<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
<channel><title>Cryptology ePrint Archive</title>
<link>http://eprint.iacr.org/</link>
<description>Recently modified papers in the IACR Cryptology ePrint Archive</description>
<language>en-us</language>
<lastBuildDate>Thu, 15 May 2008 23:51:02 -0600</lastBuildDate>
<webMaster>webmaster@iacr.org</webMaster>
<managingEditor>eprint-editor@iacr.org</managingEditor>
<generator>None of your business</generator>
<ttl>60</ttl>
<item>
<link>http://eprint.iacr.org/2008/207</link>
<title><![CDATA[Efficient Receipt-Free Ballot Casting Resistant to Covert Channels]]>, by Ben Adida and C. Andrew Neff</title>
<description><![CDATA[We present an efficient, covert-channel-resistant, receipt-free ballot casting scheme that can be used by humans without trusted hardware. In comparison to the recent Moran-Naor proposal, our scheme produces a significantly shorter ballot, prevents covert channels in the ballot, and opts for statistical soundness rather than everlasting privacy (achieving both seems impossible). The human interface remains the same, based on Neff's MarkPledge scheme, and requires of the voter only short-string operations.
]]></description>
<guid>http://eprint.iacr.org/2008/207</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/206</link>
<title><![CDATA[Partial Fairness in Secure Two-Party Computation]]>, by Dov Gordon and Jonathan Katz</title>
<description><![CDATA[Complete fairness is impossible to achieve, in general, in secure two-party computation. In light of this, various techniques for obtaining \emph{partial} fairness in this setting have been suggested. We explore the possibility of achieving partial fairness with respect to a strong, simulation-based definition of security within the standard real/ideal world paradigm. We show feasibility with respect to this definition for randomized functionalities where each player may possibly receive a different output, as long as at least one of the domains or ranges of the functionality are polynomial in size. When one of the domains is polynomial size, our protocol is also secure-with-abort. In contrast to much of the earlier work on partial fairness, we rely on standard assumptions only (namely, enhanced trapdoor permutations).

We also provide evidence that our results are, in general, optimal. Specifically, we show a boolean function defined on a domain of super-polynomial size for which it is impossible to achieve both partial fairness and security with abort, and provide evidence that partial fairness is impossible altogether for functions whose domains and ranges all have super-polynomial size.
]]></description>
<guid>http://eprint.iacr.org/2008/206</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/205</link>
<title><![CDATA[On Software Parallel Implementation of Cryptographic Pairings]]>, by Philipp Grabher and Johann Groszschaedl and Dan Page</title>
<description><![CDATA[A significant amount of research has focused on methods to improve the
efficiency of cryptographic pairings; in part this work is motivated by the wide range of applications for such primitives.  Although numerous hardware accelerators for pairing evaluation have used parallelism within extension field arithmetic to improve efficiency, similar techniques have not been examined in software thus far.  In this paper we focus on parallelism within one pairing evaluation (intra-pairing), and parallelism between different pairing evaluations (inter-pairing).  We identify several methods for exploiting such parallelism (extending previous results in the context of ECC) and show that it is possible to accelerate pairing evaluation by a significant factor in comparison to a naive approach.

