<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
<channel><title>Cryptology ePrint Archive</title>
<link>http://eprint.iacr.org/</link>
<description>Recently modified papers in the IACR Cryptology ePrint Archive</description>
<language>en-us</language>
<lastBuildDate>Tue, 18 Jun 2013 20:31:02 -0600</lastBuildDate>
<webMaster>webmaster@iacr.org</webMaster>
<managingEditor>eprint-editor@iacr.org</managingEditor>
<generator>None of your business</generator>
<ttl>60</ttl>
<item>
<link>http://eprint.iacr.org/2013/399</link>
<title><![CDATA[Attack on Liao and Hsiao's Secure ECC-based RFID Authentication Scheme integrated with ID-Verifier Transfer Protocol]]>, by Roel Peeters and Jens Hermans</title>
<description><![CDATA[We show that the Liao and Hsiao's protocol achieves neither tag-authentication nor privacy.
]]></description>
<guid>http://eprint.iacr.org/2013/399</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/398</link>
<title><![CDATA[ASICS: Authenticated Key Exchange Security Incorporating Certification Systems]]>, by Colin Boyd and Cas Cremers and Michèle Feltz and Kenneth G. Paterson and Bertram Poettering and Douglas Stebila</title>
<description><![CDATA[Most security models for authenticated key exchange (AKE) do not explicitly model the associated certification system, which includes the certification authority (CA) and its behaviour. However, there are several well-known and realistic attacks on AKE protocols which exploit various forms of malicious key registration and which therefore lie outside the scope of these models. We provide the first systematic analysis of AKE security incorporating certification systems (ASICS). We define a family of security models that, in addition to allowing different sets of standard AKE adversary queries, also permit the adversary to register arbitrary bitstrings as keys. For this model family we prove generic results that enable the design and verification of protocols that achieve security even if some keys have been produced maliciously. Our approach is applicable to a wide range of models and protocols; as a concrete illustration of its power, we apply it to the CMQV protocol in the natural strengthening of the eCK model to the ASICS setting.

]]></description>
<guid>http://eprint.iacr.org/2013/398</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/397</link>
<title><![CDATA[Practical Secure Logging: Seekable Sequential Key Generators]]>, by Giorgia Azzurra Marson and Bertram Poettering</title>
<description><![CDATA[In computer forensics, log files are indispensable resources that support auditors in identifying and understanding system threats and security breaches. If such logs are recorded locally, i.e., stored on the monitored machine itself, the problem of log authentication arises: if a system intrusion takes place, the intruder might be able to manipulate the log entries and cover her traces. Mechanisms that cryptographically protect collected log messages from manipulation should ideally have two properties: they should be *forward-secure* (the adversary gets no advantage from learning current keys when aiming at forging past log entries), and they should be *seekable* (the auditor can verify the integrity of log entries in any order or access pattern, at virtually no computational cost).

We propose a new cryptographic primitive, a *seekable sequential key generator* (SSKG), that combines these two properties and has direct application in secure logging. We rigorously formalize the required security properties and give a provably-secure construction based on the integer factorization problem. We further optimize the scheme in various ways, preparing it for real-world deployment. As a byproduct, we develop the notion of a *shortcut one-way permutation* (SCP), which might be of independent interest.

Our work is highly relevant in practice. Indeed, our SSKG implementation has become part of the logging service of the systemd system manager, a core component of many modern commercial Linux-based operating systems.

]]></description>
<guid>http://eprint.iacr.org/2013/397</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/396</link>
<title><![CDATA[On the Practical Security of a Leakage Resilient Masking Scheme]]>, by Emmanuel Prouff and Matthieu Rivain and Thomas Roche</title>
<description><![CDATA[At TCC 2012, Dziembowski and Faust show how to construct leakage resilient circuits using secret sharing based on the inner product [2]. At Asiacrypt 2012, Ballash et al. turned the latter construction into an efficient masking scheme and they apply it to protect an implementation of AES against side-channel attacks [1]. The so-called Inner-Product masking (IPmasking for short) was claimed to be secure with respect to two different security models: the $\lambda$-limited security model (Section 4 of [1]), and the dth-order security model (see definitions p.8 of [1]). In the former model, the security proof makes sense for a sharing dimension $n > 130$ which is acknowledged impractical by the authors. In the latter model, the scheme is claimed secure up to the order $d = n-1$. In this note, we contradict the dth-order security claim by exhibiting a 1st-order flaw in the masking algorithm for any chosen sharing dimension n.
]]></description>
<guid>http://eprint.iacr.org/2013/396</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/395</link>
<title><![CDATA[Pickle: A HASH Design]]>, by Lan Luo and Yalan Ye and Zehui Qu and Sharon Goldberg and Xan Du</title>
<description><![CDATA[For make the cryptography design eatable and popular,
we design the pickle HASH carefully. The pickle can deal large
data into HASH value with 1024bytes block quickly. There are
normal mode and operation mode of pickle from Keccak and
Shabal respectively. The nonlinear transformation is from 3fish of
Skein, which is only use up the MIX function. The pickle is speed
up because of no memory operation mode. The core function P is 8
times MIX without linear permutation and subkey involving in. So,
the full pickle is similar to the interlace code plus a little bit
nonlinear function. The nonlinear character is equal to the Skein
so that we consider it's secure. The output from filter function
strong the linear character of pickle.
]]></description>
<guid>http://eprint.iacr.org/2013/395</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/394</link>
<title><![CDATA[A Public Key Cryptoscheme Using the Bit-pair Method]]>, by Shenghui Su and Maozhi Xu and Shuwang Lu</title>
<description><![CDATA[The authors give the definition of a bit-pair shadow, and design the three algorithms of a public key cryptoscheme called JUNA which regards a bit-pair as an operation unit, and is based on the multivariate permutation problem (MPP) and the anomalous subset product problem (ASPP). Then, demonstrate the correctness of the decryption algorithm, deduce the probability that a plaintext solution is nonunique is nearly zero, and analyze the security of the cryptoscheme against extracting a private key from a public key, and recovering a plaintext from a ciphertext on the assumption that IFP, DLP, and SSP can be solved efficiently. Besides, give the conversion from the ASPP to the anomalous subset sum problem (ASSP) through a discrete logarithm. The facts show the bit-pair method increases the density of a related ASSP knapsack with D > 1, and decreases the length of modulus of the cryptoscheme with lg M = 384, 464, 544, or 640 corresponding to n = 80, 96, 112, or 128.
]]></description>
<guid>http://eprint.iacr.org/2013/394</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/393</link>
<title><![CDATA[Strongly Secure One-round Group Authenticated Key Exchange in the Standard Model]]>, by Yong Li and Zheng Yang</title>
<description><![CDATA[One-round group authenticated key exchange (GAKE) protocols typically provide implicit authentication and appealing bind-width efficiency. As a special case of GAKE -- the pairing-based one-round tripartite authenticated key exchange (3AKE), recently gains much attention of research community due to its strong security. Several pairing-based one-round 3AKE protocols have recently been proposed to achieve provable security in the g-eCK model. In contrast to earlier GAKE models, the g-eCK model particularly formulates the security properties regarding resilience to the leakage of various combinations of long-term key and ephemeral session state, and provision of weak perfect forward secrecy in a single model. However, the g-eCK security proofs of previous protocols are only given under the random oracle model. In this work, we give a new construction for pairing-based one-round 3AKE protocol which is provably secure in the g-eCK model without random oracles. Security of proposed protocol is reduced to the hardness of Cube Bilinear Decisional Diffie-Hellman (CBDDH) problem for symmetric pairing. We also extend the proposed 3AKE scheme to a GAKE scheme with more than three group members, based on multilinear maps. We prove g-eCK security of our GAKE scheme in the standard model under the natural multilinear generalization of the CBDDH assumption.
]]></description>
<guid>http://eprint.iacr.org/2013/393</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/392</link>
<title><![CDATA[Efficient Simultaneous Privately and Publicly Verifiable Robust Provable Data Possession from Elliptic Curves]]>, by Christian Hanser and Daniel Slamanig</title>
<description><![CDATA[When outsourcing large sets of data to the cloud, it is desirable for clients to efficiently check, whether all outsourced data is still retrievable at any later point in time without requiring to download all of it. Provable data possession (PDP)/proofs of retrievability (PoR), for which various constructions exist, are concepts to solve this issue. Interestingly, by now, no PDP/PoR scheme leading to an efficient construction supporting both private and public verifiability simultaneously is known. In particular, this means that up to now all PDP/PoR schemes either allow public or private verifiability exclusively, since different setup procedures and metadata sets are required. However, supporting both variants simultaneously seems interesting, as publicly verifiable schemes are far less efficient than privately verifiable ones. In this paper, we propose the first simultaneous privately and publicly verifiable (robust) PDP protocol, which allows the data owner to use the more efficient private verification and anyone else to run the public verification algorithm. Our construction, which is based on elliptic curves, achieves this, as it uses the same setup procedure and the same metadata set for private and public verifiability. We provide a rigorous security analysis and prove our construction secure in the random oracle model under the assumption that the elliptic curve discrete logarithm problem is intractable. We give detailed comparisons with the most efficient existing approaches for either private or public verifiability with our proposed scheme in terms of storage and communication overhead, as well as computational effort for the client and the server. Our analysis shows that for choices of parameters, which are relevant for practical applications, our construction outperforms all existing privately and publicly verifiable schemes significantly. This means, that even when our construction is used for either private or public verifiability alone, it still outperforms the most efficient constructions known, which is particularly appealing in the public verifiability setting.

