<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
<channel><title>Cryptology ePrint Archive</title>
<link>http://eprint.iacr.org/</link>
<description>Recently modified papers in the IACR Cryptology ePrint Archive</description>
<language>en-us</language>
<lastBuildDate>Fri, 03 Jul 2009 20:41:02 -0600</lastBuildDate>
<webMaster>webmaster@iacr.org</webMaster>
<managingEditor>eprint-editor@iacr.org</managingEditor>
<generator>None of your business</generator>
<ttl>60</ttl>
<item>
<link>http://eprint.iacr.org/2009/323</link>
<title><![CDATA[Factoring Unbalanced Moduli with Known Bits]]>, by Eric Brier and David Naccache and Mehdi Tibouchi</title>
<description><![CDATA[Let $n = pq > q^3$ be an RSA modulus. This note describes a LLL-based method allowing to factor $n$ given $2log_2q$ contiguous bits of $p$, irrespective to their position. A second method is presented, which needs fewer bits but whose length depends on the position of the known bit pattern. Finally, we introduce a somewhat surprising ad hoc method where two different known bit chunks, totalling $\frac32 log_2 q$ bits suffice to factor $n$. 
]]></description>
<guid>http://eprint.iacr.org/2009/323</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/322</link>
<title><![CDATA[Certifying Assembly with Formal Cryptographic Proofs: the Case of BBS]]>, by Reynald Affeldt, David Nowak and Kiyoshi Yamada</title>
<description><![CDATA[With today's dissemination of embedded systems manipulating sensitive data, it has become important to equip low-level programs with strong security guarantees. Unfortunately, security proofs as done by cryptographers are about algorithms, not about concrete implementations running on hardware. In this paper, we show how to extend security proofs to guarantee the security of assembly implementations of cryptographic primitives. Our approach is based on a framework in the Coq proof-assistant that integrates correctness proofs of assembly programs with game-playing proofs of provable security. We demonstrate the usability of our approach using the Blum-Blum-Shub (BBS) pseudorandom number generator, for which a MIPS implementation for smartcards is shown cryptographically secure.

]]></description>
<guid>http://eprint.iacr.org/2009/322</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/321</link>
<title><![CDATA[Tweakable Enciphering Schemes From Stream Ciphers With IV]]>, by Palash Sarkar</title>
<description><![CDATA[We present the first construction of a tweakable enciphering scheme from a stream cipher
supporting an initialization vector. This construction can take advantage of the recent
advances in hardware efficient stream ciphers to yield disk encryption systems with a very
small hardware footprint. Such systems will be attractive for resource constrained devices.
]]></description>
<guid>http://eprint.iacr.org/2009/321</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/320</link>
<title><![CDATA[Automorphic Signatures in Bilinear Groups]]>, by Georg Fuchsbauer</title>
<description><![CDATA[We call signature schemes in bilinear groups automorphic if they have the following properties: the verification keys lie in the message space, messages and signatures consist of group elements only, and verification is done by evaluating a set of pairing-product equations.
These signatures make a perfect counterpart to the powerful proof system by Groth and Sahai (Eurocrypt 2008).  We give practical instantiations under appropriate assumptions and an extension yielding blind signatures.  To illustrate their usefulness in combination with Groth-Sahai proofs, we efficiently instantiate a series of recent primitives ensuring user anonymity.
]]></description>
<guid>http://eprint.iacr.org/2009/320</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/319</link>
<title><![CDATA[Comments and Improvements on Chameleon Hashing Without Key Exposure Based on Factoring]]>, by Xiaofeng Chen and Haibo Tian and Fangguo Zhang</title>
<description><![CDATA[In this paper, we present some security flaws of the key-exposure
free chameleon hash scheme based on factoring \cite{GWX07}.
Besides, we propose an improved chameleon hash scheme without key
exposure based on factoring which enjoys all the desired security
notions of chameleon hashing.
]]></description>
<guid>http://eprint.iacr.org/2009/319</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/318</link>
<title><![CDATA[The Fermat  factorization method revisited]]>, by ERRA Robert and GRENIER Chirstophe</title>
<description><![CDATA[We consider the well known Fermat factorization method, we call the {\it Fermat factorization equation} the equation solved 
by it: ${\cal P}(x,y)=(x+2R)^2-y^2-4N=0$;   where $N=p\, q>0$ is a RSA modulus with primes $p$ and $q$ supposed of equal length.

This equation is a bivariate integer polynomial equation and we propose to solve it directly using Coppersmith's method for bivariate integer polynomials. As we use them as a black box, our proofs will be  brief. 

We show a first result : we can factor $N$ in a polynomial time if $|p-q|<N^{5/18}$. 
Using the fact that the Newton polygon of ${\cal P}(x,y)$ is in fact a lower triangle 
we show a better result: we can indeed factor $N$ in a polynomial time if $|p-q|<N^{1/3}$. 
We conclude with proposals for future works.
]]></description>
<guid>http://eprint.iacr.org/2009/318</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/317</link>
<title><![CDATA[Related-key Cryptanalysis of the Full AES-192 and AES-256]]>, by Alex Biryukov and Dmitry Khovratovich</title>
<description><![CDATA[In this paper we present two related-key attacks on the full AES. For AES-256 we show the first key recovery attack that works for all the keys and has complexity $2^{119}$, while the recent attack by Biryukov-Khovratovich-Nikoli\'c works for a weak key class and has higher complexity. The second attack is the first cryptanalysis of the full AES-192. Both our attacks are boomerang attacks, which are based on the recent idea of finding {\em local collisions in block ciphers} and enhanced with the {\em boomerang switching} techniques to gain free rounds in the middle.
]]></description>
<guid>http://eprint.iacr.org/2009/317</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/316</link>
<title><![CDATA[An Efficient Password Security of Three-Party Key exchange Protocol based on ECDLP]]>, by Jayaprakash  Kar, Dr.Bansidhar Majhi</title>
<description><![CDATA[In this paper we have proposed an efficient password security of Three-Party Key Exchange Protocol based on Elliptic Curve Discrete Logarithm Problem. Key exchange protocols allow two parties communicating over a public network to establish a common secret key called session key. Due to their significance by in building a secure communication channel, a number of key exchange protocols have been suggested over the years for a variety of settings.Here we have taken two one-way hash functions to built the level of security high.
]]></description>
<guid>http://eprint.iacr.org/2009/316</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/315</link>
<title><![CDATA[Breaking RSA-based PIN Encryption with thirty ciphertext validity queries]]>, by N.P. Smart</title>
<description><![CDATA[We show that one can recover the PIN from a standardised RSA-based PIN encryption algorithm from a small number of queries to a ciphertext validity checking oracle. The validity checking oracle required is rather special and we discuss whether such oracles could be obtained in
the real world. Our method works using a minor extension to the ideas
of Bleichenbacher and Manger, in particular we obtain information from negative, as well as positive, responses from the validity checking oracle.
]]></description>
<guid>http://eprint.iacr.org/2009/315</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/314</link>
<title><![CDATA[Secure Two-Party Computation is Practical]]>, by B. Pinkas and T. Schneider and N.P. Smart and S. Williams</title>
<description><![CDATA[Secure multi-party computation has been considered by the cryptographic community for a number of years.  Until recently it has been a purely theoretical area, with few implementations with which to test various ideas.  This has led to a number of optimisations being proposed which are quite restricted in their application.  In this paper we describe an implementation of the 2-party case, using Yao's garbled circuits, we present various algorithmic protocol improvements. These optimisations are analysed both theoretically and empirically, using experiments of various adversarial situations.  Our experimental data is provided for reasonably large circuits, including one which performs an AES encryption, a problem which we discuss in the context of various possible applications.
]]></description>
<guid>http://eprint.iacr.org/2009/314</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/313</link>
<title><![CDATA[Identity Based Group Signatures from Hierarchical Identity-Based Encryption]]>, by Nigel P. Smart and Bogdan Warinschi</title>
<description><![CDATA[A number of previous papers explored the notion of identity-based group signature. We present a generic construction of identity-based group signatures. Our construction is based on the Naor transformation of a identity-based signature out of an identity-based encryption, adjusted to hierarchical identity-based encryption. We identify sufficient conditions on the underlying HIBE so that the scheme that results 
from our transformation meets our security definitions. Finally, we suggest a couple of extensions enabled by our construction, one of which is to hierarchical identity-based group signatures.
]]></description>
<guid>http://eprint.iacr.org/2009/313</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/312</link>
<title><![CDATA[Jacobi Quartic Curves Revisited]]>, by Huseyin Hisil and Kenneth Koon-Ho Wong and Gary Carter and Ed Dawson</title>
<description><![CDATA[This paper provides new results about efficient arithmetic on Jacobi quartic form elliptic curves, $y^2 = d x^4 + 2 a x^2 + 1$. With recent proposals, the arithmetic on Jacobi quartic curves became solidly faster than that of Weierstrass curves. These proposals use up to 7 coordinates to represent a single point. However, fast scalar multiplication algorithms based on windowing techniques, precompute and store several points which require more space than what it takes with 3 coordinates. Also note that some of these proposals require $d = 1$ for full speed. Unfortunately, elliptic curves having 2-times-a-prime number of points, cannot be written in Jacobi quartic form if $d = 1$. Even worse the contemporary formulae may fail to output correct coordinates for some inputs. This paper provides improved speeds using fewer coordinates without causing the above mentioned problems. For instance, our proposed point doubling algorithm takes only 2 multiplications, 5 squarings, and no multiplication with curve constants when $d$ is arbitrary and $a = \pm1/2$.