]]></description>
<guid>http://eprint.iacr.org/2008/205</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/204</link>
<title><![CDATA[Cryptanalysis of the Cai-Cusick Lattice-based Public-key Cryptosystem]]>, by Yanbin Pan and Yingpu Deng</title>
<description><![CDATA[In 1998, Cai and Cusick proposed a lattice-based public-key
cryptosystem based on the similar ideas of the Ajtai-Dwork
cryptosystem, but with much less data expansion. However, they
didn't give any security proof. In our paper, we present an
efficient ciphertext-only attack which runs in polynomial time
against the cryptosystem to recover the message, so the Cai-Cusick
lattice-based public-key cryptosystem is not secure. We also present
two chosen-ciphertext attacks to get a similar private key which
acts as the real private key.
]]></description>
<guid>http://eprint.iacr.org/2008/204</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/203</link>
<title><![CDATA[Privacy-Preserving Matching of DNA Profiles]]>, by Fons Bruekers and Stefan Katzenbeisser and Klaus Kursawe and Pim Tuyls</title>
<description><![CDATA[In the last years, DNA sequencing techniques have advanced to the
point that DNA identification and paternity testing has become almost
a commodity. Due to the critical nature of DNA related data, this
causes substantial privacy issues. In this paper, we introduce
cryptographic privacy enhancing protocols that allow to perform the
most common DNA-based identity, paternity and ancestry tests 
and thus implement privacy-enhanced online
genealogy services or research projects. In the semi-honest attacker
model, the protocols guarantee that no sensitive information about the
involved DNA is exposed, and are resilient against common forms of measurement
errors during DNA sequencing. The protocols are practical and efficient,
both in terms of communication and computation complexity.
]]></description>
<guid>http://eprint.iacr.org/2008/203</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/202</link>
<title><![CDATA[Polynomials for  Ate Pairing and $\mathbf{Ate}_{i}$ Pairing]]>, by Zhitu Su, Hui Li and JianFeng Ma</title>
<description><![CDATA[The irreducible factor $r(x)$ of $\mathrm{\Phi}_{k}(u(x))$ and $u(x)
$ are often used in constructing pairing-friendly curves. $u(x)$ and
$u_{c} \equiv u(x)^{c} \pmod{r(x)}$ are selected to be the Miller
loop control polynomial in Ate pairing and $\mathrm{Ate}_{i}$
pairing. In this paper we show that when $4|k$ or the minimal prime
which divides $k$ is larger than $2$, some $u(x)$ and $r(x)$ can not
be used as curve generation parameters if we want $\mathrm{Ate}_{i}$
pairing to be efficient. We also show that the Miller loop length
can not reach the bound $\frac{\mathrm{log_{2}r}}{\varphi(k)}$ when
we use the factorization of $\mathrm{\Phi}_{k}(u(x))$ to generate
elliptic curves.
]]></description>
<guid>http://eprint.iacr.org/2008/202</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/201</link>
<title><![CDATA[How To Ensure Forward and Backward Untraceability of RFID Identification Schemes By Using A Robust PRBG]]>, by J. Wu and D.R. Stinson</title>
<description><![CDATA[In this paper, we analyze an RFID identification scheme which is designed to provide forward untraceability and backward untraceability. We show that if a standard cryptographic pseudorandom bit generator (PRBG) is used in the scheme, then the scheme may fail to provide
forward untraceability and backward untraceability. To achieve the desired untraceability features, the scheme can use a robust PRBG which provides forward security and backward security. We also note that the backward security is stronger than necessary for the backward untraceability of the scheme.
]]></description>
<guid>http://eprint.iacr.org/2008/201</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/200</link>
<title><![CDATA[On The Security of The ElGamal Encryption Scheme and Damgard’s Variant]]>, by J. Wu and D.R. Stinson</title>
<description><![CDATA[In this paper, we discuss the security of the ElGamal encryption scheme and its variant by Damgard. For the ElGamal encryption, we show that (1) under the generalized knowledge-of-exponent assumption and the one-more discrete log assumption, ElGamal encryption is one-way under nonadaptive chosen cipher attacks; (2) one-wayness of ElGamal encryption under non-adaptive chosen cipher attacks is equivalent to the hardness of one-more computational Diffie-Hellman problem. For
a variant of ElGamal encryption proposed by Damgard (DEG), we give a new proof that DEG is semantically secure against non-adaptive chosen ciphertext attacks under the one-more decisional Diffie-Hellman assumption (although the same result for DEG security has been presented in the literature before, our proof is simpler). We also give a new security proof for DEG based on the decisional Diffie-
Hellman assumption (DDHA) and a weaker version of the knowledge-of-exponent assumption (KEA), and note that KEA is stronger than necessary in the security proof of DEG, for which KEA was originally proposed.
]]></description>
<guid>http://eprint.iacr.org/2008/200</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/199</link>
<title><![CDATA[Simultaneous field divisions: an extension of Montgomery's trick]]>, by David G. Harris</title>
<description><![CDATA[Montgomery's trick is a technique which can be used to quickly compute multiple field inversion simultaneously. We extend this technique to simultaneous field divisions (that is, combinations of field multiplications and field inversion). The generalized Montgomery's trick is faster in some fields than a simple inversion with Montgomery's trick followed by a simple field multiplication
]]></description>
<guid>http://eprint.iacr.org/2008/199</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/198</link>
<title><![CDATA[Security needs in embedded systems]]>, by Anoop MS</title>
<description><![CDATA[The paper discusses the hardware and software security requirements
in an embedded device that are involved in the transfer of secure digital data. The paper gives an overview on the security processes like encryption/decryption, key agreement, digital signatures and digital certificates that are used to achieve data protection during data transfer. The paper also discusses the security requirements in the device to prevent possible physical attacks to expose the secure data such as secret keys from the device. The paper also briefs on the security enforced in a device by the use of proprietary security technology and also discusses the security measures taken during the production of the device.
]]></description>
<guid>http://eprint.iacr.org/2008/198</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/197</link>
<title><![CDATA[Secure Multiparty Computation for Privacy-Preserving Data Mining]]>, by Yehuda Lindell and Benny Pinkas</title>
