RSA can be broken with as few as a single or a handful of erroneous computation results. Many countermeasures have been proposed both at the algorithmic level and using ad-hoc methods. In this paper, we address the problem of finding efficient countermeasures for RSA signature computations based on the Chinese Remainder Theorem for which one uses the inverse operation (verification) in order to secure the algorithm against fault attacks. We propose new efficient methods with associated security proofs in two different models; our methods
protect against run-time errors, computation errors, and most permanent errors in the key parameters as well. We also extend our methods with infective computation strategies to secure the algorithm against double faults.
]]></description>
<guid>http://eprint.iacr.org/2010/038</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/037</link>
<title><![CDATA[Estimating the Size of the Image of Deterministic Hash Functions to Elliptic Curves]]>, by Pierre-Alain Fouque and Mehdi Tibouchi</title>
<description><![CDATA[Let $E$ be a non-supersingular elliptic curve over a finite field $\Fq$. At CRYPTO 2009, Icart introduced a deterministic function $\Fq\to E(\Fq)$ which can be computed efficiently, and allowed him and Coron to define well-behaved hash functions with values in $E(\Fq)$. Some properties of this function rely on a conjecture which was left as an open problem in [Icart]. We prove this conjecture as well as analogues for other hash functions. This allows us to prove that a related function is surjective, which is a first step towards efficient hashing to the whole set of points of elliptic curves.
]]></description>
<guid>http://eprint.iacr.org/2010/037</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/036</link>
<title><![CDATA[An Improved Timestamp-Based Password Remote User Authentication Scheme]]>, by Keerti Srivastava and  Amit K Awasthi  and R.C.Mittal</title>
<description><![CDATA[In 2003, Shen et al [4] proposed a timestamp-based password authentication scheme in which remote server does not need to store the passwords or veri&#64257;cation table for users authentication. Unfortunately Wang and Li[6], E.J.Yoon [8],Lieu et al.[3], analyzed independently the Shen Lin Scheme [4] and was found to be vulnerable to some deadly attacks. In continuation to it, this paper analyzes few attacks and &#64257;nally proposes an improved Timestamp- based password
remote user authentication scheme so that it can withstand the existing forged attacks.
]]></description>
<guid>http://eprint.iacr.org/2010/036</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/035</link>
<title><![CDATA[Between Hashed DH and Computational DH: Compact Encryption from Weaker Assumption]]>, by Goichiro Hanaoka and Kaoru Kurosawa</title>
<description><![CDATA[In this paper, we introduce
the intermediate hashed Diffie-Hellman (IHDH) assumption
which is weaker than the hashed DH (HDH) assumption (and thus the decisional DH
assumption),
and is stronger than the computational DH assumption. 
We then present two public key encryption schemes with short ciphertexts
which are both chosen-ciphertext secure under this assumption.
The short-message scheme has smaller size of ciphertexts 
than Kurosawa-Desmedt (KD) scheme,
and
the long-message scheme is a KD-size scheme with arbitrary plaintext length
which is based on a weaker assumption
than the HDH assumption.
]]></description>
<guid>http://eprint.iacr.org/2010/035</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/034</link>
<title><![CDATA[On the order of the polynomial $x^p-x-a$]]>, by Xiwang Cao</title>
<description><![CDATA[In this note, we prove that the order of $x^p-x-1\in \F_p[x]$ is
$\frac{p^p-1}{p-1}$, where $p$ is a prime and $\mathbb{F}_p$ is the
finite field of size $p$. As a consequence, it is shown that
$x^p-x-a\in \mathbb{F}_p[x]$ is primitive if and only if $a$ is a
primitive element in $\mathbb{F}_p$.
]]></description>
<guid>http://eprint.iacr.org/2010/034</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/033</link>
<title><![CDATA[Simple and Efficient Public-Key Encryption from Computational Diffie-Hellman in the Standard Model]]>, by Kristiyan Haralambiev and Tibor Jager and Eike Kiltz and Victor Shoup</title>
<description><![CDATA[This paper proposes practical chosen-ciphertext secure public-key encryption systems that are provably secure under the computational Diffie-Hellman assumption, in the standard model. Our schemes are conceptually simpler and more efficient than previous constructions. 
We also show that in bilinear groups the size of the public-key can be shrunk from n to 2\sqrt{n} group elements, where n is the security parameter.
]]></description>
<guid>http://eprint.iacr.org/2010/033</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/032</link>
<title><![CDATA[An Information Theoretic Perspective on the Differential Fault Analysis against AES]]>, by Yang Li, Shigeto Gomisawa, Kazuo Sakiyama, Kazuo Ohta</title>
<description><![CDATA[Dierential Fault Analysis (DFA) against AES has been actively stud-
ied these years. Based on similar assumptions of the fault injection, different DFA attacks against AES have been proposed. However, it is difficult to understand how different attack results are obtained for the same assumption of fault injection. It is also difficult to understand the relationship between similar assumptions of fault injections and the corresponding attack results. This paper reviews the previous DFA attacks against AES from an information theoretic point of view, and gives a general understanding for DFA attacks against AES.
]]></description>
<guid>http://eprint.iacr.org/2010/032</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/031</link>
<title><![CDATA[Class Invariants by the CRT Method]]>, by Andreas Enge and Andrew V. Sutherland</title>
<description><![CDATA[We adapt the CRT approach to computing Hilbert class polynomials to handle a wide range of class invariants. For suitable discriminants D, this improves its performance by a large constant factor, more than 200 in the most favourable circumstances. This has enabled record-breaking constructions of elliptic curves via the CM method, including examples with |D| > 10^{15}.