]]></description>
<guid>http://eprint.iacr.org/2013/392</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/391</link>
<title><![CDATA[Key Recovery Attacks on 3-round Even-Mansour, 8-step LED-128, and Full $\mbox{AES}^{2}$]]>, by Itai Dinur and Orr Dunkelman and Nathan Keller and Adi Shamir</title>
<description><![CDATA[The Even-Mansour (EM) encryption scheme received a lot of attention in the last couple of years due to its exceptional simplicity and tight security proofs.
The original $1$-round construction was naturally generalized into $r$-round structures with one key, two alternating keys, and completely independent keys.
In this paper we describe the first key recovery attack on the one-key 3-round version of EM which is asymptotically faster than exhaustive search
(in the sense that its running time is $o(2^n)$ rather than $O(2^n)$ for an $n$-bit key).
We then use the new cryptanalytic techniques in order to improve the best known
attacks on several concrete EM-like schemes. In the case of LED-128, the best previously known attack could only be applied to 6 of its 12 steps. In this paper we develop a new attack which increases the number of attacked steps to 8, is slightly faster than the previous attack on 6 steps, and uses about a thousand times less data.
Finally, we describe the first attack on the full $\mbox{AES}^{2}$ (which uses two complete AES-128 encryptions and three independent $128$-bit keys, and looks exceptionally strong) which is about 7 times faster than a standard meet-in-the-middle attack, thus violating its security claim.

]]></description>
<guid>http://eprint.iacr.org/2013/391</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/390</link>
<title><![CDATA[Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption]]>, by Keita Emura and Goichiro Hanaoka and Koji Nuida and Go Ohtake and Takahiro Matsuda and Shota Yamada</title>
<description><![CDATA[In homomorphic encryption schemes, anyone can perform homomorphic operations, and therefore, it is difficult to manage when, where and by whom they are performed. In addition, the property that anyone can \lq\lq freely'' perform the operation inevitably means that ciphertexts are malleable, and it is well-known that adaptive chosen ciphertext (CCA) security and the homomorphic property can never be achieved simultaneously. 
In this paper, we show that CCA security and the homomorphic property can be simultaneously handled in situations that the user(s) who can perform homomorphic operations on encrypted data should be controlled/limited, and propose a new concept of homomorphic public-key encryption, which we call \emph{keyed-homomorphic public-key encryption} (KH-PKE). By introducing a secret key for homomorphic operations, we can control who is allowed to perform the homomorphic operation. To construct KH-PKE schemes, we introduce a new concept, a \emph{homomorphic transitional universal hash family}, and present a number of KH-PKE schemes through hash proof systems. We also present a practical construction of KH-PKE from the DDH assumption. For $\ell$-bit security, our DDH-based scheme yields only $\ell$-bit longer ciphertext size than that of the Cramer-Shoup PKE scheme. 
]]></description>
<guid>http://eprint.iacr.org/2013/390</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/389</link>
<title><![CDATA[A Capacity-Achieving Simple Decoder for Bias-Based Traitor Tracing Schemes]]>, by Jan-Jaap Oosterwijk and Boris \v{S}kori\'c and Jeroen Doumen </title>
<description><![CDATA[We investigate alternative suspicion functions for bias-based traitor tracing schemes, and present a practical construction of a simple decoder that attains capacity in the limit of large coalition size $c$.

We derive optimal suspicion functions in both the Restricted-Digit Model and the Combined-Digit Model. These functions depend on information that is usually not available to the tracer -- the attack strategy or the tallies of the symbols received by the colluders. We discuss how such results can be used in realistic contexts.

We study several combinations of coalition attack strategy versus suspicion function optimized against some attack (another attack or the same). In many of these combinations the usual codelength scaling $\ell \propto c^2$ changes to a lower power of $c$, e.g. $c^{3/2}$. We find that the interleaving strategy is an especially powerful attack. The suspicion function tailored against interleaving is the key ingredient of the capacity-achieving construction.