<description><![CDATA[In this paper, we survey the basic paradigms and notions of secure multiparty computation and discuss their relevance to the field of privacy-preserving data mining. In addition to reviewing definitions and constructions for secure multiparty computation, we discuss the issue of efficiency and demonstrate the difficulties involved in constructing highly efficient protocols. We also present common errors that are prevalent in the literature when secure multiparty computation techniques are applied to privacy-preserving data mining. Finally, we discuss the relationship between secure multiparty computation and privacy-preserving data mining, and show which problems it solves and which problems it does not.
]]></description>
<guid>http://eprint.iacr.org/2008/197</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/196</link>
<title><![CDATA[A New Family of Perfect Nonlinear Binomials]]>, by Zhengbang Zha and Gohar M. Kyureghyan and Xueli Wang</title>
<description><![CDATA[We prove that the binomials $x^{p^s+1}-\alpha x^{p^k+p^{2k+s}}$
define  perfect nonlinear mappings in $GF(p^{3k})$ for an appropriate choice of the integer $s$ and $\alpha \in GF(p^{3k})$. We show that these binomials are inequivalent to known perfect nonlinear monomials. As a consequence we obtain new commutative semifields for $p\geq 5$ and odd $k$.
]]></description>
<guid>http://eprint.iacr.org/2008/196</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/195</link>
<title><![CDATA[An Efficient and Provably-Secure Identity-based Signcryption Scheme for Multiple PKGs]]>, by Jin Zhengping and Zuo Huijuan and Du hongzhen and Wen Qiaoyan</title>
<description><![CDATA[In this paper, based on the scheme proposed by Barreto et al in ASIACRYPT 2005, an identity-based signcryption scheme in multiple Private Key Generator (PKG) environment is proposed, which mitigates the problems referred to users' private keys escrow and distribution in single PKG system. For security of the scheme, it is proved to satisfy the properties of message confidentiality and existential signature-unforgeability, assuming the intractability of the q-Strong Diffie-Hellman problem and the q-Bilinear Diffie-Hellman Inversion problem. For efficiency, compared with the state-of-the-art signcryption schemes of the same kind, our proposal needs less pairing computations and is shown to be the most efficient identity-based signcryption schemes for multiple PKGs up to date.
]]></description>
<guid>http://eprint.iacr.org/2008/195</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/194</link>
<title><![CDATA[Endomorphisms for faster elliptic curve cryptography on general curves]]>, by Steven D. Galbraith and Xibin Lin and Michael Scott</title>
<description><![CDATA[We present efficiently computable homomorphisms for general elliptic
curves by working over quadratic extensions. This allows point
multiplication to be accelerated using the Gallant-Lambert-Vanstone
method.  Our preliminary results give up to a 74 percent speedup for elliptic curve cryptography using general curves.  Further speedups are possible when using special curves.
]]></description>
<guid>http://eprint.iacr.org/2008/194</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/193</link>
<title><![CDATA[A Tamper-Evident Voting Machine Resistant to Covert Channels]]>, by Wei Han and Tao Hao and Dong Zheng and Ke-fei Chen and Xiaofeng Chen</title>
<description><![CDATA[To provide a high level of security guarantee cryptography is introduced into the design of the voting machine. The voting machine based on cryptography is vulnerable to attacks through covert channels. An adversary may inject malicious codes into the voting machine and make it leak vote information unnoticeably by exploiting the randomness used in encryptions and zero-knowledge proofs. In this paper a voting machine resistant to covert channels is designed. It has the following properties: Firstly, it is tamper-evident. The randomness used by the voting machine is generated by the election authority. The inconsistent use of the randomness can be detected by the voter from examining a destroyable verification code. Even if malicious codes are run in the voting machine attacks through subliminal channels are thwarted. Next, it is voter-verifiable. The voter has the ability to verify if the ballot cast by the machine is consistent with her intent without doing complicated cryptographic computation. Finally, the voting system is receipt-free. Vote-buying and coercion are prevented.
]]></description>
<guid>http://eprint.iacr.org/2008/193</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/192</link>
<title><![CDATA[Investigating the DPA-Resistance Property of Charge Recovery Logics]]>, by Amir Moradi and Mehrdad Khatir and Mahmoud Salmasizadeh and Mohammad T. Manzuri Shalmani</title>
<description><![CDATA[The threat of DPA attacks is of crucial importance when designing cryptographic hardware. As a result, several DPA countermeasures at the cell level have been proposed in the last years, but none of them offers perfect protection against DPA attacks. Moreover, all of these DPA-resistant logic styles increase the power consumption and the area consumption significantly. On the other hand, there are some logic styles which provide less power dissipation (so called charge recovery logic) that can be considered as a DPA countermeasure. In this article we examine them from the DPA-resistance point of view. As an example of charge recovery logic styles, 2N-2N2P is evaluated. It is shown that the usage of this logic style leads to an improvement of the DPA-resistance and at the same time reduces the energy consumption which make it especially suitable for pervasive devices. In fact, it is the first time that a proposed DPA-resistant logic style consumes less power than the corresponding standard CMOS circuit.
]]></description>
<guid>http://eprint.iacr.org/2008/192</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/191</link>
<title><![CDATA[Cryptanalysis of Self-Generated-Certificate Public Key Encryption without Pairing in PKC07]]>, by Xu An Wang and  Xiaoyuan Yang and Yiliang Han  </title>
<description><![CDATA[In PKC07, Junzuo Lai and Weidong Kou proposed a self-generated-certificate public key encryption without pairing scheme. In this paper, we show that this scheme cannot resist man-in-the-middle attack. We further point out the reason for successfully attacking is binding the user's secret key with the multiply of partial public key from KGC and user's self-generated public key instead of binding with partial public key from KGC and user's self-generated public key independently. At last, we give a rescue SGC-PKE scheme by giving little change to Lai and Kou's scheme which can resist this attack. 
]]></description>
<guid>http://eprint.iacr.org/2008/191</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/190</link>
<title><![CDATA[User-Sure-and-Safe Key Retrieval]]>, by Daniel R. L. Brown</title>
<description><![CDATA[In a key retrieval scheme, a human user interacts with a client
computer to retrieve a key.  A scheme is user-sure if any adversary
without access to the the user cannot distinguish the retrieved key
from a random key.  A scheme is user-safe if any adversary without
access to the client's keys, or simultaneous user and client access,
cannot exploit the user to distinguish the retrieved key from a random
key.  A multiple-round key retrieval scheme, where the user is given
informative prompts to which the user responds, is proved to be
user-sure and user-safe.
  