]]></description>
<guid>http://eprint.iacr.org/2010/031</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/030</link>
<title><![CDATA[On the  Complexity of the Herding Attack and Some Related Attacks on Hash Functions]]>, by D.R. Stinson and J. Upadhyay</title>
<description><![CDATA[In this paper, we analyze the complexity of the construction of the 2^k-diamond structure proposed by Kelsey and Kohno. We point out a flaw  in their analysis and show that their construction may not produce the desired diamond structure. We then give a more rigorous and detailed complexity analysis of the construction of a diamond structure. For this, we appeal to random graph theory, which allows us to determine sharp necessary and sufficient conditions for the message complexity (i.e., the number of hash computations required to  build the required structure). We also analyze the computational complexity for constructing a diamond structure, which has not been previously studied in the literature. Finally, we study the impact of our analysis on herding and other attacks that use  the diamond structure as a subroutine. 
    
Precisely, our results shows the following:
1. The message complexity for the construction of a diamond structure  is  \sqrt{k}  times more than what was previously stated in literature.
2. The time complexity is  n  times the message complexity, where  n  is the size of hash value.

Due to above two results, the complexity of the herding attack  and the second preimage attack on iterated hash functions have increased complexity. We also show that the message complexity of herding and second preimage attacks on "hash twice'' is  n  times the claimed complexity, by giving a more detailed analysis of the attack.

]]></description>
<guid>http://eprint.iacr.org/2010/030</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/029</link>
<title><![CDATA[On Achieving the "Best of Both Worlds" in Secure Multiparty Computation]]>, by Yuval Ishai and Jonathan Katz and Eyal Kushilevitz and Yehuda Lindell and Erez Petrank</title>
<description><![CDATA[Two settings are traditionally considered for secure multiparty computation, depending on whether or not a majority of the parties are assumed to be honest. Protocols designed under this assumption provide ``full security'' (and, in particular, guarantee output delivery and fairness) when this assumption holds; unfortunately, these protocols are completely insecure if this assumption is violated. On the other hand, protocols tolerating an arbitrary number of corruptions do not guarantee fairness or output delivery even if only a \emph{single} party is dishonest.