]]></description>
<guid>http://eprint.iacr.org/2009/312</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/311</link>
<title><![CDATA[Multi Party Distributed Private Matching, Set Disjointness and Cardinality Set Intersection with Information Theoretic Security]]>, by Sathya Narayanan G, Aishwarya T, Anugrah Agrawal,  Arpita Patra, Ashish Choudhary, Pandu Rangan C</title>
<description><![CDATA[In this paper, we focus on the specific problems of Private Matching, Set Disjointness and Cardinality Set Intersection in information theoretic settings. Specifically, we give perfectly secure protocols 
for the above problems in n party settings, tolerating a computational ly unbounded semi-honest adversary, who can passively corrupt at most t < n/2 parties. To the best of our knowledge, these are the first such 
information theoretically secure protocols in a multi-party setting for all three problems. Previous solutions for Distributed Private Matching and Cardinality Set Intersection were cryptographical ly secure and the 
previous Set Disjointness solution, though information theoretically secure, is in a two party setting. We also propose a new model for Distributed Private matching which is relevant in a multi-party setting. 
]]></description>
<guid>http://eprint.iacr.org/2009/311</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/310</link>
<title><![CDATA[RFID distance bounding protocol with mixed challenges to prevent relay attacks]]>, by Chong Hee Kim and Gildas Avoine</title>
<description><![CDATA[RFID systems suffer from different location-based attacks such as distance fraud, mafia fraud and terrorist fraud attacks. Among them mafia fraud attack is the most serious since this attack can be mounted without the notice of both the reader and the tag. An adversary performs a kind of man-in-the-middle attack between the reader and the tag. It is very difficult to prevent this attack since the adversary does not change any data between the reader and the tag. Recently distance bounding protocols measuring the round-trip time between the reader and the tag have been researched to prevent this attack.

All the existing distance bounding protocols based on binary challenges, without final signature, provide an adversary success probability equal to (3/4)^n where n is the number of rounds in the protocol. In this paper, we introduce a new protocol based on binary mixed challenges that converges toward the expected and optimal (1/2)^n bound. We prove its security in case of both noisy and non-noisy channels.
]]></description>
<guid>http://eprint.iacr.org/2009/310</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/309</link>
<title><![CDATA[Fault Attacks on RSA Signatures with Partially Unknown Messages]]>, by Jean-Sebastien Coron and Antoine Joux and Ilya Kizhvatov and David Naccache and Pascal Paillier</title>
<description><![CDATA[Fault attacks exploit hardware malfunctions to recover secrets from embedded electronic devices.
In the late 90's, Boneh, DeMillo and Lipton introduced fault-based attacks on {\sc crt-rsa}.
These attacks factor the signer's modulus when the message padding
function is deterministic. However, the attack does not apply when the
message is partially unknown, for example when messages contain some
randomness which is recovered only when
 verifying a {\sl correct} signature.

In this paper we successfully extends RSA fault attacks to a large class
of partially known message configurations.
The new attacks rely on Coppersmith's algorithm for finding small roots of multivariate polynomial equations.
We illustrate the approach by successfully attacking several randomized versions of the ISO 9796-2 encoding standard.
Practical experiments show that a $2048$-bit modulus can be factored
in less than a minute given one faulty signature containing $160$
random bits and an unknown $160$-bit message digest.
]]></description>
<guid>http://eprint.iacr.org/2009/309</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/308</link>
<title><![CDATA[A note on the Certificateless Multi-receiver  Signcryption Scheme]]>, by S. Sharmila Deva Selvi and S. Sree Vivek and C. Pandu Rangan</title>
<description><![CDATA[Certificateless cryptography aims at combining the advantages of identity based and public key cryptography, so as to avoid the 
key escrow problem inherent in the identity based system and cumbersome certificate management in public key infrastructure. Signcryption 
achieves confidentiality and authentication simultaneously in an e
]]></description>
<guid>http://eprint.iacr.org/2009/308</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/307</link>
<title><![CDATA[Anonymous Signatures Revisited]]>, by Vishal Saraswat and Aaram Yun</title>
<description><![CDATA[We revisit the notion of the anonymous signature, first formalized by 
Yang, Wong, Deng and Wang, and then further developed by 
Fischlin and Zhang and Imai. 
We point out that the previous formalism is inadequate in several aspects 
and present a new formalism. We introduce the notion unpretendability
to guarantee infeasibility for someone other than the correct signer to 
pretend authorship of the message and signature. Our definition retains 
applicability for all previous applications of the anonymous signature, 
provides stronger security, and is conceptually simpler.  
We give a generic construction from any ordinary signature scheme and finally
we present an example construction of an efficient anonymous signature scheme.
We show that the short signature scheme by Boneh and Boyen can be naturally
regarded as such a secure anonymous signature scheme according to
our formalism.
]]></description>
<guid>http://eprint.iacr.org/2009/307</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/306</link>
<title><![CDATA[Authentic Time-Stamps for Archival Storage]]>, by Alina Oprea and Kevin D. Bowers</title>
<description><![CDATA[We study the problem of authenticating the content and creation time of documents generated by an organization and retained in archival storage. Recent regulations (e.g., the Sarbanes-Oxley act and the Securities and Exchange Commission rule) mandate secure retention of important business records for several years. We provide a mechanism to authenticate bulk repositories of archived documents. In our approach, a space efficient local data structure encapsulates a full document repository in a short (e.g., 32-byte) digest. Periodically registered with a trusted party, these commitments enable compact proofs of both document creation time and content integrity.  The data structure, an append-only persistent authenticated dictionary, allows for efficient proofs of existence and non-existence, improving on state-of-the-art techniques. We give a rigorous security analysis of our solution and confirm through an experimental evaluation with the Enron email corpus its feasibility in practice. 
]]></description>
<guid>http://eprint.iacr.org/2009/306</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/305</link>
<title><![CDATA[Improved generic algorithms for 3-collisions]]>, by Antoine Joux and Stefan Lucks</title>
<description><![CDATA[ An $r$-collision for a function is a set of $r$ distinct inputs with identical outputs. Actually finding $r$-collisions for a random map over a finite set of cardinality $N$ requires at least about $N^{(r-1)/r} $ units of time on a sequential machine. For $r$=2, memoryless and well-parallelisable algorithms are known. The current paper describes memory-efficient and parallelisable algorithms for $r \ge 3$. The main results are: (1)~A sequential algorithm for 3-collisions, roughly using memory $N^\alpha$ and time $N^{1-\alpha}$ for $\alpha\le1/3$. I.e., given $N^{1/3}$ units of storage, on can find 3-collisions in time $N^{2/3}$. Note that there is a time-memory tradeoff which allows to reduce the memory consumption. (2)~A parallelisation of this algorithm using $N^{1/3}$ processors running in time $N^{1/3}$. Each single processor only needs a constant amount of memory. (3)~An generalisation of this second approach to $r$-collisions for $r \ge3$: given $N^s$ parallel processors, on can generate $r$-collisions roughly in time $N^{((r-1)/r)-s}$, using memory $N^{((r-2)/r)-s}$ on every processor. 
]]></description>
<guid>http://eprint.iacr.org/2009/305</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/304</link>
<title><![CDATA[Factor-4 and 6 Compression of Cyclotomic Subgroups]]>, by Koray Karabina</title>
<description><![CDATA[Bilinear pairings derived from supersingular elliptic curves of embedding degrees 4 and 6 over finite fields of characteristic two and three, respectively, have been used to implement pairing-based cryptographic protocols. The pairing values lie in certain prime-order subgroups of certain cyclotomic subgroups. It was previously known how to compress the pairing values over characteristic two fields by a factor of 2, and the pairing values over characteristic three fields by a factor of 6. We show how the pairing values over characteristic two fields can be compressed by a factor of 4. Moreover, we present and compare several algorithms for performing exponentiation in the prime-order subgroups using the compressed representations. In particular, in the case where the base is fixed, we gain a 59% speed up over the fastest previously known exponentiation algorithm that uses factor-6 compressed representations.
]]></description>
<guid>http://eprint.iacr.org/2009/304</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/303</link>
<title><![CDATA[Key extraction from general non-discrete signals]]>, by E. Verbitskiy and P. Tuyls and C. Obi and B. Schoenmakers and B. Skoric</title>
<description><![CDATA[We address the problem of designing optimal schemes for the generation of secure cryptographic keys from continuous noisy data. We argue that, contrary to the discrete case, a universal fuzzy extractor does not exist. 
This implies that in the continuous case, key extraction schemes  have to be designed for particular probability distributions.
We extend the known definitions of the correctness and security properties of fuzzy extractors. Our definitions apply to continuous as well as discrete variables.

We propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions.
The extra freedom in the choice of discretisation, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution.
We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise.

Finally, we study the security implications of incomplete knowledge of the source's probability distribution P.
We derive a bound on the min-entropy of the extracted key under the worst case assumption, where the attacker knows P exactly.
]]></description>
<guid>http://eprint.iacr.org/2009/303</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/302</link>
<title><![CDATA[Cryptanalysis of ESSENCE]]>, by Maria Naya-Plasencia and Andrea Röck and Jean-Philippe Aumasson and Yann Laigle-Chapuy and Gaëtan Leurent and Willi Meier and Thomas Peyrin</title>
<description><![CDATA[ESSENCE is a hash function submitted to the NIST Hash Competition that stands out as a hardware-friendly and highly parallelizable design, and that has thus far remained unbroken. Preliminary analysis in its documentation argues that it resists standard differential cryptanalysis. This paper disproves this claim, showing that advanced techniques can be used to significantly reduce the cost of such attacks: using a manually found differential characteristic and a nontrivial search algorithm, we obtain shortcut collision attacks on the full ESSENCE-256 and ESSENCE-512, with respective complexities $2^{91}$ and $2^{168}$. As an aside, we show how to use these attacks for forging valid message/MAC pairs for HMAC-ESSENCE-256 and HMAC-ESSENCE-512, essentially at the same cost as a collision.
]]></description>
<guid>http://eprint.iacr.org/2009/302</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/301</link>
<title><![CDATA[A Probabilistic Secret Sharing Scheme for a Compartmented Access Structure]]>, by Yuyin Yu and Mingsheng Wang</title>
<description><![CDATA[In a compartmented access structure, there are disjoint participants
C1, . . . ,Cm. The access structure consists of subsets of participants
containing at least ti from Ci for i = 1, . . . ,m, and a total of at
least t0 participants. Tassa [2] asked: whether there exists an efficient ideal secret sharing scheme for such an access structure? Tassa and Dyn [5] presented a solution using the idea of bivariate interpolation and the concept of dual program [9, 10]. For the purpose of practical applications, it is advantageous to have a simple scheme solving the problem. In this paper a simple scheme is given for this problem using the similar idea from [5].
]]></description>
<guid>http://eprint.iacr.org/2009/301</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/300</link>
<title><![CDATA[Universally Composable Contributory Group Key Exchange]]>, by M. Choudary Gorantla and Colin Boyd and Juan Manuel Gonz\`alez Nieto</title>
<description><![CDATA[We treat the security of group key exchange (GKE) in the universal composability (UC) framework. Analyzing GKE protocols in the UC framework naturally addresses attacks by malicious insiders. We define an ideal functionality for GKE that captures contributiveness in addition to other desired security goals. We show that an efficient two-round protocol securely realizes the proposed functionality in the random oracle model. As a result, we obtain the most efficient UC-secure contributory GKE protocol known.
]]></description>
<guid>http://eprint.iacr.org/2009/300</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/299</link>
<title><![CDATA[On the security of oscillator-based random number generators]]>, by Mathieu Baudet and David Lubicz and Julien Micolod and Andr\'e Tassiaux</title>
<description><![CDATA[True Random Number Generators (TRNGs) are a critical building block
of many cryptographic systems. It is thus of first importance to
design TRNGs with a proved assessment of security. A common and
attractive way to implement a TRNG on a chip is to sample a ring
oscillator and take advantage of its phase jitters as a source of
entropy.  In this paper, we present a comprehensive statistical
model for TRNGs based on this principle. In order to use this model,
typically to evaluate the entropy rate or to control the biases of
certain bit patterns, it is necessary to assess the physical
parameters of the ring oscillator. We propose a method for filtering
out the perturbations due to the global deterministic component of
the jitters, and for precisely measuring the statistics of the
Gaussian jitters, that is, the secure source of entropy. Finally we
outline two specific statistical tests applicable to the bit stream
of a TRNG in order to check for its good operation, or in some cases,
to recover the parameters of the underlying oscillator.
]]></description>
<guid>http://eprint.iacr.org/2009/299</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/298</link>
<title><![CDATA[On the Security of Certificateless Signcryption Schemes]]>, by S. Sharmila Deva Selvi, S. Sree Vivek. C. Pandu Ragan</title>
<description><![CDATA[Signcryption is a cryptographic primitive which offers authentication and confidentiality simultaneously with a very low cost when compared to signing and encryption a message independently. Certificateless cryptography (CLC) is a relatively new filed where the public key of the user is not certified by a central authority, which overcomes the cumbersome certificate verification which is an ill fate in public key infrastructure (PKI). Certificateless systems provide a natural way to reduce the key escrow in identity based cryptosystems (IBC). In the literature there are four certificateless signcryption schemes and in this paper, we show that two out of them are insecure.
]]></description>
<guid>http://eprint.iacr.org/2009/298</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/297</link>
<title><![CDATA[A New Improved Distinguisher for HC-128]]>, by Subhabrata Sen and Rudradev Sengupta and Subhamoy Maitra and Goutam Paul and Shashwat Raizada</title>
<description><![CDATA[In this paper we present a new distinguisher for HC-128 which is the best known so far. The distinguisher requires approximately 
$2^{106}$ keystream words with success probability 0.9772.
]]></description>
<guid>http://eprint.iacr.org/2009/297</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/296</link>
<title><![CDATA[Perfectly Balanced Functions in Symbolic Dynamics]]>, by O.A. Logachev and A.A. Salnikov and S.V. Smyshlyaev and V.V. Yashchenko</title>
<description><![CDATA[In the present paper we study properties of perfectly balanced Boolean functions. Based on the concept of Boolean function barrier, we propose a novel approach to construct large classes of perfectly balanced Boolean functions.
]]></description>
<guid>http://eprint.iacr.org/2009/296</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/295</link>
<title><![CDATA[Defending Against Key Abuse Attacks in KP-ABE Enabled Broadcast Systems]]>, by Shucheng Yu and Kui Ren and Wenjing Lou and Jin Li</title>
<description><![CDATA[Key-Policy Attribute-Based Encryption (KP-ABE) is a promising
cryptographic primitive which enables fine-grained access control
over sensitive data. However, key abuse attacks in KP-ABE may impede
its wide application especially in copyright-sensitive systems. To
defend against this kind of attacks, this paper proposes a novel KP-ABE scheme which is able to disclose any illegal key distributor’s ID when key abuse is detected. In our scheme, each bit of user ID is defined as an attribute and the user secret key is associated with his unique ID. The tracing algorithm fulfills its task by tricking the pirate device into decrypting the ciphertext associated with the corresponding bits of his ID. Our proposed scheme has the salient property of black box tracing, i.e., it traces back to the illegal key distributor’s ID only by observing the pirate device’s outputs on certain inputs. In addition, it does not require the pirate device’s secret keys to be well-formed as compared to some previous work. Our proposed scheme is provably secure under the Decisional Bilinear Diffie-Hellman (DBDH) assumption and the Decisional Linear (DL) assumption.
]]></description>
<guid>http://eprint.iacr.org/2009/295</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/294</link>
<title><![CDATA[Low Latency High Bandwidth Anonymous Overlay Network with Anonymous Routing]]>, by Roman Schlegel and Duncan S. Wong</title>
<description><![CDATA[Most existing anonymous networks focus on providing strong anonymity for the price of having lower bandwidth, higher latency and degraded usability when compared with the conventional use of the Internet. They also often anonymize only a few specific applications.
In this paper, we propose a new approach of constructing an anonymous network. The network consists of an overlay network, which provides anonymity to all applications running on top of it, and a routing protocol, which can be considered as an anonymized version of path vector routing. The protocol preserves the high performance characteristics of the path vector routing and also has the added advantage of hiding the overlay network topology. Our simulation results show that the expected latency of our approach is 50% better than that of existing systems.
Besides the new anonymous routing protocol, this paper aims to provide the general overview of this new anonymous overlay network which may serve as the input for further research.