Remote key retrieval involves a keyless client and a remote, keyed
server.  User-sure and user-safe are defined similarly for remote key
retrieval.  The scheme is user-anonymous if the server cannot identify
the user.  A remote version of the multiple-round key retrieval scheme
is proved to be user-sure, user-safe and user-anonymous.

]]></description>
<guid>http://eprint.iacr.org/2008/190</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/189</link>
<title><![CDATA[How to Build a Hash Function from any Collision-Resistant Function]]>, by Thomas Ristenpart and Thomas Shrimpton</title>
<description><![CDATA[Recent collision-finding attacks against hash functions such as MD5 and SHA-1 motivate the use of provably collision-resistant (CR) functions in their place.  Finding a collision in a provably CR function implies the ability to solve some hard problem (e.g., factoring). Unfortunately, existing provably CR functions make poor replacements for hash functions as they fail to deliver behaviors demanded by practical use.  In particular, they are easily distinguished from a random oracle. We initiate an investigation into building hhash functions from provably CR functions.  As a method for achieving this, we present the Mix-Compress-Mix (MCM) construction; it envelopes any provably CR function H (with suitable regularity properties) between two injective ``mixing'' stages. The MCM construction simultaneously enjoys (1) provable collision-resistance in the standard model, and (2) indifferentiability from a monolithic random oracle when the mixing stages themselves are indifferentiable from a random oracle that observes injectivity. We instantiate our new design approach by specifying a blockcipher-based construction that appropriately realizes the mixing stages. 
]]></description>
<guid>http://eprint.iacr.org/2008/189</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/188</link>
<title><![CDATA[Information Leakage of Flip-Flops in DPA-Resistant Logic Styles]]>, by Amir Moradi and Thomas Eisenbarth and Axel Poschmann and Carsten Rolfes and Christof Paar and Mohammad T. Manzuri Shalmani and Mahmoud Salmasizadeh</title>
<description><![CDATA[This contribution discusses the information leakage of flip-flops for different DPA-resistant logic styles. We show that many of the proposed side-channel resistant logic styles still employ flip-flops that leak data-dependent information. Furthermore, we apply simple models for the leakage of masked flip-flops to design a new attack on circuits implemented using masked logic styles. Contrary to previous attacks on masked logic styles, our attack does not predict the mask bit and does not need detailed knowledge about the attacked device, e.g., the circuit layout. Moreover, our attack works even if all the load capacitances of the complementary logic signals are perfectly balanced and even if the PRNG is ideally unbiased. Finally, after performing the attack on DRSL, MDPL, and iMDPL circuits we show that single-bit masks do not influence the exploitability of the revealed leakage of the masked flip-flops.
]]></description>
<guid>http://eprint.iacr.org/2008/188</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/187</link>
<title><![CDATA[An Efficient and Provably Secure ID-Based Threshold Signcryption Scheme]]>, by Fagen Li and Yong Yu</title>
<description><![CDATA[Signcryption is a cryptographic primitive that performs digital
signature and public key encryption simultaneously, at a lower
computational costs and communication overheads than the
signature-then-encryption approach. Recently, two identity-based
threshold signcryption schemes[12],[26] have been
proposed by combining the concepts of identity-based threshold
signature and signcryption together. However, the formal models and
security proofs for both schemes are not considered. In this paper,
we formalize the concept of identity-based threshold signcryption
and give a new scheme based on the bilinear pairings. We prove its
confidentiality under the Decisional Bilinear Diffie-Hellman
assumption and its unforgeability under the Computational
Diffie-Hellman assumption in the random oracle model. Our scheme
turns out to be more efficient than the two previously proposed
schemes.
]]></description>
<guid>http://eprint.iacr.org/2008/187</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/186</link>
<title><![CDATA[Privacy-Preserving Audit and Extraction of Digital Contents]]>, by Mehul A. Shah and Ram Swaminathan and Mary Baker</title>
<description><![CDATA[A growing number of online services, such as Google, Yahoo!, and Amazon, are starting to charge users for their storage. Customers often use these services to store valuable data such as email, family photos and videos, and disk backups. Today, a customer must entirely trust such external services to maintain the integrity of hosted data and return it intact. Unfortunately, no service is infallible.

To make storage services accountable for data loss, we present protocols that allow a third-party auditor to periodically verify the data stored by a service and assist in returning the data intact to the customer. Most importantly, our protocols are privacy-preserving, in that they never reveal the data contents to the auditor. Our solution removes the burden of verification from the customer, alleviates both the customer’s and storage service’s fear of data leakage, and provides a method for independent arbitration of data retention contracts.
]]></description>
<guid>http://eprint.iacr.org/2008/186</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/184</link>
<title><![CDATA[On the Secure Obfuscation of Deterministic Finite Automata]]>, by W. Erik Anderson</title>
<description><![CDATA[In this paper, we show how to construct secure obfuscation for Deterministic Finite Automata, assuming non-uniformly strong one-way functions exist. We revisit the software protection approaches originally proposed by [B79,G87,GO96,K80] and revise them to the current obfuscation setting of Barak et al. [BGI+01]. Under this model, we introduce an efficient oracle that retains some ``small" secret about the original program. Using this secret, we can construct an obfuscator and two-party protocol that securely obfuscates Deterministic Finite Automata against malicious adversaries. The security of this model retains the strong ``virtual black box" property originally proposed in [BGI+01] while incorporating the stronger condition of dependent auxiliary inputs in [GTK05]. Additionally, we further show that our techniques remain secure under concurrent self-composition with adaptive inputs and that Turing machines are obfuscatable under this model.
]]></description>
<guid>http://eprint.iacr.org/2008/184</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/183</link>
<title><![CDATA[Preimage Attacks on 3-Pass HAVAL and Step-Reduced MD5]]>, by Jean-Philippe Aumasson and Willi Meier and Florian Mendel</title>
<description><![CDATA[  This paper presents preimage attacks for the hash functions 3-pass
  HAVAL and step-reduced MD5. Introduced in 1992 and 1991
  respectively, these functions underwent severe collision attacks,
  but no preimage attack. We describe two preimage attacks on the
  compression function of 3-pass HAVAL. The attacks have a complexity
  of about $2^{224}$ compression function evaluations instead of
  $2^{256}$. Furthermore, we present several preimage attacks on the
  MD5 compression function that invert up to 47 (out of 64) steps
  within $2^{96}$ trials instead of $2^{128}$. Though our attacks are
  not practical, they show that the security margin of 3-pass HAVAL
  and step-reduced MD5 with respect to preimage attacks is not as high
  as expected.