It is natural to wonder whether it is possible to achieve the ``best of both worlds'': namely, a single protocol that simultaneously achieves the best possible security in both the above settings. Here, we rule out this possibility (at least for general functionalities) but show some positive results regarding what \emph{can} be achieved.
]]></description>
<guid>http://eprint.iacr.org/2010/029</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/028</link>
<title><![CDATA[A secure anonymous communication scheme in vehicular ad hoc networks from pairings]]>, by *Jue-Sam Chou 1, Yalin Chen 2</title>
<description><![CDATA[Security and efficiency are two crucial issues in vehicular ad hoc networks. Many researches have devoted to these issues. However, we found that most of the proposed protocols  in this area are insecure and can't satisfy the anonymous property. Due to this observation, we propose a secure and anonymous method based on bilinear pairings to resolve the problems. After analysis, we conclude that our scheme is the most secure when compared with other protocols proposed so far.
]]></description>
<guid>http://eprint.iacr.org/2010/028</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/027</link>
<title><![CDATA[A novel k-out-of-n Oblivious Transfer Protocols Based on Bilinear Pairings]]>, by Yalin Chen1, *Jue-Sam Chou2, Xian-Wu Hou3</title>
<description><![CDATA[Low bandwidth consumption is an important issue in a busy commercial network whereas time may not be so crucial, for example, the end-of-day financial settlement for commercial transactions in a day. In this paper, we construct a secure and low bandwidth-consumption k-out-of-n oblivious transfer scheme based on bilinear pairings. We analyze the security and efficiency of our scheme and conclude that our scheme is more secure and efficient in communication bandwidth consumption than most of the other existing oblivious transfer schemes that we know.
]]></description>
<guid>http://eprint.iacr.org/2010/027</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/026</link>
<title><![CDATA[Further Improved Differential Fault Attacks on Camellia by Exploring Fault Width and Depth]]>, by Xin-jie ZHAO  and Tao WANG</title>
<description><![CDATA[ This paper presents several further improved attacks on Camellia. In Jan 2009, Yong-bin ZHOU proposes the first DFA attack on Camellia by injecting 1 byte fault into the rth round left register to recover 1 Kr equivalent subkey byte and obtains Camellia-128,192/256 key with 64 and 96 faulty ciphertexts. In Dec 2009, Xin-jie ZHAO proposes an improved attack extending the fault depth by injecting single byte fault into the r-1th round left register to recover 5-6 bytes of Kr, 1 byte of Kr-1 and obtains Camellia-128,192/256 key with 16 and 24 faulty ciphertexts. In this work, we present two further improved DFA attacks on Camellia. Our first attack broadens Yong-bin ZHOU's fault width, injects multiple byte faults into the rth round left register to recover multiple bytes of Kr, and obtains Camellia-128,192/256 key with at least 8 and 12 faulty ciphertexts; our second attack further extends Xin-jie ZHAO's fault depth, injects single byte fault into the r-2th round left register or r-2th round key to recover full 8 bytes of Kr, 5-6 bytes of Kr-1, 1 byte of Kr-2, and obtains Camellia-128,192/256 key with 4 and 6 faulty ciphertexts. Simulation experiments demonstrate that: due to the reversible permutation function of Camellia, Camellia is quite weak for multiple byte faults attack, and the attack efficiency is even increased with fault width, this feature great improves fault attack's practicalities; due to the Feistel structure of Camellia, Camellia is also quite weak for deeper single byte fault attack, 4 faulty ciphertexts are enough to recover Camellia-128 with 222 brute force search, 6 faulty ciphertexts are enough to recover Camellia-192/256 with 231.5 brute force search.
]]></description>
<guid>http://eprint.iacr.org/2010/026</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/006</link>
<title><![CDATA[Factorization of a 768-bit RSA modulus]]>, by Thorsten Kleinjung and Kazumaro Aoki and Jens Franke and Arjen Lenstra and Emmanuel Thomé and Joppe Bos and Pierrick Gaudry and Alexander Kruppa and Peter Montgomery and Dag Arne Osvik and Herman te Riele and Andrey Timofeev and Paul Zimmermann</title>
<description><![CDATA[This paper reports on the factorization of the 768-bit number RSA-768 by the number field sieve factoring method and discusses some
implications for RSA.
]]></description>
<guid>http://eprint.iacr.org/2010/006</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/605</link>
<title><![CDATA[Solving the Shortest Lattice Vector Problem in Time 2^2.465n]]>, by Xavier Pujol and Damien Stehle</title>
<description><![CDATA[The Shortest lattice Vector Problem is central in lattice-based
cryptography, as well as in many areas of computational mathematics
and computer science.  We present an algorithm for solving it in time
2^2.465n and space 2^1.233n, where n is the lattice dimension.  This improves the best previously known algorithm, by Micciancio and Voulgaris [SODA 2010], which runs in time 2^3.199n and space 2^1.325n.