]]></description>
<guid>http://eprint.iacr.org/2009/294</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/293</link>
<title><![CDATA[Enhancing Attribute-based Encryption with Attribute Hierarchy]]>, by Jin Li and Qian Wang and Cong Wang and Kui Ren</title>
<description><![CDATA[Attribute-based encryption (ABE) has been envisioned as a promising cryptographic primitive for realizing secure and
flexible access control. However, ABE is being criticized for its high scheme overhead as extensive pairing operations are usually required. In this paper, we focus on improving the efficiency of ABE by leveraging a previously overlooked fact, i.e., the often-found hierarchical relationships among the attributes that are inherent to many access control scenarios. As the first research effort along this direction, we coin the notion of hierarchical ABE (\textsf{HABE}), which can be viewed as the generalization of traditional ABE in the sense that both definitions are equal when all attributes are independent. We further give a concrete \textsf{HABE} construction considering a tree hierarchy among the attributes, which is provably secure. More importantly, our construction exhibits significant improvements over the traditional ABE when attribute hierarchies exist.
]]></description>
<guid>http://eprint.iacr.org/2009/293</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/292</link>
<title><![CDATA[Implementing Wagner's generalized birthday attack against the SHA-3 candidate FSB ]]>, by Daniel J. Bernstein and Tanja Lange and Christiane Peters and Ruben Niederhagen and Peter Schwabe</title>
<description><![CDATA[The hash function FSB is one of the candidates submitted to NIST's competition to find the new standard hash function, SHA-3. The compression function of FSB is based on error correcting codes. In this paper we show how to use Wagner's generalized birthday attack to find collisions in FSB's compression function. In particular, we present details on our implementation attacking FSB_48, a toy version of FSB which was proposed by the FSB submitters as a training case for FSB. Our attack does not make use of any properties of the particular linear code used within FSB. FSB_48 was chosen as a target where generalized birthday attacks would be one of the strongest attacks and which could be attacked in practice.

We show how to adapt this attack so that it runs on our computer   cluster of only 10 PCs which provides far less memory than the usual implementation of generalized birthday attacks would require. This situation is very interesting for estimating the security of systems against distributed attacks using contributed off-the-shelf PCs.

For the SHA-3 competition this result is meaningful in that it allows to assess the security of FSB against the strongest non-structural attack; it does not provide any insight in the security of this particular choice of linear code.
]]></description>
<guid>http://eprint.iacr.org/2009/292</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/291</link>
<title><![CDATA[Modeling Key Compromise Impersonation Attacks on Group Key Exchange Protocols]]>, by M. Choudary Gorantla and Colin Boyd and Juan Manuel Gonz\'alez Nieto</title>
<description><![CDATA[A key exchange protocol allows a set of parties to agree upon a secret session key over a public network. Two-party key exchange (2PKE) protocols have been rigorously analyzed under various models considering different adversarial actions. However, the analysis of group key exchange (GKE) protocols has not been as extensive as that of 2PKE protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for the case of GKE protocols. We first model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure even against outsider KCI attacks. The attacks on these protocols demonstrate the necessity of considering KCI resilience for GKE protocols. Finally, we give a new proof of security for an existing GKE protocol under the revised model assuming random oracles.
]]></description>
<guid>http://eprint.iacr.org/2009/291</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/290</link>
<title><![CDATA[Security Analysis of Aggregate signature and Batch verification signature schemes]]>, by S.Sharmila Deva Selvi and S.Sree Vivek and J.Shriram and S.Kalaivani and C.Pandu Rangan</title>
<description><![CDATA[An identity based signature scheme allows any pair of users to communicate securely and to verify each others signatures without exchanging public key certificates. An aggregate signature scheme is a digital signature scheme which supports aggregation of signatures. Batch verification is a method to verify multiple signatures at once. Aggregate signature is useful in reducing both communication and computation cost. In this paper, we describe the breaks possible in some of the aggregate signature schemes and batch verification scheme.
]]></description>
<guid>http://eprint.iacr.org/2009/290</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/289</link>
<title><![CDATA[Analysis of the End-by-Hop Protocol for Secure Aggregation in Sensor Networks]]>, by Erik Zenner</title>
<description><![CDATA[In order to save bandwidth and thus battery power, sensor network measurements are sometimes aggregated en-route while being reported back to the querying server. Authentication of the measurements then becomes a challenge if message integrity is important for the application.

At ESAS 2007, the End-by-Hop protocol for securing in-network aggregation for sensor nodes was presented. The solution was claimed to be secure and efficient and to provide the possibility of trading off bandwidth against computation time on the server.

In this paper, we disprove these claims. We describe several attacks against the proposed solution and point out shortcomings in the original complexity analysis. In particular, we show that the proposed solution is inferior to a naive solution without in-network aggregation both in security and in efficiency.
]]></description>
<guid>http://eprint.iacr.org/2009/289</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/288</link>
<title><![CDATA[Efficient Key Exchange with Tight Security Reduction]]>, by Jiang Wu and Berkant Ustaoglu</title>
<description><![CDATA[In this paper, we propose two authenticated key exchange (AKE) protocols, SMEN and SMEN&#8722;, which have efficient online computation and tight security proof in the extended Canetti-Krawczyk (eCK) model. SMEN takes 1.25 exponentiations in online computation, close
to that (1.17 exponentiations) of the most efficient AKEs MQV and its variants HMQV and CMQV. SMEN has a security reduction as tight as that of NAXOS, which is the first AKE having a tight security reduction in the eCK model. As a comparison, MQV does not have a security proof; both HMQV and CMQV have a highly non-tight security reduction, and HMQV needs a non-standard assumption; NAXOS takes 2.17 exponentiations in online computation; NETS, a NAXOS variant, takes two online exponentiations in online computation. SMEN simultaneously
achieves online efficiency and a tight security proof at a cost of 0.17 more exponentiations in offline computation and the restriction that one party is not allowed to establish a key with itself. SMEN&#8722; takes 1.29 exponentiations in online computation, but SMEN&#8722; does not use the static private key to compute the ephemeral public key (as does in SMEN, NAXOS, CMQV, and NETS), and hence reduces the risk of leaking the static private key.
]]></description>
<guid>http://eprint.iacr.org/2009/288</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/287</link>
<title><![CDATA[Generic Attacks on Alternating Unbalanced Feistel Schemes]]>, by Valerie Nachef</title>
<description><![CDATA[
\begin{abstract}
Generic attacks against classical (balanced) Feistel schemes, unbalanced Feistel schemes with contracting functions and unbalanced Feistel schemes with expanding functions have been studied in \cite {P01}, \cite{Jut}, \cite{PNB06}, \cite{PNB07}. In this paper we study schemes where we use alternatively contracting random functions and expanding random functions. We name these schemes ``Alternating Unbalanced Feistel Schemes''. They allow constructing pseudo-random permutations from $kn$ bits to $kn$ bits where $k \geq 3$. At each round, we use either a random function from $n$ bits to $(k-1)n$ bits or a random function from $(k-1)n$ bits to $n$ bits. We describe the best generic attacks we have found. We present``known plaintext attacks'' (KPA) and ``non-adaptive chosen plaintext attacks'' (CPA-1). Let $d$ be the number of rounds. We show that if $d \leq k$, there are CPA-1 with 2 messages and KPA with $m$ the number of messages about $2^{\frac {(d-1)n}{4}}$. For $d \geq k+1$ we have to distinguish $k$ even and $k$ odd. For $k$ even, we have $m=2$ in CPA-1 and $m \simeq 2^{\frac {kn}{4}}$ in KPA. When $k$ is odd, we show that there exist CPA-1 for $d \leq 2k-1$ and KPA for $d \leq 2k+3$ with less than $2^{kn}$ messages and computations. Beyond these values, we give KPA against generators of permutations.

\end{abstract}
]]></description>
<guid>http://eprint.iacr.org/2009/287</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/286</link>
<title><![CDATA[On Privacy Losses in the Trusted Agent Model (Abstract)]]>, by Paulo Mateus and Serge Vaudenay</title>
<description><![CDATA[Tamper-proof devices are pretty powerful. They typically make security applications simpler (provided that the tamper-proof assumption is not violated). For application requiring privacy, we observe that some properties may become harder (if possible at all) to achieve when devices are maliciously used. We take the example of deniability, receipt-freeness, and anonymity.

We formalize the trusted agent model which assumes tamper-proof hardware in a way which captures the notion of programmable secure hardware. This model defines a functionality relative to which deniability requires provers to use a tamper proof hardware. Otherwise, any asymmetric situation in which the malicious verifiers have more powerful tamper-proof devices than the honest ones makes deniability impossible.