]]></description>
<guid>http://eprint.iacr.org/2008/183</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/181</link>
<title><![CDATA[Proofs of Knowledge with Several Challenge Values]]>, by Grzegorz Stachowiak</title>
<description><![CDATA[In this paper we consider the problem of increasing
the number of possible challenge values from 2 to $s$
in various zero-knowledge cut and choose protocols.
First we discuss doing this for graph isomorphism protocol.
Then we show how increasing this number improves efficiency
of protocols for double discrete logarithm
and $e$-th root of discrete logarithm.
Double discrete logarithm protocol is potentially a very useful
tool for constructing complex cryptographic protocols. 
Our protocol gives hope that it will find more applications than it has now.
]]></description>
<guid>http://eprint.iacr.org/2008/181</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/168</link>
<title><![CDATA[Possibility and impossibility results for selective decommitments]]>, by Dennis Hofheinz</title>
<description><![CDATA[The \emph{selective decommitment problem} can be described as follows: assume an adversary receives a number of commitments and then may request openings of, say, half of them. Do the unopened commitments remain secure? Although this question arose more than twenty years ago, no satisfactory answer could be presented so far. We answer the question in several ways:

 - If simulation-based security is desired (i.e., if we demand that the adversary's output can be simulated by a machine that does not see the unopened commitments), then security is \emph{not achievable} for noninteractive commitment schemes via blackbox reductions to standard cryptographic assumptions. \emph{However,} we show how to achieve security in this sense in two ways: with a non-blackbox reduction to one-way permutations, and with an interactive scheme whose security follows from a blackbox reduction to one-way permutations.

 - If only indistinguishability of the unopened commitments from random commitments is desired, then security is \emph{not achievable} for (interactive or noninteractive) perfectly binding commitment schemes, via blackbox reductions to standard cryptographic assumptions. \emph{However,} any statistically hiding scheme \emph{does} achieve security in this sense.

Our results give an almost complete picture when and how security under selective openings can be achieved. Applications of our results include:

 - Essentially, an encryption scheme \emph{must} be non-committing in order to achieve provable security against an adaptive adversary.

 - The zero-knowledge interactive proof system for graph 3-coloring due to \citeauthor{Goldreich:1991:Proofs} is composable in parallel.

 - We show the witness indistinguishability and composability of ``commit-choose-open'' style interactive proofs in a simple and elegant way.

On the technical side, we develop a technique to show very general impossibility results for blackbox proofs.

]]></description>
<guid>http://eprint.iacr.org/2008/168</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/146</link>
<title><![CDATA[Dynamic SHA-2]]>, by Xu Zijie</title>
<description><![CDATA[In this paper I describe the construction of Dynamic SHA-2 family of cryptographic hash functions. They are built with design components from the SHA-2 family, but I use the bits in message as parameters of function G, R and ROTR operation in the new hash functionh. It enabled us to achieve a novel design principle:  When message is changed, the calculation will be different. It make the system can resistant against all extant attacks.  
]]></description>
<guid>http://eprint.iacr.org/2008/146</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/142</link>
<title><![CDATA[Attacking Reduced Round SHA-256]]>, by Somitra Kumar Sanadhya and Palash Sarkar</title>
<description><![CDATA[              The SHA-256 hash function has started getting attention recently by the cryptanalysis community
due to the various weaknesses found in its predecessors such as MD4, MD5, SHA-0 and SHA-1. We make
two contributions in this work. First we describe message modification techniques and use them to obtain an
algorithm to generate message pairs which collide for the actual SHA-256 reduced to 18 steps. Our second
contribution is to present differential paths for 19, 20, 21, 22 and 23 steps of SHA-256. We construct parity
check equations in a novel way to find these characteristics. Further, the 19-step differential path presented here
is constructed by using only 15 local collisions, as against the previously known 19-step near collision differential
path which consists of interleaving of 23 local collisions. Our 19-step differential path can also be seen as a single
local collision at the message word level. We use a linearized local collision in this work. These results do not
cause any threat to the security of the SHA-256 hash function.