]]></description>
<guid>http://eprint.iacr.org/2009/605</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/601</link>
<title><![CDATA[Parallel Shortest Lattice Vector Enumeration on Graphics Cards]]>, by Jens Hermans and Michael Schneider and Johannes Buchmann and Frederik Vercauteren and Bart Preneel</title>
<description><![CDATA[In this paper we present an algorithm for parallel exhaustive search for short vectors in lattices. This algorithm can be applied to a wide range of parallel computing systems. To illustrate the algorithm, it was implemented on graphics cards using CUDA, a programming framework for NVIDIA graphics cards. We gain large speedups compared to previous serial CPU implementations. Our implementation is almost 5 times faster in high lattice dimensions.

Exhaustive search is one of the main building blocks for lattice basis reduction in cryptanalysis. Our work results in an advance in practical lattice reduction.
]]></description>
<guid>http://eprint.iacr.org/2009/601</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/579</link>
<title><![CDATA[Privacy-Preserving Public Auditing for Data Storage Security in Cloud Computing]]>, by Cong Wang and Qian Wang and Kui Ren and Wenjing Lou</title>
<description><![CDATA[Cloud Computing is the long dreamed vision of computing as a utility, where users can remotely store their data into
the cloud so as to enjoy the on-demand high quality applications and services from a shared pool of configurable
computing resources. By data outsourcing, users can be relieved from the burden of local data storage and maintenance.
However, the fact that users no longer have physical possession of the possibly large size of outsourced data makes the
data integrity protection in Cloud Computing a very challenging and potentially formidable task, especially for users
with constrained computing resources and capabilities. Thus, enabling public auditability for cloud data storage
security is of critical importance so that users can resort to an external audit party to check the integrity of
outsourced data when needed. To securely introduce an effective third party auditor (TPA), the following two
fundamental requirements have to be met: 1) TPA should be able to efficiently audit the cloud data storage without
demanding the local copy of data, and introduce no additional on-line burden to the cloud user; 2) The third party
auditing process should bring in no new vulnerabilities towards user data privacy. In this paper, we utilize the public
key based homomorphic authenticator and uniquely integrate it with random mask technique to achieve a
privacy-preserving public auditing system for cloud data storage security while keeping all above requirements in mind.
To support efficient handling of multiple auditing tasks, we further explore the technique of bilinear aggregate
signature to extend our main result into a multi-user setting, where TPA can perform multiple auditing tasks
simultaneously. Extensive security and performance analysis shows the proposed schemes are provably secure and highly
efficient.

]]></description>
<guid>http://eprint.iacr.org/2009/579</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/578</link>
<title><![CDATA[Efficient and Provably Secure Certificateless Signcryption from Bilinear Maps]]>, by Wenjian Xie and Zhang Zhang</title>
<description><![CDATA[Signcryption is a cryptographic primitive that fulfills both the functions of digital signature and public key encryption simultaneously, at a cost significantly lower than that required by the traditional signature-then-encryption approach. In 2008, Barbosa and Farshim introduced the notion of certificateless signcryption (CLSC) and proposed the first CLSC scheme [3], but which requires six pairing operations in the signcrypt and unsigncrypt phases. In this paper, aimed at designing an efficient CLSC scheme, we propose a new efficient CLSC scheme from bilinear maps, which requires only two pairing operations in the signcrypt and unsigncrypt phases and is more efficient than all the schemes available.
]]></description>
<guid>http://eprint.iacr.org/2009/578</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/547</link>
<title><![CDATA[Non-Interactive Verifiable Computing: Outsourcing Computation to Untrusted Workers]]>, by Rosario Gennaro and Craig Gentry and Bryan Parno</title>
<description><![CDATA[Verifiable Computation enables a computationally weak client to "outsource" the computation of a function F on various inputs x_1,...,x_k to one or more workers.  The workers return the result of the function evaluation, e.g., y_i=F(x_i), as well as a proof that the computation of F was carried out correctly on the given value x_i.  The verification of the proof should require substantially less computational effort than computing F(x_i) from scratch.

We present a protocol that allows the worker to return a computationally-sound, non-interactive proof that can be verified in O(m) time, where m is the bit-length of the output of F. The protocol requires a one-time pre-processing stage by the client which takes O(|C|) time, where C is the smallest Boolean circuit computing F.  Our scheme also provides input and output privacy for the client, meaning that the workers do not learn any information about the x_i or y_i values.