We conclude by observing that the ability to put boundaries in computing devices prevents from providing full control on how private information spreads: the concept of sealing a device is in some sense incompatible with some privacy notions. 
]]></description>
<guid>http://eprint.iacr.org/2009/286</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/285</link>
<title><![CDATA[Efficient Public Key Encryption Based on Ideal Lattices]]>, by Damien Stehlé, Ron Steinfeld, Keisuke Tanaka, Keita Xagawa</title>
<description><![CDATA[The potential high efficiency of public-key encryption based on
structured lattices was first indicated by the NTRU cryptosystem,
which was proposed about 10 years ago. Unfortunately, the security of
NTRU is only heuristic. Thus, it remained an important research challenge to construct an efficient encryption scheme based on structured lattices which admits a proof of security relative to a well established cryptographic assumption.  We make progress in addressing the above challenge. We show how to construct a CPA-secure public-key encryption scheme with security provably based on the worst case hardness of the approximate Shortest Vector Problem in structured ideal lattices. Under the assumption that the latter is exponentially hard to solve even with a quantum computer, our scheme resists any subexponential attack and offers (quasi-)optimal asymptotic performance: if $n$ is the security parameter, both keys are of bit-length $\softO(n)$ and the amortized costs of both encryption and decryption are $\softO(1)$ per message
bit. Our construction adapts the trapdoor one-way function of Gentry,
Peikert and Vaikuntanathan (STOC 2008), based on the Learning With
Errors problem, to structured lattices. Our main technical tools are
an adaptation of Ajtai's trapdoor key generation algorithm
(ICALP 1999) to structured ideal lattices, and a re-interpretation of
Regev's quantum reduction between the Closest Vector Problem and
sampling short lattice vectors. We think these techniques are very
likely to find further applications in the future.

]]></description>
<guid>http://eprint.iacr.org/2009/285</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/284</link>
<title><![CDATA[Privacy-aware Attribute-based Encryption with User Accountability]]>, by Jin Li,  Kui Ren, Bo Zhu, and Zhiguo Wan</title>
<description><![CDATA[As a new public key primitive, attribute-based encryption (ABE) is envisioned to be a promising tool for implementing fine-grained access control. To further address the concern of user access privacy, privacy-aware ABE schemes are being developed to achieve hidden access policy recently. For the purpose of secure access control, there is, however, still one critical functionality missing in the existing ABE schemes, which is user accountability. Currently, no ABE scheme can completely prevent the problem of illegal key sharing among users. In this paper, we tackle this problem by firstly proposing the notion of accountable, anonymous, and ciphertext-policy ABE (CP-A$^3$BE, in short) and then giving out a concrete construction. We start by improving the state-of-the-art of anonymous CP-ABE to obtain shorter public parameters and ciphertext length. In the proposed CP-A$^3$BE construction, user accountability  can be achieved in black-box model by embedding additional user-specific information into the attribute private key issued to that user, while still maintaining hidden access policy. The proposed constructions are provably secure.
]]></description>
<guid>http://eprint.iacr.org/2009/284</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/283</link>
<title><![CDATA[Short and Stateless Signatures from the RSA Assumption]]>, by Susan Hohenberger and Brent Waters</title>
<description><![CDATA[We present the first signature scheme which is ``short'', stateless and secure under the RSA assumption in the standard model. Prior short, standard model signatures in the RSA setting required either a strong complexity assumption such as Strong RSA or (recently) that the signer maintain state. A signature in our scheme is comprised of one element in Z_N and one integer. The public key is also short, requiring only the modulus N, one element of Z_N, one integer and one PRF seed.

To design our signature, we employ the known generic construction of fully-secure signatures from weakly-secure signatures and a chameleon hash. We then introduce a new proof technique for reasoning about weakly-secure signatures. This technique enables the simulator to predict a prefix of the message on which the adversary will forge and to use knowledge of this prefix to embed the challenge. This technique has wider applications beyond RSA.

We also use it to provide an entirely new analysis of the security of the Waters signatures: the only short, stateless signatures known to be secure under the Computational Diffie-Hellman assumption in the standard model.
]]></description>
<guid>http://eprint.iacr.org/2009/283</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/281</link>
<title><![CDATA[Enabling Public Verifiability and Data Dynamics for Storage Security in Cloud Computing]]>, by Qian Wang and Cong Wang and Jin Li and Kui Ren and Wenjing Lou</title>
<description><![CDATA[Cloud Computing has been envisioned as the next-generation architecture of IT Enterprise. It moves the application software and databases to the centralized large data centers, where the management of the data and services may not be fully trustworthy. This unique paradigm brings about many new security challenges, which have not been well understood. In this work, we study the problem of ensuring the integrity of data storage in Cloud Computing. In particular, we consider the task of allowing a third party auditor (TPA), on behalf of the cloud client, to verify the storage correctness of the dynamic data stored in the cloud. The introduction of TPA eliminates the involvement of client through the auditing of whether his data stored in the cloud is indeed intact, which can be important in achieving economies of scale for Cloud Computing. The support to handle dynamic data via the most general forms of data operation, such as block modification, insertion and deletion, is also a significant step toward practicality, since services in Cloud Computing are not limited to archive or backup data only. While prior works on ensuring remote data integrity often lacks the support of either public verifiability or dynamic data operations, we achieve them both. We identify the difficulties and potential security problems of direct
extensions with fully dynamic data updates from prior works and show how to construct an elegant verification scheme for seamless integration of these two salient features in our protocol design. In particular, to achieve efficient data dynamics, we improve the Proof of Retrievability model [1] by manipulating the classic Merkle Hash Tree (MHT) construction for block tag authentication. Extensive security and performance analysis show that the proposed scheme is highly efficient and proven secure in the strongest security model.
]]></description>
<guid>http://eprint.iacr.org/2009/281</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/276</link>
<title><![CDATA[Multi-core Implementation of the Tate Pairing over Supersingular Elliptic Curves]]>, by Jean-Luc Beuchat and Emmanuel López-Trejo and Luis Martínez-Ramos and Shigeo Mitsunari and Francisco Rodríguez-Henríquez</title>
<description><![CDATA[This paper describes the design of a fast multi-core library for the cryptographic Tate pairing over supersingular elliptic curves. For the computation of the reduced modified Tate pairing over $\mathbb{F}_{3^{509}}$, we report calculation times of just $2.94$ ms and $1.87$ ms on the Intel Core2 and Intel Core i7 architectures, respectively. We also try to answer one important design question that surges: how many cores should be utilized for a given application?
]]></description>
<guid>http://eprint.iacr.org/2009/276</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/253</link>
<title><![CDATA[Formally and Practically Relating the CK, CK-HMQV, and eCK Security Models for Authenticated Key Exchange]]>, by Cas J.F. Cremers</title>
<description><![CDATA[Many recent protocols for Authenticated Key Exchange have been proven
correct in the CK, CK-HMQV, or eCK security models. The exact relation
between the security models, and hence between the security guarantees
provided by the protocols, is unclear. We show that the CK, CK-HMQV, and
eCK security models are not only formally incomparable but also
practically incomparable, by providing for each model attacks on
existing protocols that are not considered by the other models. We
analyse a set of recent key exchange protocols with respect to the
models.  Finally, we present the first two-message authenticated key
exchange protocol that is correct in the CK-HMQV and eCK models and also
provides Perfect Forward Secrecy.


]]></description>
<guid>http://eprint.iacr.org/2009/253</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/248</link>
<title><![CDATA[Cryptanalysis of the MST_3 Public Key Cryptosystem]]>, by Simon R. Blackburn, Carlos Cid and Ciaran Mullan</title>
<description><![CDATA[In this paper we describe a cryptanalysis of MST_3, a public key
cryptosystem based on non-commutative groups recently proposed by
Lempken, Magliveras, van Trung and Wei.

]]></description>
<guid>http://eprint.iacr.org/2009/248</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/225</link>
<title><![CDATA[The Security of Abreast-DM in the Ideal Cipher Model]]>, by Jooyoung Lee and Daesung Kwon</title>
<description><![CDATA[In this paper, we give a security proof for Abreast-DM in terms of collision resistance, preimage resistance and adaptive preimage resistance. As old as Tandem-DM, the compression function Abreast-DM is one of the most well-known constructions for double block length compression functions. The bounds on the number of queries for collision resistance and preimage resistance are given by $O(2^{n}$. The adaptive preimage resistance is guaranteed up to $O(2^{n})$ queries/commitments. Based on a novel technique using \emph{query-response cycles}, our security proof is simpler than those for MDC-2 and Tandem-DM. We also present a wide range of Abreast-DM variants that enjoy a birthday-type security guarantee with a simple proof.
]]></description>
<guid>http://eprint.iacr.org/2009/225</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/222</link>
<title><![CDATA[PET SNAKE: A Special Purpose Architecture to Implement an Algebraic Attack in Hardware]]>, by Willi Geiselmann and Kenneth Matheis and Rainer Steinwandt</title>
<description><![CDATA[In [Solving Multiple Right Hand Sides linear equations. Designs, Codes and Cryptography, 49:147–160, 2008] Raddum and Semaev propose a technique to solve systems of polynomial equations over GF(2) as occurring in algebraic attacks on block ciphers. This approach is known as MRHS, and we present a special purpose architecture to implement MRHS in a dedicated hardware device. Our preliminary performance analysis of this Parallel Elimination Technique Supporting Nice Algebraic Key Elimination shows that the use of ASICs seems to enable significant performance gains over a software implementation of MRHS. The main parts of the proposed architecture are scalable, the limiting factor being mainly the available bandwidth for interchip communication. Our focus is on a design choice that can be implemented within the limits of available fab technology. The proposed design can be expected to offer a running time improvement in the order of several magnitudes over a software implementation.