]]></description>
<guid>http://eprint.iacr.org/2008/142</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/110</link>
<title><![CDATA[On the Design of Secure Double Block Length Hash Functions with Rate 1]]>, by Zheng Gong and Xuejia Lai and Kefei Chen</title>
<description><![CDATA[This paper reconsiders the security of the rate-1 double block
length hash functions, which based on a block cipher with a block
length of $n$-bit and a key length of $2n$-bit. Two concrete
attacks are designed to break Hirose's two examples which were
left as an open problem. Counter-examples and new attacks are
presented on a general class of double block length hash functions
with rate 1, which disclose there exist uncovered flaws in the
former analysis by Satoh \textit{et al.} and Hirose. Some refined
conditions are proposed for ensuring this general class of the
rate-1 hash functions to be optimally secure against the collision
attack. In particular, two typical examples, which designed under
the proposed conditions, are proven to be indifferentiable from
the random oracle in the ideal cipher model. The security results
are extended to a new class of double block length hash functions
with rate 1, where one block cipher used in the compression
function has the key length is equal to the block length, while
the other is doubled.
]]></description>
<guid>http://eprint.iacr.org/2008/110</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/107</link>
<title><![CDATA[Private Branching Programs: On Communication-Efficient Cryptocomputing]]>, by Helger Lipmaa</title>
<description><![CDATA[We polish a recent cryptocomputing method that makes it possible to cryptocompute every language in $\mathbf{L/poly}$. We give several nontrivial applications, including: (a) A CPIR protocol with log-squared communication and sublinear server-computation by giving a secure function evaluation protocol for Boolean functions with similar performance, (b) A protocol that makes it possible to compute (say) how similar is client's input to an element in server's database, without revealing any information to the server, (c) A protocol for private database updating with low amortized complexity.
]]></description>
<guid>http://eprint.iacr.org/2008/107</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/079</link>
<title><![CDATA[Homomorphic Encryption with CCA Security]]>, by Manoj Prabhakaran and Mike Rosulek</title>
<description><![CDATA[We address the problem of constructing public-key encryption schemes that meaningfully combine useful {\em computability features} with {\em non-malleability}. In particular, we investigate schemes in which anyone can change an encryption of an unknown message $m$ into an encryption of $T(m)$ (as a {\em feature}), for a specific set of allowed functions $T$, but the scheme is ``non-malleable'' with respect to all other operations. We formulate precise definitions that capture these intuitive requirements and also show relationships among our new definitions and other more standard ones (IND-CCA, gCCA, and RCCA). We further justify our definitions by showing their equivalence to a natural formulation of security in the Universally Composable framework. We also consider extending the definitions to features which combine {\em multiple} ciphertexts, and show that a natural definition is unattainable for a useful class of features. Finally, we describe a new family of encryption schemes that satisfy our definitions for a wide variety of allowed transformations $T$, and which are secure under the standard Decisional Diffie-Hellman (DDH) assumption.
]]></description>
<guid>http://eprint.iacr.org/2008/079</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/026</link>
<title><![CDATA[Pairing-friendly Hyperelliptic Curves of Type $y^2=x^5+ax$]]>, by Mitsuru Kawazoe and Tetsuya Takahashi</title>
<description><![CDATA[An explicit construction of pairing-friendly hyperelliptic curves with ordinary Jacobians was firstly given by D.~Freeman.
In this paper, we give other explicit constructions of pairing-friendly hyperelliptic curves. Our methods are based on the closed formulae for the order of the Jacobian of a hyperelliptic curve of type $y^2=x^5+ax$ over a finite prime field ${¥mathbb F}_p$ which are given by E.~Furukawa, M.~Haneda, M.~Kawazoe and T.~Takahashi. 
We present two methods in this paper. One is an analogue of the Cocks-Pinch method and the other is a cyclotomic method. 
Our methods construct a pairing-friendly hyperelliptic curve $y^2=x^5+ax$ over ${¥mathbb F}_p$ whose Jacobian has a prescribed embedding degree with respect to some prime number $¥ell$.
Curves constructed by the analogue of the Cocks-Pinch method satisfy $p¥approx ¥ell^2$, whereas $p¥approx ¥ell^4$ in Freeman's construction. Moreover, for the case of embedding degree 24, we can construct a cyclotomic family with $p¥approx ¥ell^{3/2}$.
]]></description>
<guid>http://eprint.iacr.org/2008/026</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/023</link>
<title><![CDATA[General Certificateless Encryption and Timed-Release Encryption]]>, by Sherman S.M. Chow and Volker Roth and Eleanor G. Rieffel</title>
<description><![CDATA[Recent non-interactive timed-release encryption (TRE) schemes can be viewed as being supported by a certificateless encryption (CLE) mechanism. However, the security models of CLE and TRE differ and there is no generic transformation that turns a CLE into a TRE. In this paper, we give a generalized model for CLE that is also sufficient to fulfill the requirements of TRE.

Our model is secure against an adversary with adaptive trapdoor extraction capabilities for arbitrary identifiers (instead of selective identifiers), decryption capabilities for arbitrary public keys (as considered in strongly-secure CLE) and partial decryption capabilities (as considered in security-mediated certificateless encryption, or SMCLE). Our model also supports hierarchical identities, which have not been considered formally in paradigms of TRE and CLE.

We propose a concrete scheme under our
generalized model and prove it secure without random oracles. 
Our proposal yields the first strongly-secure SMCLE and 
the first TRE in the standard model. 
In addition, our technique of partial decryption is different from the previous approach.
]]></description>
<guid>http://eprint.iacr.org/2008/023</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/012</link>
<title><![CDATA[The Encrypted Elliptic Curve Hash]]>, by Daniel R. L. Brown</title>
<description><![CDATA[Bellare and Micciancio's MuHASH applies a pre-existing hash function
to map indexed message blocks into a secure group.  The resulting hash
is the product.  Bellare and Micciancio proved, in the random oracle
model, that MuHASH is collision-resistant if the group's discrete
logarithm problem is infeasible.  MuHASH, however, relies on a
pre-existing hash being collision resistant.  In this paper, we remove
such a reliance by replacing the pre-existing hash with a block cipher
under a fixed key.  We adapt Bellare and Micciancio's
collision-resistance proof to the ideal cipher model.  Preimage
resistance requires us to add a further modification.