]]></description>
<guid>http://eprint.iacr.org/2009/547</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/530</link>
<title><![CDATA[A New Proposal Against the Main of Generic Attacks]]>, by Xigen.Yao</title>
<description><![CDATA[This paper presents a effcient proposal for iterating hash functions
to prevent the main of generic attacks such as Multicollisions Attack,Second
Preimage Attack and Herding Attack.Based on this proposal,it's possible that a
secure hash function can be built with iterating compression functions .
The proposal mainly contains a method called " Shifting Whole Message",it
regroups the cascaded messages to be new blocks and makes the known results
of the pre-computed blocks noneffective .
]]></description>
<guid>http://eprint.iacr.org/2009/530</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/439</link>
<title><![CDATA[A Fast Mental Poker Protocol]]>, by Tzer-jen Wei and Lih-Chung Wang </title>
<description><![CDATA[Abstract. We present a fast and secure mental poker protocol. It is twice as fast as Barnett-Smart's and Castellà-Roca's protocols. This protocol is provably secure under DDH assumption. 
]]></description>
<guid>http://eprint.iacr.org/2009/439</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/397</link>
<title><![CDATA[Linear Cryptanalysis of Reduced-Round PRESENT]]>, by Joo Yeon Cho</title>
<description><![CDATA[PRESENT is a hardware-oriented block cipher suitable for resource
constrained environment. In this paper we analyze PRESENT by the
multidimensional linear cryptanalysis method.
We claim that our attack can recover the 80-bit secret key of PRESENT up to 25 rounds 
out of 31 rounds with around $2^{62.4}$ data complexity.
Furthermore, we showed that the 26-round version of PRESENT can be attacked 
faster than key exhaustive search with the $2^{64}$ data complexity
by an advanced key search technique. 
Our results are superior to all the previous attacks. 
We demonstrate our result by performing the
linear attacks on reduced variants of PRESENT. 
Our results exemplify that
the performance of the multidimensional linear attack is superior compared
to the classical linear attack.
]]></description>
<guid>http://eprint.iacr.org/2009/397</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/395</link>
<title><![CDATA[First CPIR Protocol with Data-Dependent Computation]]>, by Helger Lipmaa</title>
<description><![CDATA[We design a new $(n, 1)$-CPIR protocol $\mathsf{BddCpir}$ for
$\ell$-bit strings as a combination of a noncryptographic (BDD-based) data structure and a more basic cryptographic primitive (communication-efficient $(2, 1)$-CPIR). $\mathsf{BddCpir}$ is the first CPIR protocol where server's online computation depends substantially on the concrete database. We then show that (a) for reasonably small values of $\ell$, $\mathsf{BddCpir}$ is guaranteed to have simultaneously log-squared communication and sublinear online computation, and (b) $\mathsf{BddCpir}$ can handle huge but sparse matrices, common in data-mining applications, significantly more efficiently compared to all previous protocols. The security of $\mathsf{BddCpir}$ can be based on the well-known Decisional Composite Residuosity assumption
]]></description>
<guid>http://eprint.iacr.org/2009/395</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/367</link>
<title><![CDATA[Non-delegatable Identity-based Designated Verifier Signature]]>, by Qiong Huang and Willy Susilo and Duncan S. Wong</title>
<description><![CDATA[Designated verifier signature is a cryptographic primitive which allows a signer to convince a designated verifier of the validity of a statement but in the meanwhile prevents the verifier from transferring this conviction to any third party. In this work we present the \emph{first} identity-based designated verifier signature scheme that supports non-delegatability, and prove its security in the random oracle model, based on computational Diffie-Hellman assumption. Our scheme is perfectly non-transferable, and its non-delegatability follows the original definition proposed by Lipmaa et al. \cite{LipmaaWaBa05}.
]]></description>
<guid>http://eprint.iacr.org/2009/367</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/302</link>
<title><![CDATA[Cryptanalysis of ESSENCE]]>, by Maria Naya-Plasencia and Andrea Röck and Jean-Philippe Aumasson and Yann Laigle-Chapuy and Gaëtan Leurent and Willi Meier and Thomas Peyrin</title>
<description><![CDATA[ESSENCE is a hash function submitted to the NIST Hash Competition that stands out as a hardware-friendly and highly parallelizable design. Previous analysis showed some non-randomness in the compression function which could not be extended to an attack on the hash function and ESSENCE remained unbroken. Preliminary analysis in its documentation argues that it resists standard differential cryptanalysis. This paper disproves this claim, showing that advanced techniques can be used to significantly reduce the cost of such attacks: using a manually found differential characteristic and an advanced search algorithm, we obtain collision attacks on the full ESSENCE-256 and ESSENCE-512, with respective complexities 2^67.4 and 2^134.7. In addition, we show how to use these attacks to forge valid (message, MAC) pairs for HMAC-ESSENCE-256 and HMAC-ESSENCE-512, essentially at the same cost as a collision.
]]></description>
<guid>http://eprint.iacr.org/2009/302</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/212</link>
<title><![CDATA[A Flyweight RFID Authentication Protocol]]>, by Mike Burmester and Jorge Munilla</title>
<description><![CDATA[We propose a lightweight RFID authentication protocol that supports forward and backward security. The only cryptographic mechanism that this protocol uses is a pseudo-random number generator (PRNG) that is shared with the backend Server. Authentication is achieved by exchanging a few numbers (3 or 5) drawn from the PRNG. The protocol is optimistic with constant lookup time, and can be easily adapted to prevent online man-in-the-middle relay attacks. Security is proven in the UC security framework.
]]></description>
<guid>http://eprint.iacr.org/2009/212</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/187</link>
<title><![CDATA[Compact McEliece Keys from Goppa Codes]]>, by Rafael Misoczki and Paulo S. L. M. Barreto</title>
<description><![CDATA[The classical McEliece cryptosystem is built upon the class of Goppa codes, which remains secure to this date in contrast to many other families of codes but leads to very large public keys. Previous proposals to obtain short McEliece keys have primarily centered around replacing that class by other families of codes, most of which were shown to contain weaknesses, and at the cost of reducing in half the capability of error correction. In this paper we describe a simple way to reduce significantly the key size in McEliece and related cryptosystems using a subclass of Goppa codes, while also improving the efficiency of cryptographic operations to $\tilde{O}(n)$ time, and keeping the capability of correcting the full designed number of errors in the binary case.