We do not make any claims about the practical feasibility of an attack against ciphers like AES or PRESENT with our design, however, as we do not see the necessary theoretical tools to be available:
deriving reliable running time estimates for an algebraic attack with MRHS when being applied to a full-round version of block ciphers like AES or PRESENT is still an open problem.

]]></description>
<guid>http://eprint.iacr.org/2009/222</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/208</link>
<title><![CDATA[PUBLIC KEY CRYPTOGRAPHY USING PERMUTATION P-POLYNOMIALS OVER FINITE FIELDS]]>, by Rajesh P Singh and  B.K.Sarma  and  A.Saikia</title>
<description><![CDATA[In this paper we propose an efficient multivariate
public key cryptosystem based on permutation p-polynomials over
finite fields. We first characterize a class of permutation
p-polynomials over finite fields $F_{q^{m}}$ and then construct a
trapdoor function using this class of permutation p-polynomials.
The complexity of encryption in our public key cryptosystem is
$O(m^{3})$ multiplication which is equivalent to other
multivariate public key cryptosystems. However the decryption is
much faster than other multivariate public key cryptosystems. In
decryption we need $O(m^{2})$ left cyclic shifts and $O(m^{2})$
xor operations.
]]></description>
<guid>http://eprint.iacr.org/2009/208</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/195</link>
<title><![CDATA[Secure Evaluation of Private Linear Branching Programs with Medical Applications]]>, by Mauro Barni and Pierluigi Failla and Vladimir Kolesnikov and Riccardo Lazzeretti and Ahmad-Reza Sadeghi and Thomas Schneider</title>
<description><![CDATA[Diagnostic and classification algorithms play an important role
in data analysis, with applications in  areas such as health
care, fault diagnostics, or benchmarking.  Branching programs (BP) is a
 popular representation model for describing the
underlying classification/diagnostics algorithms. Typical application
scenarios involve a client who provides data and a service provider
(server) whose diagnostic program is run on client's data.  Both parties need to keep their inputs private.

We present new, more efficient privacy-protecting protocols for remote
evaluation of such classification/diagnostic programs. 
In addition to efficiency improvements, we generalize previous solutions -- we securely evaluate private linear
branching programs (LBP), a useful generalization of BP that we introduce.  We show practicality of our solutions: we apply our protocols to the privacy-preserving
classification of medical ElectroCardioGram (ECG) signals and present
implementation results.  Finally, we discover and fix a subtle security weakness of the most recent remote diagnostic proposal, which allowed malicious clients to learn partial information about the program.
]]></description>
<guid>http://eprint.iacr.org/2009/195</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/166</link>
<title><![CDATA[I shall love you up to the death]]>, by Valerie Nachef and Jacques Patarin</title>
<description><![CDATA[\begin{abstract}
In this paper, we explain the encryption algorithm used by the Queen of France, Marie-Antoinette, to send letters to Axel von Fersen during the French Revolution. We give the complete deciphering of some letters for which we found differences with the text taken from historical books. We also provide the deciphering of one letter that seems to be unknown so far. The results we get bring new proofs on Marie-Antoinette's deep affection for Fersen. Finally, we mention some open questions about Marie-Antoinette's correspondence with Axel von Fersen. 

]]></description>
<guid>http://eprint.iacr.org/2009/166</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/164</link>
<title><![CDATA[CCA-Secure Proxy Re-Encryption without Pairings]]>, by Jun Shao and Zhenfu Cao</title>
<description><![CDATA[In a proxy re-encryption scheme, a semi-trusted proxy can transform
a ciphertext under Alice's public key into another ciphertext that
Bob can decrypt. However, the proxy cannot access the plaintext. Due
to its transformation property, proxy re-encryption can be used in
many applications, such as encrypted email forwarding. In this
paper, by using signature of knowledge and Fijisaki-Okamoto
conversion, we propose a proxy re-encryption scheme \emph{without}
pairings, in which the proxy can only transform the ciphertext in
one direction. The proposal is secure against chosen ciphertext
attack (CCA) and collusion attack in the \emph{random oracle model}
based on Decisional Diffie-Hellman (DDH) assumption over
$\mathbb{Z}_{N^2}^*$ and integer factorization assumption,
respectively. To the best of our knowledge, it is the \emph{first}
unidirectional PRE scheme with CCA security and
collusion-resistance.
]]></description>
<guid>http://eprint.iacr.org/2009/164</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/146</link>
<title><![CDATA[Transferable Anonymous Constant-Size Fair E-Cash]]>, by Georg Fuchsbauer and David Pointcheval and Damien Vergnaud</title>
<description><![CDATA[We propose a new blind certification protocol that provides interesting properties while remaining efficient.  It falls in the Groth-Sahai framework for WI proofs, thus extended to a certified signature it immediately yields non-frameable group signatures.  We then use it to build an efficient (offline) e-cash system that guarantees user anonymity and transferability of coins without increasing their size.  As required for fair e-cash, in case of fraud, anonymity can be revoked by an authority, which is also crucial to deter from double spending.

]]></description>
<guid>http://eprint.iacr.org/2009/146</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/129</link>
<title><![CDATA[Faster and Timing-Attack Resistant AES-GCM]]>, by Emilia Kasper and Peter Schwabe</title>
<description><![CDATA[We present a bitsliced implementation of AES encryption in counter mode for 
64-bit Intel processors. Running at 7.59 cycles/byte on a Core~2, it is up to 25% faster than previous implementations,
while simultaneously offering protection against timing attacks. In
particular, it is the only cache-timing-attack resistant
implementation offering competitive speeds for stream as well as for 
packet encryption: for 576-byte packets, we improve performance over
previous bitsliced implementations by more than a factor of 2. We also report more than 30%
improved speeds for lookup-table based Galois/Counter mode
authentication, achieving 10.68 cycles/byte for authenticated
encryption. Furthermore, we present the first constant-time
implementation of AES-GCM that has a reasonable speed of $21.99$
cycles/byte, thus offering a full suite of timing-analysis resistant software for authenticated encryption.


]]></description>
<guid>http://eprint.iacr.org/2009/129</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/122</link>
<title><![CDATA[Hardware Accelerator for the Tate Pairing in Characteristic Three Based on Karatsuba-Ofman Multipliers]]>, by Jean-Luc Beuchat and Jérémie Detrey and Nicolas Estibals and Eiji Okamoto and Francisco Rodríguez-Henríquez</title>
<description><![CDATA[This paper is devoted to the design of fast parallel accelerators
for the cryptographic Tate pairing in characteristic three over
supersingular elliptic curves. We propose here a novel hardware
implementation of Miller's loop based on a pipelined Karatsuba-Ofman
multiplier. Thanks to a careful selection of algorithms for computing the tower field arithmetic associated to the Tate pairing, we manage to keep the pipeline busy. We also describe the strategies we
considered to design our parallel multiplier. They are included in a
VHDL code generator allowing for the exploration of a wide range of
operators. Then, we outline the architecture of a coprocessor for
the Tate pairing over $\mathbb{F}_{3^m}$. However, a final
exponentiation is still needed to obtain a unique value, which is
desirable in most of the cryptographic protocols. We supplement our
pairing accelerator with a coprocessor responsible for this task. An
improved exponentiation algorithm allows us to save hardware
resources.