]]></description>
<guid>http://eprint.iacr.org/2013/389</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/388</link>
<title><![CDATA[Parallel Gauss Sieve Algorithm: Solving the SVP in the Ideal Lattice of 128 dimensions]]>, by Tsukasa Ishiguro and Shinsaku Kiyomoto and Yutaka Miyake and Tsuyoshi Takagi</title>
<description><![CDATA[In this paper, we report that we have solved the shortest vector problem (SVP) over a 128-dimensional lattice, which is currently the highest dimension of the SVP that has ever been solved. The security of lattice-based cryptography is based on the hardness of solving the SVP in lattices. In 2010 Micciancio \textit{et al.} proposed a Gauss Sieve algorithm for heuristically solving the SVP using list $L$ of Gauss-reduced vectors. Milde \textit{et al.} proposed a parallel implementation method for the Gauss Sieve algorithm. However, the efficiency of more than 10 threads in their implementation decreases due to a large number of non-Gauss-reduced vectors appearing in the distributed list of each thread. In this paper, we propose a more practical parallelized Gauss Sieve algorithm. Our algorithm deploys an additional Gauss-reduced list $V$ of sample vectors assigned to each thread, and all vectors in list $L$ remain Gauss-reduced by mutually reducing them using all sample vectors in $V$. Therefore, our algorithm enables the Gauss Sieve algorithm to run without excessive overhead even in a large-scale parallel computation of more than 1,000 threads. Moreover, for speed-up, we use the bi-directional rotation structure of an ideal lattice that makes the generation of additional vectors in the list with almost no additional overhead. Finally, we have succeeded in solving the SVP over a 128-dimensional ideal lattice generated by cyclotomic polynomial $x^{128}+1$ using about 30,000 CPU hours.
]]></description>
<guid>http://eprint.iacr.org/2013/388</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/387</link>
<title><![CDATA[Cryptographically Protected Prefixes for Location Privacy in IPv6]]>, by Jonathan Trostle and Hosei Matsuoka and James Kempf and Toshiro Kawahara and Ravi Jain</title>
<description><![CDATA[There is a growing concern with preventing unauthorized agents from discovering the geographical location of Internet users, a kind of security called location privacy. Typical deployments of IPv6 make it possible to deduce the approximate geographical location of a device from its IPv6 address. We present a scheme called Cryptographically Protected Prefixes (CPP), to address this problem at the level of IPv6 addressing and forwarding. CPP randomizes the address space of a defined topological region (privacy domain), thereby making it infeasible to infer location information from an IP address.
CPP can be deployed incrementally. We present an adversary model and show that CPP is secure within the model, assuming the existence of pseudorandom functions. We have implemented CPP as a pre-processing step within the forwarding algorithm in the FreeBSD 4.8 kernel. Our performance testing indicates that CPP pre-processing results in a 40-50 percent overhead for packet forwarding in privacy domain routers. The additional end to end per packet delay is roughly 20 to 60 microseconds. We also give an attack against the address encryption scheme in [Raghavan et al. 2009]. We show that the CPP forwarding algorithm is resilient in the event of network failures.
]]></description>
<guid>http://eprint.iacr.org/2013/387</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/386</link>
<title><![CDATA[Side Channel Attacks against Pairing over Theta Functions]]>, by Nadia El Mrabet</title>
<description><![CDATA[In \cite{LuRo2010}, Lubicz and Robert generalized the Tate pairing over any abelian variety and more precisely over Theta functions. The security of the new algorithms is an important issue for the use of practical cryptography. Side channel attacks are powerful attacks, using the leakage of information to reveal sensitive data. The pairings over elliptic curves were sensitive to side channel attacks. In this article, we study the weaknesses of the Tate pairing over Theta functions when submitted to side channel attacks.
]]></description>
<guid>http://eprint.iacr.org/2013/386</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/385</link>
<title><![CDATA[Cryptanalysis of ultralightweight RFID authentication protocol]]>, by Umar Mujahid, M.Najam-ul-islam, Jameel Ahmed, Usman Mujahid</title>
<description><![CDATA[Radio frequency identification (RFID) technology is one of the most emerging technologies in the field of pervasive systems, which provides the automatic identification of the object with non-line of sight capability. RFID is much better than its contending identification scheme (Bar code) in terms of efficiency and functional haste. Although it offers many advantages over other identification schemes but there are also allied security apprehensions, so to make the system secure in a cost effective manner we use ultralightweight authentication protocols. In this letter, a desynchornization attack has been presented on recently published ultralightweight authentication protocol RAPP (RFID authentication protocol with permutation). Then an advanced version of RAPP has also been proposed to combat against the desynchronization attack.
]]></description>
<guid>http://eprint.iacr.org/2013/385</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/384</link>
<title><![CDATA[Sequential Aggregate Signatures Made Shorter]]>, by Kwangsu Lee and Dong Hoon Lee and Moti Yung</title>
<description><![CDATA[Sequential aggregate signature (SAS) is a special type of public-key signature that allows a signer to add his signature into a previous aggregate signature in sequential order. In this case, since many public keys are used and many signatures are employed and compressed, it is important to reduce the sizes of signatures and public keys. Recently, Lee, Lee, and Yung (PKC 2013) proposed an efficient SAS scheme with short public keys and proved its security without random oracles under static assumptions.

In this paper, we propose an improved SAS scheme that has a shorter signature size compared with that of Lee et al.'s SAS scheme. Our SAS scheme is also secure without random oracles under static assumptions. To achieve the improvement, we devise a new public-key signature scheme that supports multi-users and public re-randomization. Compared with the SAS scheme of Lee et al., our SAS scheme employs new techniques which allow us to reduce the size of signatures by increasing the size of the public keys (obviously, since signature compression is at the heart of aggregate signature this is a further step in understanding the aggregation capability of such schemes).
]]></description>
<guid>http://eprint.iacr.org/2013/384</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/383</link>
<title><![CDATA[Lattice Signatures and Bimodal Gaussians]]>, by Léo Ducas and Alain Durmus and Tancrède Lepoint and Vadim Lyubashevsky</title>
<description><![CDATA[Our main result is a construction of a lattice-based digital signature scheme that represents an improvement, both in theory and in practice, over today's most efficient
lattice schemes.  The novel scheme is obtained as a result of a modification of the rejection sampling algorithm that is at the heart of Lyubashevsky's signature scheme (Eurocrypt, 2012) and several other lattice primitives.  Our new rejection sampling algorithm which samples from a bimodal Gaussian distribution, combined with a modified
scheme instantiation, ends up reducing the standard deviation of the resulting
signatures by a factor that is asymptotically square root in the security
parameter.  The implementations of our signature scheme for security levels of
128, 160, and 192 bits compare very favorably to existing schemes such as
RSA and ECDSA in terms of efficiency.  In addition, the new scheme has shorter
signature and public key sizes than all previously proposed lattice signature
schemes.

As part of our implementation, we also designed several novel algorithms which
could be of independent interest.  Of particular note, is a new algorithm for
efficiently generating discrete Gaussian samples over Z^n.  Current
algorithms either require many high-precision floating point exponentiations
or the storage of very large pre-computed tables, which makes them completely
inappropriate for usage in constrained devices.  Our sampling algorithm
reduces the hard-coded table sizes from linear to logarithmic as compared to
the time-optimal implementations, at the cost of being only a small factor
slower.
]]></description>
<guid>http://eprint.iacr.org/2013/383</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/382</link>
<title><![CDATA[To Hash or Not to Hash Again? (In)differentiability Results for H^2 and HMAC]]>, by Yevgeniy Dodis and Thomas Ristenpart and John Steinberger and Stefano Tessaro</title>
<description><![CDATA[We show that the second iterate H^2(M) = H(H(M)) of a random oracle H cannot achieve strong security in the sense of indifferentiability from a random oracle. We do so by proving that indifferentiability for H 2 holds only with poor concrete security by providing a lower bound (via an attack) and a matching upper bound (via a proof requiring new techniques) on the complexity of any successful simulator. We then investigate HMAC when it is used as a general-purpose hash function with arbitrary keys (and not as a MAC or PRF with uniform, secret keys). We uncover that HMAC's handling of keys gives rise to two types of weak key pairs. The first allows trivial attacks against its indifferentiability; the second gives rise to structural issues similar to that which ruled out strong indifferentiability bounds in the case of H^2 . However, such weak key pairs do not arise, as far as we know, in any deployed applications of HMAC. For example, using keys of any fixed length shorter than d &#8722; 1, where d is the block length in bits of the underlying hash function, completely avoids weak key pairs. We therefore conclude with a positive result: a proof that HMAC
is indifferentiable from a RO (with standard, good bounds) when applications use keys of a fixed length less than d &#8722; 1. 