]]></description>
<guid>http://eprint.iacr.org/2008/012</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/008</link>
<title><![CDATA[Factoring Polynomials for Constructing Pairing-friendly Elliptic Curves]]>, by Zhitu su, Hui Li and Jianfeng Ma</title>
<description><![CDATA[In this paper we present a new method to construct a polynomial
$u(x) \in \mathbb{Z}[x]$ which will make $\mathrm{\Phi}_{k}(u(x))$
reducible. We construct a finite separable extension of
$\mathbb{Q}(\zeta_{k})$, denoted as $\mathbb{E}$. By primitive
element theorem, there exists a primitive element $\theta \in
\mathbb{E}$ such that $\mathbb{E}=\mathbb{Q}(\theta)$. We represent
the primitive $k$-th root of unity $\zeta_{k}$ by $\theta$ and get a
polynomial $u(x) \in \mathbb{Q}[x]$ from the representation. The
resulting $u(x)$ will make $\mathrm{\Phi}_{k}(u(x))$ factorable.
]]></description>
<guid>http://eprint.iacr.org/2008/008</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/007</link>
<title><![CDATA[Efficient One-round Key Exchange in the Standard Model]]>, by Colin Boyd and Yvonne Cliff and Juan M. Gonzalez Nieto and Kenneth G. Paterson </title>
<description><![CDATA[We consider one-round identity-based key exchange protocols  secure
in the standard model. The security analysis uses the powerful security model of Canetti and
Krawczyk and a natural extension of it to the ID-based setting. It is shown how
 KEMs can be used in a generic way to obtain two different
protocol designs with progressively stronger security guarantees. A detailed
analysis of the performance of the protocols is included; surprisingly, when
instantiated with specific KEM constructions, the resulting protocols are
competitive with the best previous schemes that have proofs only in the random
oracle model.
]]></description>
<guid>http://eprint.iacr.org/2008/007</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/481</link>
<title><![CDATA[MAC-free variant of KD04]]>, by Xianhui Lu, Xuejia Lai, Dake He</title>
<description><![CDATA[Kurosawa and Desmedt proposed an efficient hybrid encryption scheme(KD04) which is secure
against adaptive chosen ciphertext attacks(IND-CCA) although the underlying KEM(key
encapsulation mechanism) is not IND-CCA secure\cite{Kurosawa2004}. We show a variant of
KD04 which is IND-CCA secure when the the underlying DEM part is IND-CCA secure. We need
a DEM built from one-time symmetric encryption scheme and a MAC in the security reduction
to check if the KEM part of a ciphertext is valid. However in the real situation we can
check if the KEM part of the ciphertext is valid without the help of the MAC. So the
hybrid encryption scheme can also use redundancy-free IND-CCA secure DEMs that avoid the
overhead due to the MAC. When using redundancy-free(MAC-free) IND-CCA secure DEMs, the
new scheme will be more efficient than KD04 in bandwidth.
]]></description>
<guid>http://eprint.iacr.org/2007/481</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/479</link>
<title><![CDATA[An Efficient Identification Protocol and the Knowledge-of-Exponent Assumption]]>, by J. Wu and D.R. Stinson</title>
<description><![CDATA[In this paper, we propose an extremely simple identification protocol and prove its security using the Knowledge-of-Exponent Assumption (KEA). We discuss the applicability of KEA in various protocol settings as well. Recently, doubts have been raised about applying KEA in some protocols where an adversary has auxiliary inputs. However, we suggest that KEA is applicable in these cases. We present two variants of KEA, Generalized KEA (GKEA) and Auxiliary-Input KEA (AI-KEA), to clarify the proper use of KEA.
]]></description>
<guid>http://eprint.iacr.org/2007/479</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/462</link>
<title><![CDATA[Construction of Universal Designated-Verifier Signatures and Identity-Based Signatures from Standard Signatures]]>, by Siamak F Shahandashti and Reihaneh Safavi-Naini</title>
<description><![CDATA[We give a generic construction for universal designated-verifier signature schemes from a large class, C, of signature schemes. The resulting schemes are efficient and have two important properties. Firstly, they are provably DV-unforgeable, non-transferable and also non-delegatable. Secondly, the signer and the designated verifier can independently choose their cryptographic settings. We also propose a generic construction for identity-based signature schemes from any signature scheme in C and prove that the construction is secure against adaptive chosen message and identity attacks. We discuss possible extensions of our constructions to hierarchical identity-based signatures, identity-based universal designated verifier signatures, and identity-based ring signatures from any signature in C. 
]]></description>
<guid>http://eprint.iacr.org/2007/462</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/461</link>
<title><![CDATA[Verifiable Attribute-based Encryption]]>, by QiangTang and Dongyao Ji</title>
<description><![CDATA[Abstract. In this paper, we construct two verifiable attribute-based encryption schemes. One is for a single authority ABE, and the other is for a multi authority ABE. Not only our schemes are proved secure as the previous ABE schemes, they also provide a verifiable property. Adding the verification property has at least two advantages: first, it allows the user to immediately check the correctness of the keys which later would be used to decrypt all authorized ciphertexts at any time, and second, if the keys pass the verification but the user still does not rightly decrypt out the message, something might be wrong with the attributes or ciphertexts. We formalize the notion of verifiable attribute-based encryption and prove our schemes in our model.
]]></description>
<guid>http://eprint.iacr.org/2007/461</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/441</link>
<title><![CDATA[Faster Group Operations on Elliptic Curves]]>, by Huseyin Hisil and Kenneth Koon-Ho Wong and Gary Carter and Ed Dawson</title>
<description><![CDATA[This paper is on improving implementation techniques of Elliptic Curve Cryptography. We introduce new addition formulae for Jacobi-quartic, Edwards, Hessian forms and new doubling formulae for Jacobi-quartic and Jacobi-intersection forms of elliptic curves. The new formulae speed up the group operations for each of these forms on suitable coordinate systems. To show this, a comparison is made in respect to their performance evaluations with classic point multiplication algorithms using the previous and current operation counts. The most significant outcomes are obtained from the modified Jacobi-quartic coordinates which provide the fastest timings for most point multiplication strategies and the fastest unified addition which costs 7M+3S+1D. The new unified addition formulae can be used to provide a natural way to protect against side channel attacks which are based on simple power analysis (SPA). 