]]></description>
<guid>http://eprint.iacr.org/2009/187</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/434</link>
<title><![CDATA[The computational SLR: a logic for reasoning about computational indistinguishability]]>, by Yu Zhang</title>
<description><![CDATA[Computational indistinguishability is a notion in complexity-theoretic cryptography and is used to
define many security criteria. However, in traditional cryptography, proving computational
indistinguishability is usually informal and becomes error-prone when cryptographic constructions
are complex. This paper presents a formal proof system based on an extension of Hofmann's SLR
language, which can capture probabilistic polynomial-time computations through typing and is
sufficient for expressing cryptographic constructions. We in particular define rules that justify
directly the computational indistinguishability between programs and prove that these rules are
sound with respect to the set-theoretic semantics, hence the standard definition of security. We also
show that it is applicable in cryptography by verifying, in our proof system, Goldreich and Micali's
construction of pseudorandom generator, and the equivalence between next-bit unpredictability and
pseudorandomness.
]]></description>
<guid>http://eprint.iacr.org/2008/434</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/431</link>
<title><![CDATA[Usable Optimistic Fair Exchange]]>, by Alptekin Kupcu and Anna Lysyanskaya</title>
<description><![CDATA[Fairly exchanging digital content is an everyday problem. It has been shown that fair exchange cannot be done without a trusted third party (called the Arbiter). Yet, even with a trusted party, it is still non-trivial to come up with an efficient solution, especially one that can be used in a p2p file sharing system with a high volume of data exchanged.