]]></description>
<guid>http://eprint.iacr.org/2013/382</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/381</link>
<title><![CDATA[Breaking the Even-Mansour Hash Function: Collision and Preimage Attacks on JH and Gr{\o}stl]]>, by Bingke Ma and Bao Li and Ronglin Hao</title>
<description><![CDATA[The Even-Mansour structure and the chopMD mode are two widely-used strategies in hash function designs. They are adopted by many hash functions including two SHA-3 finalists, the JH hash function and the Gr{\o}stl hash function. The Even-Mansour structure combining the chopMD mode is supposed to enhance the security of hash functions against collision and preimage attacks, while our results show that it is not possible to achieve this goal with an unbalanced compression function. In this paper, we show generic attacks on the Even-Mansour hash functions including both collision and preimage attacks. Our attacks show the structure flaws of the Even-Mansour hash functions.  All these attacks can be applied to specific hash functions based on the Even-Mansour structure. We achieve the first collision and (2nd-)preimage attacks on full JH and Gr{\o}stl respectively. For the JH hash function, we achieve collision and (2nd-)preimage attacks on the full JH compression function with a time gain $2^{10.22}$. After a simple modification of the padding rules, we obtain full round collision and (2nd-)preimage attacks on the modified JH hash function with a time gain $2^{10.22}$. For the Gr{\o}stl hash function, we obtain both collision and (2nd-)preimage attacks on the full Gr{\o}stl hash function with a limited time gain $2^{0.58}$.
]]></description>
<guid>http://eprint.iacr.org/2013/381</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/380</link>
<title><![CDATA[Comments on Three Multi-Server Authentication Protocols]]>, by Yalin Chen 1, *Jue-Sam Chou2, Wen-Yi Tsai 3</title>
<description><![CDATA[Recently, Tsai et al., Liao et al. and Li et al. each proposed a multi-server authentication protocol. They claimed their protocols are secure and can withstand various attacks. However, we found some security loopholes in each of their schemes, for example, both Tsai et al.'s and Liao et al.'s schemes suffers from server spoofing attack by an insider server. Li et al.s' suffers from the lost smart card password-guessing attack. In addition, Liao et al.'s scheme also has the off-line password-guessing attack. In this paper, we will first review then show the attacks on each of the schemes. Then, based on Li et al.'s scheme, we proposed a novel one and examined its security in several security features. After security analysis, we concluded that our protocol outperformed Li et al.'s scheme in the security feature of lost smart card password-guessing attack.
Keywords: multi-server, password authentication protocol
]]></description>
<guid>http://eprint.iacr.org/2013/380</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/379</link>
<title><![CDATA[Delegatable Pseudorandom Functions and Applications]]>, by Aggelos Kiayias and Stavros Papadopoulos and Nikos Triandopoulos and Thomas Zacharias</title>
<description><![CDATA[  We put forth the problem of delegating the evaluation of a
  pseudorandom function (PRF) to an untrusted proxy. A {\em delegatable    PRF}, or DPRF for short, is a new primitive that enables a proxy to  evaluate a PRF on a strict subset of its domain using a trapdoor  derived from the DPRF secret-key.  PRF delegation is
  \emph{policy-based}: the trapdoor is constructed with respect to a
  certain policy that determines the subset of input values which the
  proxy is allowed to compute.  Interesting DPRFs should achieve
  \emph{low-bandwidth delegation}: Enabling the proxy to compute the PRF  values that conform to the policy should be more efficient than simply providing the proxy with the sequence of all such values precomputed.
  The main challenge in constructing DPRFs is in maintaining the
  pseudorandomness of unknown values in the face of an attacker that
  adaptively controls proxy servers.  A DPRF may be optionally equipped
  with an additional property we call \emph{policy privacy}, where any
  two delegation predicates remain indistinguishable in the view of a
  DPRF-querying proxy: Achieving this raises new design challenges as
  policy privacy and efficiency are seemingly conflicting goals.

  For the important class of policies described as (1-dimensional)
  \emph{ranges}, we devise two DPRF constructions and rigorously prove
  their security. Built upon the well-known tree-based GGM PRF
  family~\cite{GGM86}, our constructions are generic and feature only
  logarithmic delegation size in the number of values conforming to the
  policy predicate. At only a constant-factor efficiency reduction, we
  show that our second construction is also policy private. As we
  finally describe, their new security and efficiency properties render
  our delegated PRF schemes particularly useful in numerous security
  applications, including RFID, symmetric searchable encryption, and
  broadcast encryption.


]]></description>
<guid>http://eprint.iacr.org/2013/379</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/378</link>
<title><![CDATA[A note on quantum related-key attacks]]>, by Martin Roetteler and Rainer Steinwandt</title>
<description><![CDATA[In a basic related-key attack against a block cipher, the adversary has access to encryptions under keys that differ from the target key by bit-flips. In this short note we show that for a quantum adversary such attacks are quite powerful: if the secret key is (i) uniquely determined by a small number of plaintext-ciphertext pairs, (ii) the block cipher can be evaluated efficiently, and (iii) a superposition of related keys can be queried, then the key can be extracted efficiently.
]]></description>
<guid>http://eprint.iacr.org/2013/378</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/377</link>
<title><![CDATA[An Algebraic Framework for Diffie-Hellman Assumptions]]>, by Alex Escala and Gottfried Herold and Eike Kiltz and Carla R\`afols and Jorge Villar</title>
<description><![CDATA[We put forward a new algebraic framework to generalize and
analyze Diffie-Hellman like Decisional Assumptions which allows
us to argue about security and applications by considering only algebraic properties.
Our $D_{\ell,k}-MDDH$ assumption states that it is hard to decide whether
a vector in $G^\ell$ is linearly dependent of the columns of some matrix in $G^{\ell\times k}$ sampled according to distribution $D_{\ell,k}$.
It covers known assumptions such as $DDH$, $2-Lin$ (linear assumption), and $k-Lin$ (the $k$-linear assumption).
Using our algebraic viewpoint, we can relate the generic hardness of our assumptions in $m$-linear groups to the irreducibility of certain polynomials which describe the output of $D_{\ell,k}$.
We use the hardness results to find new distributions for which the $D_{\ell,k}-MDDH$-Assumption holds generically in $m$-linear groups.
In particular, our new assumptions $2-SCasc$ and $2-ILin$ are generically hard in bilinear groups and, compared to $2-Lin$, have shorter description size, which is a relevant parameter for efficiency in many applications.
These results support using our new assumptions as natural replacements for the $2-Lin$ Assumption which was already used in a large number of applications.

To illustrate the conceptual advantages of our algebraic framework, we construct several fundamental primitives based on any $MDDH$-Assumption. In particular, we can give many instantiations of a primitive in a compact way, including public-key encryption, hash-proof systems, pseudo-random functions, and Groth-Sahai NIZK and NIWI proofs.
As an independent contribution we give more efficient NIZK and NIWI proofs for membership in a subgroup of $G^\ell$, for validity of ciphertexts and for equality of plaintexts. The results imply very significant efficiency improvements for a large number of schemes, most notably Naor-Yung type of constructions.