(M: The cost of field multiplication, S: The cost of field squaring, D: The cost of multiplication by a curve constant.) 

]]></description>
<guid>http://eprint.iacr.org/2007/441</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/242</link>
<title><![CDATA[Time-Memory-Data Trade-off Attack on Stream Ciphers based on Maiorana-McFarland Functions]]>, by Khoongming Khoo, Guanhan Chew, Guang Gong and Hian-Kiat Lee</title>
<description><![CDATA[In this paper, we present the time-memory-data (TMD) trade-off attack on stream ciphers filtered by Maiorana-McFarland functions. This can be considered as a generalization of the time-memory-data trade-off attack of Mihaljevic and Imai on Toyocrypt. First, we substitute the filter function in Toyocrypt (which has the same size as the LFSR) with a general Maiorana-McFarland function. This allows us to apply the attack to a wider class of stream ciphers. Second, we highlight how the choice of different Maiorana-McFarland functions can affect the effectiveness of our attack. Third, we show that the attack can be modified to apply on filter functions which are smaller than the LFSR and on filter-combiner stream ciphers. This allows us to cryptanalyze other configurations commonly found in practice. Finally, filter functions with vector output are sometimes used in stream ciphers to improve the throughput. Therefore the case when the Maiorana-McFarland functions have vector output is investigated. We found that the extra speed comes at the price of additional weaknesses which make the attacks easier.

]]></description>
<guid>http://eprint.iacr.org/2007/242</guid>
</item>
<item>
<link>http://eprint.iacr.org/2007/235</link>
<title><![CDATA[Blind Identity-Based Encryption and Simulatable Oblivious Transfer]]>, by Matthew Green and Susan Hohenberger</title>
<description><![CDATA[In an identity-based encryption (IBE) scheme, there is a {\em key extraction} protocol where a user submits an identity string to a master authority who then returns the corresponding secret key for that identity.   In this work, we describe how this protocol can be performed efficiently and in a {\em blind} fashion for several known IBE schemes; that is, a user can obtain a secret key for an identity without the master authority learning anything about this identity.

We formalize this notion as {\em blind IBE} and discuss the many practical applications of such a scheme.  In particular, we build upon the recent work of Camenisch, Neven, and shelat in Eurocrypt 2007 to construct oblivious transfer (OT) schemes which achieve full simulatability for both sender and receiver.  OT constructions with comparable efficiency prior to Camenisch et al.\ were proven secure in the weaker half-simulation model.   Our OT schemes can be constructed generically from any blind IBE, and thus require only static complexity assumptions (e.g., DBDH) whereas prior comparable schemes require dynamic complexity assumptions (e.g., $q$-PDDH).
]]></description>
<guid>http://eprint.iacr.org/2007/235</guid>
</item>
<item>
<link>http://eprint.iacr.org/2006/307</link>
<title><![CDATA[Note on Design Criteria for Rainbow-Type Multivariates]]>, by Jintai Ding and Lei Hu and Bo-Yin Yang and Jiun-Ming Chen</title>
<description><![CDATA[  This was a short note that deals with the design of Rainbow or
  ``stagewise unbalanced oil-and-vinegar'' multivariate signature
  schemes.  We exhibit new cryptanalysis for current schemes that
  relates to flawed choices of system parameters in current schemes.

  These can be ameliorated according to an updated list of security
  design criteria.
]]></description>
<guid>http://eprint.iacr.org/2006/307</guid>
</item>
<item>
<link>http://eprint.iacr.org/2004/374</link>
<title><![CDATA[A general quantitative cryptanalysis of permutation-only multimedia ciphers against plaintext attacks]]>, by Shujun Li and Chengqing Li and Guanrong Chen and Nikolaos G. Bourbakis and Kwok-Tung Lo</title>
<description><![CDATA[In recent years secret permutations have been widely used for protecting different types of multimedia data, including speech files, digital images and videos. Based on a general model of permutation-only multimedia ciphers, this paper performs a quantitative cryptanalysis on the performance of these kind of ciphers against plaintext attacks. When the plaintext is of size $M\times N$ and with $L$ different levels of values, the following quantitative cryptanalytic findings have been concluded under the assumption of a uniform distribution of each element in the plaintext: 1) all permutation-only multimedia ciphers are practically insecure against known/chosen-plaintext attacks in the sense that only $O(log_L(MN))$ known/chosen plaintexts are sufficient to recover not less than (in an average sense) half elements of the plaintext; 2) the computational complexity of the known/chosen-plaintext attack is only $O(n\cdot(MN)^2)$, where n is the number of known/chosen plaintexts used. When the plaintext has a non-uniform distribution, the number of required plaintexts and the computational complexity is also discussed. Experiments are given to demonstrate the real performance of the known-plaintext attack for a typical permutation-only image cipher.
]]></description>
<guid>http://eprint.iacr.org/2004/374</guid>
</item>
</channel></rss>