We provide an efficient optimistic fair exchange mechanism for bartering digital files, where receiving a payment in return to a file (buying) is also considered fair. The exchange is optimistic, removing the need for the Arbiter's involvement unless a dispute occurs. While the previous solutions employ costly cryptographic primitives for every file or block exchanged, our protocol employs them only once per peer, therefore achieving O(n) efficiency improvement when n blocks are exchanged between two peers. The rest of our protocol uses very efficient cryptography, making it perfectly suitable for a p2p file sharing system where tens of peers exchange thousands of blocks and they do not know beforehand which ones they will end up exchanging. Therefore, our system yields to one-two orders of magnitude improvement in terms of both computation and communication (40 seconds vs. 42 minutes, 1.6MB vs. 200MB). Thus, for the first time, a provably secure (and privacy respecting when payments are made using e-cash) fair exchange protocol is being used in real bartering applications (e.g., BitTorrent) without sacrificing performance. 
]]></description>
<guid>http://eprint.iacr.org/2008/431</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/317</link>
<title><![CDATA[Elliptic Curves Scalar Multiplication Combining Multi-base Number Representation with Point halving]]>, by Abdulwahed M. Ismail and Mohamad Rushdan</title>
<description><![CDATA[Elliptic curves scalar multiplication over some finite fields, attractive research area, which paid much attention by researchers in the recent years. Researchs still in progress to improve elliptic curves cryptography implementation and reducing its complexity. Elliptic curve point-halving algorithm proposed in and later double-base chain and step multi-base chain are among efficient techniques offered in this field. Our paper proposes new algorithm combining step multi-base number representation and point halving. We extend the work done by K. W. Wong, which combined double base chain with point halving technique. The expriment results show our contribution will enhance elliptic curves scalar multiplication. 
]]></description>
<guid>http://eprint.iacr.org/2008/317</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/016</link>
<title><![CDATA[ECM using Edwards curves]]>, by Daniel J. Bernstein and Peter Birkner and Tanja Lange and Christiane Peters</title>
<description><![CDATA[This paper introduces EECM-MPFQ,a fast implementation of the elliptic-curve method of factoring integers.EECM-MPFQ uses fewer modular multiplications than the well-known GMP-ECM software,takes less time than GMP-ECM, and finds more primes than GMP-ECM.The main improvements above the modular-arithmetic level are as follows:
  (1) use Edwards curves instead of Montgomery curves;
  (2) use extended Edwards coordinates;
  (3) use signed-sliding-window addition chains;
  (4) batch primes to increase the window size;
  (5) choose curves with small parameters and base points;
  (6) choose curves with large torsion.

]]></description>
<guid>http://eprint.iacr.org/2008/016</guid>
</item>
<item>
<link>http://eprint.iacr.org/2006/420</link>
<title><![CDATA[The REESSE1+ Public-key Cryptosystem]]>, by Shenghui Su, and Shuwang Lu</title>
<description><![CDATA[This paper gives the definition of a coprime sequence and the concept of the lever function, describes the five algorithms and six characteristics of the REESSE1+ public-key cryptosystem based on three new hardnesses: the modular subset product problem, the multivariate arrangement problem, and the super logarithm problem in a prime field, shows the correctness of the decryption algorithm, and infers that the probability that a plaintext solution is not unique is nearly zeroth. The authors analyze the security of REESSE1+ against recovering a related plaintext from a ciphertext, extracting a related private key from a public key or a signature, and faking a digital signature via a public key or a known signature with a public key, discuss the super logarithm problem, and believe that the security of REESSE1+ is at least equal to the time complexity of O(2^n) at present. At last, the paper expounds the idea of optimizing REESSE1+ through binary compact sequences.
]]></description>
<guid>http://eprint.iacr.org/2006/420</guid>
</item>
<item>
<link>http://eprint.iacr.org/2006/219</link>
<title><![CDATA[Cryptographically Sound Security Proofs for Basic and Public-Key Kerberos]]>, by Michael Backes and Iliano Cervesato and Aaron D. Jaggard and Andre Scedrov and Joe-Kai Tsay</title>
<description><![CDATA[We present a computational analysis of basic Kerberos with and without its public-key extension PKINIT in which we consider authentication and key secrecy properties.  Our proofs rely on the Dolev--Yao-style model of Backes, Pfitzmann, and Waidner, which allows for mapping results obtained symbolically within this model to cryptographically sound proofs if certain assumptions are met.  This work was the first verification at the computational level of such a complex fragment of an industrial protocol.  By considering a recently fixed version of PKINIT, we extend symbolic correctness results we previously attained in the Dolev--Yao model to cryptographically sound results in the computational model. 
]]></description>
<guid>http://eprint.iacr.org/2006/219</guid>
</item>
<item>
<link>http://eprint.iacr.org/2004/224</link>
<title><![CDATA[The Polynomial Composition Problem in (Z/nZ)[X]]]>, by Marc Joye and David Naccache and Stephanie Porte</title>
<description><![CDATA[Let n be an RSA modulus and let P,Q in (Z/nZ)[X]. This paper explores the following problem: Given polynomials Q and Q(P), find polynomial P. We shed light on the connections between the above problem and the RSA problem and derive from it new zero-knowledge protocols suited to smart-card applications.
]]></description>
<guid>http://eprint.iacr.org/2004/224</guid>
</item>
</channel></rss>