]]></description>
<guid>http://eprint.iacr.org/2013/377</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/376</link>
<title><![CDATA[An Accurate Probabilistic Reliability Model for Silicon PUFs]]>, by Roel Maes</title>
<description><![CDATA[The power of an accurate model for describing a physical process or designing a physical system is beyond doubt. The currently used reliability model for physically unclonable functions (PUFs) assumes an equally likely error for every evaluation of every PUF response bit. This limits an accurate description since experiments show that certain responses are more error-prone than others, but this fixed error rate model only captures average case behavior. We introduce a new PUF reliability model taking this observed heterogeneous nature of PUF cells into account. An extensive experimental validation demonstrates that the new predicted distributions describe the empirically observed data statistics almost perfectly, even considering sensitivity to operational temperature. This allows studying PUF reliability behavior in full detail, including average and worst case probabilities, and is an invaluable tool for designing more efficient and better adapted PUFs and PUF-based systems.
]]></description>
<guid>http://eprint.iacr.org/2013/376</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/375</link>
<title><![CDATA[NaCl on 8-Bit AVR Microcontrollers]]>, by Michael Hutter and Peter Schwabe</title>
<description><![CDATA[This paper presents first results of the Networking and Cryptography library (NaCl) on the 8-bit AVR family of  microcontrollers. We show that NaCl, which has so far been optimized mainly for different desktop and server platforms, is feasible on resource-constrained devices while being very fast and memory efficient. Our implementation shows that encryption using Salsa20 requires 268 cycles/byte, authentication using Poly1305 needs 195 cycles/byte, a Curve25519 scalar multiplication needs 22,791,579 cycles, signing of data using Ed25519 needs 23,216,241 cycles, and verification can be done within 32,634,713 cycles. All implemented primitives provide at least 128-bit security, run in constant time, do not use secret-data-dependent branch conditions, and are open to the public domain (no usage restrictions).
]]></description>
<guid>http://eprint.iacr.org/2013/375</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/374</link>
<title><![CDATA[A Secure and efficient elliptic curve based authentication and key agreement protocol suitable for WSN]]>, by Majid Bayat, Mohammad Reza Aref</title>
<description><![CDATA[Authentication and key agreement protocols play an important role in wireless sensor communication networks. Recently Xue et al'. suggested a key agreement protocols for WSN which in this paper we show that the protocol has some security flaws. Also we introduce an enhanced authentication and key agreement protocol for WSN satisfying all the security requirements. 
]]></description>
<guid>http://eprint.iacr.org/2013/374</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/373</link>
<title><![CDATA[Injective Encoding to Elliptic Curves]]>, by Pierre-Alain Fouque and Antoine Joux and Mehdi Tibouchi</title>
<description><![CDATA[For a number of elliptic curve-based cryptographic protocols, it is useful and sometimes necessary to be able to encode a message (a bit string) as a point on an elliptic curve in such a way that the message can be efficiently and uniquely recovered from the point. This is for example the case if one wants to instantiate CPA-secure ElGamal encryption directly in the group of points of an elliptic curve. More practically relevant settings include Lindell's UC commitment scheme (EUROCRYPT 2011) or structure-preserving primitives.

It turns out that constructing such an encoding function is not easy in general, especially if one wishes to encode points whose length is large relative to the size of the curve. There is a probabilistic, ``folklore'' method for doing so, but it only provably works for messages of length less than half the size of the curve.

In this paper, we investigate several approaches to injective encoding to elliptic curves, and in particular, we propose a new, essentially optimal geometric construction for a large class of curves, including Edwards curves; the resulting algorithm is also quite efficient, requiring only one exponentiation in the base field and simple arithmetic operations (however, the curves for which the map can be constructed have a point of order two, which may be a limiting factor for possible applications). The new approach is based on the existence of a covering curve of genus 2 for which a bijective encoding is known.

]]></description>
<guid>http://eprint.iacr.org/2013/373</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/372</link>
<title><![CDATA[Practical Bootstrapping in Quasilinear Time]]>, by Jacob Alperin-Sheriff and Chris Peikert</title>
<description><![CDATA[Gentry's ``bootstrapping'' technique (STOC 2009) constructs a fully
homomorphic encryption (FHE) scheme from a ``somewhat homomorphic''
one that is powerful enough to evaluate its own decryption function.
To date, it remains the only known way of obtaining unbounded FHE.
Unfortunately, bootstrapping is computationally very expensive,
despite the great deal of effort that has been spent on improving its
efficiency.  The current state of the art, due to Gentry, Halevi, and
Smart (PKC 2012), is able to bootstrap ``packed'' ciphertexts (which
encrypt up to a linear number of bits) in time only \emph{quasilinear}
$\Otil(\lambda) = \lambda \cdot \log^{O(1)} \lambda$ in the security
parameter.  While this performance is \emph{asymptotically} optimal up
to logarithmic factors, the practical import is less clear: the
procedure composes multiple layers of expensive and complex
operations, to the point where it appears very difficult to implement,
and its concrete runtime appears worse than those of prior methods
(all of which have quadratic or larger asymptotic runtimes).

In this work we give \emph{simple}, \emph{practical}, and entirely
\emph{algebraic} algorithms for bootstrapping in quasilinear time, for
both ``packed'' and ``non-packed'' ciphertexts.  Our methods are easy
to implement (especially in the non-packed case), and we believe that
they will be substantially more efficient in practice than all prior
realizations of bootstrapping.  One of our main techniques is a
substantial enhancement of the ``ring-switching'' procedure of Gentry
et al.~(SCN 2012), which we extend to support switching between two
rings where neither is a subring of the other.  Using this procedure,
we give a natural method for homomorphically evaluating a broad class
of structured linear transformations, including one that lets us
evaluate the decryption function efficiently.

]]></description>
<guid>http://eprint.iacr.org/2013/372</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/371</link>
<title><![CDATA[Domain-Polymorphic Programming of Privacy-Preserving Applications]]>, by Dan Bogdanov and Peeter Laud and Jaak Randmets</title>
<description><![CDATA[Secure Multiparty Computation (SMC) is seen as one of the main enablers for secure outsourcing of computation. Currently, there are many different SMC techniques (garbled circuits, secret sharing, homomorphic encryption, etc.) and none of them is clearly superior to others in terms of efficiency, security guarantees, ease of implementation, etc. For maximum efficiency, and for obeying the trust policies, a privacy-preserving application may wish to use several different SMC techniques for different operations it performs. A straightforward implementation of this application may result in a program that
(i) contains a lot of duplicated code, differing only in the used SMC technique;
(ii) is difficult to maintain, if policies or SMC implementations change; and
(iii) is difficult to reuse in similar applications using different SMC techniques.

In this paper, we propose a programming language with associated compilation techniques for simple orchestration of multiple SMC techniques and multiple protection domains. It is a simple imperative language with function calls where the types of data items are annotated with protection domains and where the function declarations may be domain-polymorphic. This allows most of the program code working with private data to be written in a SMC-technique-agnostic manner. It also allows rapid deployment of new SMC techniques and implementations in existing applications. We have implemented the compiler for the language, integrated it with an existing SMC framework, and are currently using it for new privacy-preserving applications.