According to our place-and-route results on Xilinx FPGAs, our design
improves both the computation time and the area-time trade-off
compared to previoulsy published coprocessors.
]]></description>
<guid>http://eprint.iacr.org/2009/122</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/062</link>
<title><![CDATA[Deterministic Polynomial-Time Equivalence of Computing the CRT-RSA Secret Keys and Factoring]]>, by Subhamoy Maitra and Santanu Sarkar</title>
<description><![CDATA[Let $N = pq$ be the product of two large primes. Consider CRT-RSA with
the public encryption exponent $e$ and private decryption exponents $d_p, d_q$. It is well known that given any one of $d_p$ or $d_q$ (or both) one can factorize $N$ in probabilistic poly$(\log N)$ time with success probability almost equal to 1. Though this serves all the practical purposes, from theoretical point of view, this is not a deterministic polynomial time algorithm. In this paper, we present a lattice based deterministic poly$(\log N)$ time algorithm that uses both $d_p, d_q$ (in addition to the public information $e, N$) to factorize $N$.
]]></description>
<guid>http://eprint.iacr.org/2009/062</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/049</link>
<title><![CDATA[Extensions of the Cube Attack based on Low Degree Annihilators]]>, by Aileen Zhang, Chu-Wee Lim, Khoongming Khoo, Wei Lei and Josef Pieprzyk </title>
<description><![CDATA[At Crypto 2008, Shamir introduced a new algebraic attack called the cube attack,
which allows us to solve black-box polynomials if we are able to tweak the
inputs by varying an initialization vector. In a stream cipher setting where the filter function is known, we can 
extend it to the cube attack with annihilators: By applying the cube attack to 
Boolean functions for which we can find low-degree multiples (equivalently annihilators), 
the attack complexity can be improved. When the size of the filter function is smaller 
than the LFSR, we can improve the attack complexity further by considering a sliding window 
version of the cube attack with annihilators. Finally, we extend the cube attack to 
vectorial Boolean functions by finding implicit relations with low-degree polynomials.

]]></description>
<guid>http://eprint.iacr.org/2009/049</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/028</link>
<title><![CDATA[Realizing Hash-and-Sign Signatures under Standard Assumptions]]>, by Susan Hohenberger and Brent Waters</title>
<description><![CDATA[Currently, there are relatively few instances of ``hash-and-sign''
signatures in the standard model. Moreover, most current instances
rely on strong and less studied assumptions such as the Strong RSA
and q-Strong Diffie-Hellman assumptions.

In this paper, we present a new approach for realizing hash-and-sign
signatures in the standard model.  In our approach, a signer associates
each signature with an index i that represents how many signatures
that signer has issued up to that point. Then, to make use of this
association, we create simple and efficient techniques that restrict an
adversary which makes q signature requests to forge on an index no
greater than 2q.  Finally, we develop methods
for dealing with this restricted adversary.

Our approach requires that a signer maintains a small amount of state ---
a counter of the number of signatures issued. We achieve two new realizations
for hash-and-sign signatures respectively based on the RSA assumption
and the Computational Diffie-Hellman assumption in bilinear groups.


]]></description>
<guid>http://eprint.iacr.org/2009/028</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/026</link>
<title><![CDATA[Collision Attacks on NaSHA-384/512]]>, by Zhimin Li, Licheng Wang, Daofeng Li, Yixian Yang</title>
<description><![CDATA[NaSHA is a family of hash functions submitted by Markovski and
Mileva as a SHA-3 candidate. In this paper, we present a collision
attack on the hash function NaSHA for the output sizes 384-bit and
512-bit. This attack is based on the the weakness in the generate
course of the state words and the fact that the quasigroup operation
used in the compression function is only determined by partial state
words. Its time complexity is about $2^{128}$ with negligible memory
and its probability is more than $(1- \frac{2}{{2^{64} - 1}})^2$
($\gg \frac{1}{2}$). This is currently by far the best known
cryptanalysis result on this SHA-3 candidate.
]]></description>
<guid>http://eprint.iacr.org/2009/026</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/521</link>
<title><![CDATA[Generating Shorter Bases for Hard Random Lattices]]>, by Joel Alwen and Chris Peikert</title>
<description><![CDATA[We revisit the problem of generating a `hard' random lattice together
with a basis of relatively short vectors.  This problem has gained in
importance lately due to new cryptographic schemes that use such a
procedure to generate public/secret key pairs.  In these applications,
a shorter basis directly corresponds to milder underlying complexity
assumptions and smaller key sizes.

The contributions of this work are twofold.  First, we simplify and
modularize an approach originally due to Ajtai (ICALP 1999).  Second,
we improve the construction and its analysis in several ways, most
notably by making the output basis as short as possible (up to a small
constant factor).

]]></description>
<guid>http://eprint.iacr.org/2008/521</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/488</link>
<title><![CDATA[Efficient Rational Secret Sharing in Standard Communication Networks]]>, by Georg Fuchsbauer and Jonathan Katz and Eric Levieil and David Naccache</title>
<description><![CDATA[We propose a new methodology for rational secret sharing leading to various instantiations that are simple and efficient in terms of computation, share size, and round complexity. Our protocols do not require physical assumptions or simultaneous channels, and can even be run over asynchronous, point-to-point networks. 

Of additional interest, we propose new equilibrium notions for this setting (namely, computational versions of strict Nash equilibrium and stability with respect to trembles) and prove that our protocols satisfy them.
]]></description>
<guid>http://eprint.iacr.org/2008/488</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/424</link>
<title><![CDATA[Simple and Efficient Asynchronous  Byzantine Agreement with Optimal Resilience]]>, by Arpita Patra and Ashish Choudhary and C. Pandu Rangan</title>
<description><![CDATA[Consider a completely asynchronous network consisting of $n$ parties where every two parties are connected by
a private channel. An adversary ${\cal A}_t$ with {\it unbounded computing power} actively controls at most
$t = (\lceil \frac{n}{3} \rceil - 1)$ out of $n$ parties in Byzantine fashion. In this setting, we say that $\pi$ is
 a $t$-resilient,  $(1-\epsilon)$-terminating {\it Asynchronous Byzantine Agreement} (ABA) protocol, if $\pi$ satisfies
 all the properties of Byzantine Agreement (BA) in
 asynchronous settings tolerating ${\cal A}_t$ and  terminates (i.e every honest party terminates $\pi$) with
 probability at least $(1-\epsilon)$. In this work, we present a
new $t$-resilient,  $(1-\epsilon)$-terminating  ABA protocol which {\it privately}
 communicates ${\cal O}({\cal C} n^{6} \kappa)$  bits
and \textsf{A-casts}\footnote{ \textsf{A-Cast} is a primitive in asynchronous world, allowing a party
 to send the same value to all the other parties. Hence \textsf{A-Cast} in asynchronous world is the parallel notion
 of \textsf{broadcast} in synchronous world.}
   ${\cal O}({\cal C} n^{6} \kappa)$ bits, where $\epsilon = 2^{-\Omega(\kappa)}$ and
   ${\cal C}$ is the {\it expected running time} of the protocol.
Moreover, conditioned on the event that our ABA protocol terminates, it does so in constant expected time; i.e.,
 ${\cal C} = {\cal O}(1)$.
 Our ABA protocol is to be compared with the {\it only known} $t$-resilient,  $(1-\epsilon)$-terminating  ABA protocol of
\cite{CanettiSTOC93} in the same settings, which {\it privately} communicates ${\cal O}({\cal C} n^{11} \kappa^{4})$  bits
and \textsf{A-casts}  ${\cal O}({\cal C} n^{11} \kappa^2 \log(n))$ bits, where  $\epsilon = 2^{-\Omega(\kappa)}$
 and ${\cal C} = {\cal O}(1)$.
So our ABA achieves a huge gain in communication complexity in comparison to the ABA of \cite{CanettiSTOC93},
while keeping all other properties in place.
 In another landmark work, in PODC 2008,
 Abraham et. al \cite{DolevAsynchronousBAPODC2008} proposed a $t$-resilient,  $1$-terminating (called as
{\it almost-surely terminating} in \cite{DolevAsynchronousBAPODC2008})  ABA protocol which
 privately communicates ${\cal O}({\cal C} n^{6} \log{n})$  bits
and \textsf{A-casts}  ${\cal O}({\cal C} n^{6} \log{n})$ bits. But ABA protocol of Abraham et. al. takes polynomial
(${\cal C} = {\cal O}(n^2)$) expected time  to terminate. Hence the merits of our ABA protocol over the ABA of Abraham et. al.
are: (i) For any $\kappa < n^2 \log{n}$, our ABA is better in terms of communication complexity (ii)
conditioned on the event that our ABA protocol terminates, it does so in constant expected time (the constant
is independent of $n$, $t$ and $\kappa$), whereas ABA of Abraham et. al.
takes polynomial expected time.
 Summing up, in a practical scenario where a faster and communication efficient ABA protocol is required, our ABA
 fits the bill better than ABA protocols of \cite{CanettiSTOC93,DolevAsynchronousBAPODC2008}.