]]></description>
<guid>http://eprint.iacr.org/2013/371</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/370</link>
<title><![CDATA[Leakage-Resilient Symmetric Cryptography Under Empirically Verifiable Assumptions]]>, by François-Xavier Standaert and Olivier Pereira and Yu Yu</title>
<description><![CDATA[Leakage-resilient cryptography aims at formally proving the security of cryptographic implementations against large classes of side-channel adversaries. One important challenge for such an approach to be relevant is to adequately connect the formal models used in the proofs with the practice of side-channel attacks. It raises the fundamental problem of finding reasonable restrictions of the leakage functions that can be empirically verified by evaluation laboratories. In this paper, we first argue that the previous ``bounded leakage" requirements used in leakage-resilient cryptography are hard to fulfill by hardware engineers. We then introduce a new, more realistic and empirically verifiable assumption of simulatable leakage, under which security proofs in the standard model can be obtained. We finally illustrate our claims by analyzing the physical security of an efficient pseudorandom generator (for which security could only be proven under a random oracle based assumption so far). These positive results come at the cost of (algorithm-level) specialization, as our new assumption is specifically defined for block ciphers. Nevertheless, since block ciphers are the main building block of many leakage-resilient 
cryptographic primitives, our results also open the way towards more realistic constructions and proofs for other pseudorandom objects.
]]></description>
<guid>http://eprint.iacr.org/2013/370</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/369</link>
<title><![CDATA[Block Ciphers that are Easier to Mask: How Far Can we Go?]]>, by Benoît Gérard and Vincent Grosso and María Naya-Plasencia and François-Xavier Standaert</title>
<description><![CDATA[The design and analysis of lightweight block ciphers has been a very active research area over the last couple of years, with many innovative proposals trying to optimize different performance figures. However, since these block ciphers are dedicated to low-cost embedded devices, their implementation is also a typical target for side-channel adversaries. As preventing such attacks with countermeasures usually implies significant performance overheads, a natural open problem is to propose new algorithms for which physical security is considered as an optimization criteria, hence allowing better performances again. We tackle this problem by studying how much we can tweak standard block ciphers such as the AES Rijndael in order to allow efficient masking (that is one of the most frequently considered solutions to improve security against side-channel attacks). For this purpose, we first investigate alternative S-boxes and round structures. We show that both approaches can be used separately in order to limit the total number of non-linear operations in the block cipher, hence allowing more efficient masking. We then combine these ideas into a concrete instance of block cipher called Zorro. We further provide a detailed security analysis of this new cipher taking its design specificities into account, leading us to exploit innovative techniques borrowed from hash function cryptanalysis (that are sometimes of independent interest). Eventually, we conclude the paper by evaluating the efficiency of masked Zorro implementations in an 8-bit microcontroller, and exhibit their interesting performance figures.
]]></description>
<guid>http://eprint.iacr.org/2013/369</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/368</link>
<title><![CDATA[Security in $O(2^n)$ for the Xor of Two Random Permutations\\ -- Proof with the standard $H$ technique--]]>, by Jacques Patarin</title>
<description><![CDATA[Xoring two permutations is a very simple way to construct pseudorandom functions from pseudorandom permutations. In~\cite{P08a}, it is proved that we have security against CPA-2 attacks when $m \ll O(2^n)$, where $m$ is the number of queries and $n$ is the number of bits of the inputs
and outputs of the bijections. In this paper, we will obtain similar (but slightly different) results by using the
``standard H technique'' instead of the ``$H_{\sigma}$ technique''. It will be interesting to
compare the two techniques, their similarities and the differences between the proofs and the
results.
]]></description>
<guid>http://eprint.iacr.org/2013/368</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/367</link>
<title><![CDATA[On the Security of TLS-DH and TLS-RSA in the Standard Model]]>, by Florian Kohlar and Sven Schäge and Jörg Schwenk</title>
<description><![CDATA[TLS is the most important cryptographic protocol in the Internet. At CRYPTO 2012, Jager et al. presented the first proof of the unmodified TLS with ephemeral Diffie-Hellman key exchange (TLS-DHE) for mutual authentication. Since TLS cannot be proven secure under the classical definition of authenticated key exchange (AKE), they introduce a new security model called authenticated and confidential channel establishment (ACCE) that captures the security properties expected from TLS in practice. We extend this result in two ways. First we show that the cryptographic cores of the remaining ciphersuites, RSA encrypted key transport (TLS-RSA) and static Diffie-Hellman (TLS-DH), can be proven secure for mutual authentication in an extended ACCE model that also allows the adversary to register new public keys. In our security analysis we show that if TLS-RSA is instantiated with a CCA secure public key cryptosystem and TLS-DH is used in scenarios where a) the knowledge of secret key assumption holds or b) the adversary may not register new public keys at all, both ciphersuites can be proven secure in the standard model under standard security assumptions. Next, we present new and strong definitions of ACCE (and AKE) for server-only authentication which fit well into the general framework of Bellare-Rogaway-style models. We show that all three ciphersuites families do remain secure in this server-only setting. Our work identifies which primitives need to be exchanged in the TLS handshake to obtain strong security results under standard security assumptions (in the standard model) and may so help to guide future revisions of the TLS standard and make improvements to TLS's extensibility pay off.
]]></description>
<guid>http://eprint.iacr.org/2013/367</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/366</link>
<title><![CDATA[Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128]]>, by Pierre-Alain Fouque and Jérémy Jean and Thomas Peyrin</title>
<description><![CDATA[While the symmetric-key cryptography community has now a good
experience on how to build a secure and efficient fixed permutation,
it remains an open problem how to design a key-schedule for block
ciphers, as shown by the numerous candidates broken in the related-key
model or in a hash function setting. Provable security against
differential and linear cryptanalysis in the related-key scenario is
an important step towards a better understanding of its construction.

Using a structural analysis, we show that the full AES-128 cannot be
proven secure unless the exact coefficients of the MDS matrix and the
S-Box differential properties are taken into account since its
structure is vulnerable to a related-key differential attack. We then
exhibit a chosen-key distinguisher for AES-128 reduced to 9 rounds,
which solves an open problem of the symmetric community. We obtain
these results by revisiting algorithmic theory and graph-based ideas
to compute all the best differential characteristics in SPN ciphers,
with a special focus on AES-like ciphers subject to related-keys. We
use a variant of Dijkstra's algorithm to efficiently find the most
efficient related-key attacks on SPN ciphers with an algorithm linear
in the number of rounds.

]]></description>
<guid>http://eprint.iacr.org/2013/366</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/365</link>
<title><![CDATA[Efficient eCK-secure Authenticated Key Exchange Protocols in the Standard Model]]>, by Zheng Yang</title>
<description><![CDATA[The extended Canetti-Krawczyk (eCK) security models, are widely used to provide security arguments for authenticated key exchange protocols that capture leakage of various kinds of secret information like the long-term private key and session-specific secret state. In this paper, we study the open problem on constructing eCK secure AKE protocol without random oracles and NAXOS like trick. A generic construction GC-KKN satisfying those requirements is first given relying on standard cryptographic primitives following the guideline of efficiency. On the second a concrete protocol is proposed which is the first eCK secure protocol in the standard model under both standard assumptions and post-specified peer setting. Both proposed schemes can be more efficiently implemented with secure device than previous eCK secure protocols in the standard model, where the secure device might be normally used to store the long-term private key and implement algorithms of protocol which require to be resilience of state leakage. 
]]></description>
<guid>http://eprint.iacr.org/2013/365</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/364</link>
<title><![CDATA[On the Achievability of Simulation-Based Security for Functional Encryption]]>, by Angelo De Caro and Vincenzo Iovino Abhishek Jain and Adam O'Neill and Omer Paneth and Giuseppe Persiano</title>
<description><![CDATA[This work attempts to clarify to what extent simulation-based security (SIM-security) is achievable for functional encryption (FE) and its relation to the weaker indistinguishability-based security (IND-security). Our main result is a compiler that transforms any FE scheme for the general circuit functionality (which we denote by circuit-FE) meeting indistinguishability-based security (IND-security) to a circuit-FE scheme meeting SIM-security, where:
\begin{itemize}
\item  In the random oracle model, the resulting scheme is secure for an unbounded number of encryption and key queries, which is the strongest security level one can ask for.
\item  In the standard model, the resulting scheme is secure for a bounded number of encryption and non-adaptive key queries, but an \emph{unbounded} number of adaptive key queries.  This matches known impossibility results and improves upon Gorbunov et al. [CRYPTO'12] (which is only secure for \emph{non-adaptive} key queries).
\end{itemize}
Our compiler is inspired by the celebrated Fiat-Lapidot-Shamir paradigm [FOCS'90] for obtaining zero-knowledge proof systems from witness-indistinguishable proof systems.
As it is currently unknown whether circuit-FE meeting IND-security exists, the purpose of this result is to establish that it remains a good target for future research despite known deficiencies of IND-security [Boneh et al. -- TCC'11, O'Neill -- ePrint '10].
We also give a tailored  construction of SIM-secure hidden vector encryption (HVE) in composite-order bilinear groups.  
Finally, we revisit the known negative results for SIM-secure FE, extending them to natural weakenings of the security definition  and thus providing essentially a full picture of the 
]]></description>
<guid>http://eprint.iacr.org/2013/364</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/363</link>
<title><![CDATA[A New Class of Public Key Cryptosystems Constructed Based on Reed-Solomon Codes, K(XII)SE(1)PKC.-- Along with a presentation of K(XII)SE(1)PKC over the extension field extensively used for present day various storage and transmission systems --]]>, by Masao KASAHARA</title>
<description><![CDATA[In this paper, we present a new class of public key cryptosystem based on Reed-Solomon codes, a member of the code based PKC(CBPKC), referred to as K(XII)SE(1)PKC. We show that K(XII)SE(1)PKC can be secure against the various attacks. Particularly we present a member of K(XII)SE(1)PKC constructed based on the Reed-Solomon code over the extension field, which is extensively used in the present day storage systems and the various digital transmission systems. In a sharp contrast with the conventional CBPKC that uses Goppa code, in K(XII)SE(1)PKC, we do not care for the security of the primitive polynominal that generates the Reed-Solomon code. The probabilistic scheme presented in this paper would yield a brand-new technique in the field of CBPKC.
]]></description>
<guid>http://eprint.iacr.org/2013/363</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/362</link>
<title><![CDATA[A Fast Implementation of the Optimal Ate Pairing over BN curve on Intel Haswell Processor]]>, by Shigeo MITSUNARI</title>
<description><![CDATA[We present an efficient implementation of the Optimal Ate Pairing on Barreto-Naehrig
curve over a 254-bit prime field on Intel Haswell processor.
Our library is able to compute the optimal ate pairing over a 254-bit prime field,
in just 1.17 million of clock cycles on a single core of an Intel Core i7-4700MQ(2.4GHz)
processor with TurboBoost technology disabled.

]]></description>
<guid>http://eprint.iacr.org/2013/362</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/361</link>
<title><![CDATA[Linearly Homomorphic Structure-Preserving Signatures and Their Applications]]>, by Benoit Libert and Thomas Peters and Marc Joye and Moti Yung</title>
<description><![CDATA[Structure-preserving signatures (SPS) are signature schemes where   messages, signatures and public keys all consist of elements of a   group over which a bilinear map is efficiently computable. This   property makes them useful in cryptographic protocols as they nicely compose with other algebraic tools (like the celebrated Groth-Sahai proof systems). In this paper, we consider SPS systems with homomorphic properties and suggest applications that have not been   provided before (in particular, not by employing ordinary SPS). We build linearly homomorphic structure-preserving signatures under simple assumptions and show that the primitive makes it possible to verify the calculations performed by a server on outsourced encrypted data (i.e., combining secure computation and authenticated computation to allow reliable and secure cloud storage and computation, while freeing the client from retaining cleartext storage). Then, we give a generic construction of non-malleable (and actually simulation-sound) commitment from any linearly homomorphic SPS. This notably provides the first constant-size non-malleable commitment to group elements.
]]></description>
<guid>http://eprint.iacr.org/2013/361</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/360</link>
<title><![CDATA[Achieving the limits of the noisy-storage model using entanglement sampling]]>, by Frédéric Dupuis and Omar Fawzi and Stephanie Wehner</title>
<description><![CDATA[A natural measure for the amount of quantum information that a physical system $E$ holds about another system $A = A_1,...,A_n$ is given by the min-entropy $\hmin(A|E)$. Specifically, the min-entropy measures the amount of entanglement between $E$ and $A$, and is the relevant measure when analyzing a wide variety of problems ranging from randomness extraction in quantum cryptography, decoupling used in channel coding, to physical processes such as thermalization or the thermodynamic work cost (or gain) of erasing a quantum system.  As such, it is a central question to determine the behaviour of the min-entropy after some process M is applied to the system $A$. Here we introduce a new generic tool relating the resulting min-entropy to the original one, and apply it to several settings of interest, including sampling of subsystems and measuring in a randomly chosen basis. 

The results on random measurements yield new high-order entropic uncertainty relations with which we prove the optimality of cryptographic schemes in the bounded quantum storage model. This is an abridged version of the paper; the full version containing all proofs and further applications can be found in \cite{DFW13}.
]]></description>
<guid>http://eprint.iacr.org/2013/360</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/359</link>
<title><![CDATA[A heuristic for finding compatible differential paths with application to HAS-160]]>, by Aleksandar Kircanski and Riham AlTawy and Amr M. Youssef</title>
<description><![CDATA[The question of compatibility of differential paths plays a central role in second order
collision attacks on hash functions. In this context, attacks typically proceed by starting from the
middle and constructing the middle-steps quartet in which the two paths are enforced on the respec-
tive faces of the quartet structure. Finding paths that can fit in such a quartet structure has been
a major challenge and the currently known compatible paths extend over a suboptimal number of
steps for hash functions such as SHA-2 and HAS-160. In this paper, we investigate a heuristic that
searches for compatible differential paths. The application of the heuristic in case of HAS-160 yields
a practical second order collision over all of the function steps, which is the first practical result that
covers all of the HAS-160 steps. An example of a colliding quartet is provided

]]></description>
<guid>http://eprint.iacr.org/2013/359</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/358</link>
<title><![CDATA[Counter-cryptanalysis]]>, by Marc Stevens</title>
<description><![CDATA[We introduce \emph{counter-cryptanalysis} as a new paradigm for strengthening weak cryptographic primitives against cryptanalytic attacks.
Redesigning a weak primitive to more strongly resist cryptanalytic techniques will unavoidably break backwards compatibility.
Instead, counter-cryptanalysis exploits unavoidable anomalies introduced by cryptanalytic attacks to detect and block
cryptanalytic attacks while maintaining full backwards compatibility.
Counter-cryptanalysis in principle enables the continued secure use of weak cryptographic primitives.

Furthermore, we present the first example of counter-cryptanalysis, namely the efficient detection whether any given single message has been constructed -- together with an \emph{unknown} sibling message -- using a cryptanalytic collision attack on MD5 or SHA-1.

An immediate application is in digital signature verification software to ensure that an (older) MD5 or SHA-1 based digital signature is not a forgery using a collision attack.
This would certainly be desirable for two reasons.
Firstly, it might still be possible to generate malicious forgeries using collision attacks as too many parties still sign using MD5 (or SHA-1) based signature schemes.
Secondly, any such forgeries are currently accepted nearly everywhere due to the ubiquitous support of MD5 and SHA-1 based signature schemes.
Despite the academic push to use more secure hash functions over the last decade, these two real-world arguments (arguably) will remain valid for many more years.

Only due to counter-cryptanalysis were we able to discover that Flame, 
a highly advanced malware for cyberwarfare uncovered in May 2012, 
employed an as of yet unknown variant of our chosen-prefix collision attack on MD5 \cite{DBLP:conf/eurocrypt/StevensLW07,DBLP:conf/crypto/StevensSALMOW09}.
In this paper we disect the revealed cryptanalytic details and work towards the reconstruction of the algorithms underlying Flame's new variant attack.
Finally, we make a preliminary comparision between Flame's attack and our chosen-prefix collision attack.