 For designing our ABA protocol, we present a novel and simple {\it asynchronous verifiable secret sharing} (AVSS) protocol
 which significantly improves the communication complexity of the only known AVSS protocol
 of \cite{CanettiSTOC93} in the same settings. We believe that our AVSS can be used in many other
 applications for improving communication complexity and hence is of independent interest.
]]></description>
<guid>http://eprint.iacr.org/2008/424</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/280</link>
<title><![CDATA[FPGA and ASIC Implementations of the $\eta_T$ Pairing in Characteristic Three]]>, by Jean-Luc Beuchat and Hiroshi Doi and Kaoru Fujita and Atsuo Inomata and Piseth Ith and Akira Kanaoka and Masayoshi Katouno and Masahiro Mambo and Eiji Okamoto and Takeshi Okamoto and Takaaki Shiga and Masaaki Shirase and Ryuji Soga and Tsuyoshi Takagi and Ananda Vithanage and Hiroyasu Yamamoto</title>
<description><![CDATA[Since their introduction in constructive cryptographic applications, pairings over (hyper)elliptic curves are at the heart of an ever increasing number of protocols. As they rely critically on efficient algorithms and implementations of pairing primitives, the study of hardware accelerators became an active research area.

In this paper, we propose two coprocessors for the reduced $\eta_T$ pairing introduced by Barreto {\it et al.} as an alternative means of computing the Tate pairing on supersingular elliptic curves. We prototyped our architectures on FPGAs. According to our place-and-route results, our coprocessors compare favorably with other solutions described in the open literature. We also present the first ASIC implementation of the reduced $\eta_T$ pairing.
]]></description>
<guid>http://eprint.iacr.org/2008/280</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/110</link>
<title><![CDATA[On the Design of Secure and Fast Double Block Length Hash Functions]]>, by Zheng Gong and Xuejia Lai and Kefei Chen</title>
<description><![CDATA[In this work the security of double block length hash functions with
rate 1, which are based on a block cipher with a block length of $n$
bits and a key length of $2n$ bits, is reconsidered.
Counter-examples and new attacks are presented on this general class
of fast double block length hash functions, which reveal unnoticed
flaws in the necessary conditions given by Satoh \textit{et al.} and
Hirose. Preimage and second preimage attacks are presented on
Hirose's two examples which were left as an open problem. Our
synthetic analysis show that all rate-1 hash functions in FDBL-II
are failed to be optimally (second) preimage resistant. The
necessary conditions are refined for ensuring a subclass of hash
functions in FDBL-II to be optimally secure against collision
attacks. In particular, one of Hirose's two examples, which
satisfies our refined conditions, is proven to be indifferentiable
from a random oracle in the ideal cipher model. The security results
are extended to a new class of double block length hash functions
with rate 1, where the key length of one block cipher used in the
compression function is equal to the block length, whereas the other
is doubled.
]]></description>
<guid>http://eprint.iacr.org/2008/110</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/392</link>
<title><![CDATA[Efficient Computationally Private Information Retrieval From Anonymity or Trapdoor Groups]]>, by Jonathan Trostle and Andy Parrish</title>
<description><![CDATA[A Private Information Retrieval (PIR) protocol allows a database user, or client, to obtain information from a database in a manner that prevents the database from knowing which data was retrieved. Although substantial progress has been made in the discovery of
computationally PIR (cPIR) protocols with reduced communication complexity, there has been relatively little work in reducing the
computational complexity of cPIR protocols. In particular, Sion \cite{sion} argues that existing cPIR protocols are slower than the trivial PIR protocol (in overall performance). In this paper, we present a new family of cPIR protocols with a variety of security and performance properties. Our protocols enable much lower CPU overhead for the database server. When the database is viewed as a bit sequence, only addition operations are performed by the database server. We can view our protocol as a middle ground between the trivial protocol (fastest possible computational complexity and slowest possible communication complexity) and protocols such as Gentry-Ramzan \cite{gentry} (fast communication complexity but slower computational complexity). This middle ground enjoys a much better overall performance. The security of the general version of our protocol depends on either a trapdoor group assumption or sender anonymity \cite{pfitzmann}, and we present two specialized versions, the first of which depends on the trapdoor group assumption, and the second which depends on the sender anonymity assumption. We may view both Gentry-Ramzan and our cPIR protocol as instances of a more general new construct: the \textit{trapdoor group}. In a trapdoor group, knowledge of the trapdoor allows efficient computation of an inversion problem, such as computing discrete logarithms. Without the trapdoor, it is computationally hard to solve the inversion problem. For our protocol, we assume, roughly speaking, that given only the elements $be_1, \ldots, be_t$ in the group $\Z_m$, where $e_i < m/t$ and t is small, it is hard to compute low order bits of the group order $m$. One version of our cPIR protocol depends only on sender anonymity, which to our knowledge, is the first cPIR protocol to depend only on an anonymity assumption. Our prototype implementation shows that our performance compares favorably with existing cPIR protocols.
]]></description>
<guid>http://eprint.iacr.org/2007/392</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/346</link>
<title><![CDATA[Secure multi-party computation on incomplete networks]]>, by Shailesh Vaya</title>
<description><![CDATA[  Secure multiparty computation of a multivariate function is a central problem in cryptography. It is known that secure multiparty computation can be realized by a set of $n$ parties iff the connectivity of the underlying (authenticated) communication network is more than twice the number of corrupted parties. This impossibility result makes secure multiparty computation far less applicable in practice, as most deployed networks have a much lower degree than $O(n)$ and one would ideally like to tolerate $\theta(n)$ corrupted parties.

  This work considers a model for (unconditional) secure multiparty computation for networks of low degrees in which authenticated channels are available between very few pairs of parties. Not all honest parties can achieve traditional security guarantees of multiparty computation for this setting. This formulation of secure multiparty computation, which permits some of the honest parties to be "sacrificed" is called almost everywhere secure computation. In this work we show how to realize a.e.s.c., on a few special families of incomplete networks, for the case of Byzantine corruptions.

]]></description>
<guid>http://eprint.iacr.org/2007/346</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/123</link>
<title><![CDATA[Obtaining a secure and efficient key agreement protocol from (H)MQV and NAXOS]]>, by Berkant Ustaoglu</title>
<description><![CDATA[LaMacchia, Lauter and Mityagin recently presented a strong security definition for authenticated key agreement strengthening the well-known Canetti-Krawczyk definition. They also described a protocol, called NAXOS, that enjoys a simple security proof in the new model. Compared to MQV and HMQV, NAXOS is less efficient and cannot be readily modified to obtain a one-pass protocol. On the other hand MQV does not have a security proof, and the HMQV security proof is extremely complicated.

This paper proposes a new authenticated key agreement protocol, called
CMQV (`Combined' MQV), which incorporates design principles from MQV,
HMQV and NAXOS.  The new protocol achieves the efficiency of HMQV and admits a natural one-pass variant. Moreover, we present a simple and intuitive proof that CMQV is secure in the LaMacchia-Lauter-Mityagin model.

]]></description>
<guid>http://eprint.iacr.org/2007/123</guid>
</item>
<item>
<link>http://eprint.iacr.org/2006/077</link>
<title><![CDATA[On Secret Sharing Schemes, Matroids and Polymatroids]]>, by Jaume Marti-Farre and Carles Padro</title>
<description><![CDATA[The complexity of a secret sharing scheme is defined as the ratio between the maximum length of the shares and the length of the secret. The optimization of this parameter for general access structures is an important and very difficult open problem in secret sharing. We explore in this paper the connections of this open problem with matroids and polymatroids.

Matroid ports were introduced by Lehman in 1964. A forbidden minor characterization of matroid ports was given by Seymour in 1976. These results are previous to the invention of secret sharing by Shamir in 1979. Important connections between ideal secret sharing schemes and matroids were discovered by Brickell and Davenport in 1991. Their results can be restated as follows: every ideal secret sharing scheme defines a matroid, and its access structure is a port of that matroid. In spite of this, the results by Lehman and Seymour and other subsequent results on matroid ports have not been noticed until now by the researchers interested in secret sharing.

Lower bounds on the optimal complexity of access structures can be found by taking into account that the joint Shannon entropies of a set of random variables define a polymatroid. We introduce a new parameter, which is denoted by $\kappa$, to represent the best lower bound that can be obtained by this method. We prove that every bound that is obtained by this technique for an access structure applies to its dual structure as well.

By using the aforementioned result by Seymour we obtain two new characterizations of matroid ports. The first one refers to the existence of a certain combinatorial configuration in the access structure, while the second one involves the values of the parameter $\kappa$ that is introduced in this paper. Both are related to bounds on the optimal complexity. As a consequence, we generalize the result by Brickell and Davenport by proving that, if the length of every share in a secret sharing scheme is less than 3/2 times the length of the secret, then its access structure is a matroid port. This generalizes and explains a phenomenon that was observed in several families of access structures.

Finally, we present a construction of linear secret sharing schemes for the ports of the Vamos matroid and the non-Desargues matroid, which do not admit any ideal secret sharing scheme. We obtain in this way upper bounds on their optimal complexity. These new bounds are a contribution on the search of examples of access structures whose optimal complexity lies between 1 and 3/2.
]]></description>
<guid>http://eprint.iacr.org/2006/077</guid>
</item>
</channel></rss>