]]></description>
<guid>http://eprint.iacr.org/2013/358</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/357</link>
<title><![CDATA[The LOCAL attack: Cryptanalysis of the authenticated encryption scheme ALE]]>, by Dmitry Khovratovich and Christian Rechberger</title>
<description><![CDATA[  We show how to produce a forged (ciphertext,tag) pair for the scheme ALE with data and time complexity of 2^102 ALE encryptions of short messages and the same number of authentication attempts.
  We use a differential attack based on a local collision, which exploits the availability of extracted state bytes to the adversary. Our approach allows for a time-data complexity tradeoff, with an extreme case of a forgery produced after $2^119 attempts and based on a single authenticated message. Our attack is further turned into a state recovery and a universal forgery attack with a time complexity of 2^120 verification attempts using only a single authenticated 48-byte message.
]]></description>
<guid>http://eprint.iacr.org/2013/357</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/356</link>
<title><![CDATA[Verifying computations with state]]>, by Benjamin Braun and Ariel J. Feldman and Zuocheng Ren and Srinath Setty and Andrew J. Blumberg and Michael Walfish</title>
<description><![CDATA[When outsourcing computations to the cloud or other
third-parties, a key issue for clients is the ability to
verify the results. Recent work in proof-based verifiable
computation, building on deep results in complexity theory
and cryptography, has made significant progress on this
problem. However, all existing systems require computational
models that do not incorporate state. This limits these
systems to simplistic programming idioms and rules out
computations where the client cannot materialize all of the
input (e.g., very large MapReduce instances or database
queries).

This paper describes Pantry, the first built system that
incorporates state. Pantry composes the machinery of
proof-based verifiable computation with ideas from untrusted
storage: the client expresses its computation in terms of
digests that attests to state, and verifiably outsources
that computation. Besides the boon to expressiveness, the
client can gain from outsourcing even when the computation
is sublinear in the input size. We describe a verifiable
MapReduce application and a queriable database, among other
simple applications. Although the resulting applications
result in server overhead that is higher than we would like,
Pantry is the first system to provide verifiability for
realistic applications in a realistic programming model.
]]></description>
<guid>http://eprint.iacr.org/2013/356</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/355</link>
<title><![CDATA[New Attacks against Transformation-Based Privacy-Preserving Linear Programming]]>, by Peeter Laud and Alisa Pankova</title>
<description><![CDATA[In this paper we demonstrate a number of attacks against proposed protocols for privacy-preserving linear programming, based on publishing and solving a transformed version of the problem instance. Our attacks exploit the geometric structure of the problem, which has
mostly been overlooked in the previous analyses and is largely preserved by the proposed transformations. The attacks are efficient in practice and cast serious doubt to the viability of transformation-based approaches in general.

]]></description>
<guid>http://eprint.iacr.org/2013/355</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/354</link>
<title><![CDATA[Programmable Hash Functions in the Multilinear Setting]]>, by Eduarda S.V. Freire and Dennis Hofheinz and Kenneth G. Paterson and Christoph Striecks</title>
<description><![CDATA[We adapt the concept of a programmable hash function (PHF, Crypto 2008) to a setting in which a multilinear map is available. This enables new PHFs with previously unachieved parameters.

To demonstrate their usefulness, we show how our (standard-model) PHFs can replace random oracles in several well-known cryptographic constructions. Namely, we obtain standard-model versions of the Boneh-Franklin identity-based encryption scheme, the Boneh-Lynn-Shacham signature scheme, and the Sakai-Ohgishi-Kasahara identity-based non-interactive key exchange (ID-NIKE) scheme. The ID-NIKE scheme is the first scheme of its kind in the standard model.

Our abstraction also allows to derive hierarchical versions of the above schemes in settings with multilinear maps. This in particular yields simple and efficient hierarchical generalizations of the BF, BLS, and SOK schemes. In the case of hierarchical ID-NIKE, ours is the first such scheme with full security, in either the random oracle model or the standard model.

While our constructions are formulated with respect to a generic multilinear map, we also outline the necessary adaptations required for the recent ``noisy'' multilinear map candidate due to Garg, Gentry, and Halevi.
]]></description>
<guid>http://eprint.iacr.org/2013/354</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/353</link>
<title><![CDATA[Profiling DPA: Efficacy and efficiency trade-offs]]>, by Carolyn Whitnall and Elisabeth Oswald</title>
<description><![CDATA[Linear regression-based methods have been proposed as efficient means of characterising device leakage in the training phases of profiled side-channel attacks. Empirical comparisons between these and the `classical' approach to template building have confirmed the reduction in profiling complexity to achieve the same attack-phase success, but have focused on a narrow range of leakage scenarios which are especially favourable to simple (i.e.\ efficiently estimated) model specifications. In this contribution we evaluate---from a theoretic perspective as much as possible---the performance of linear regression-based templating in a variety of realistic leakage scenarios as the complexity of the model specification varies. We are particularly interested in complexity trade-offs between the number of training samples needed for profiling and the number of attack samples needed for successful DPA: over-simplified models will be cheaper to estimate but DPA using such a degraded model will require more data to recover the key. However, they can still offer substantial improvements over non-profiling strategies relying on the Hamming weight power model, and so represent a meaningful middle-ground between `no' prior information and `full' prior information. 
]]></description>
<guid>http://eprint.iacr.org/2013/353</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/352</link>
<title><![CDATA[Constrained Pseudorandom Functions and Their Applications]]>, by Dan Boneh and Brent Waters</title>
<description><![CDATA[We put forward a new notion of pseudorandom functions (PRFs) we call
constrained PRFs.  In a standard PRF there is a master key k that enables one to evaluate the function at all points in the domain of the
function.  In a constrained PRF it is possible to derive constrained keys kS from the master key k.  A constrained key kS enables the
evaluation of the PRF at a certain subset S of the domain and
nowhere else.  We present a formal framework for this concept and show
that constrained PRFs can be used to construct powerful primitives such as identity-based key exchange and an optimal private broadcast
encryption system.  We then construct constrained PRFs for several natural set systems needed for these applications.  We conclude with several open problems relating to this new concept.

]]></description>
<guid>http://eprint.iacr.org/2013/352</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/351</link>
<title><![CDATA[Time-Optimal Interactive Proofs for Circuit Evaluation]]>, by Justin Thaler</title>
<description><![CDATA[Several research teams have recently been working toward the development of practical general-purpose protocols for verifiable computation. These protocols enable a computationally weak verifier to offload computations to a powerful but untrusted prover, while providing the verifier with a guarantee that the prover performed the requested computations correctly. Despite substantial progress, existing implementations require further improvements before they become practical for most settings. The main bottleneck is typically the extra effort required by the prover to return an answer with a guarantee of correctness, compared to returning an answer with no guarantee.

We describe a refinement of a powerful interactive proof protocol due to Goldwasser, Kalai, and Rothblum. Cormode, Mitzenmacher, and Thaler show how to implement the prover in this protocol in time $O(S \log S)$, where $S$ is the size of an arithmetic circuit computing the function of interest. Our refinements apply to circuits with sufficiently ``regular'' wiring patterns;  for these circuits, we bring the runtime of the prover down to $O(S)$. That is, our prover can evaluate the circuit with a guarantee of correctness, with only a constant-factor blowup in work compared to evaluating the circuit with no guarantee.

We argue that our refinements capture a large class of circuits, and we complement our theoretical results with experiments on problems such as matrix multiplication and determining the number of distinct elements in a data stream. Experimentally, our refinements yield a 200x speedup for the prover over the implementation of Cormode et al., and our prover is less than 10x slower than a C++ program that simply evaluates the circuit. Along the way, we describe a special-purpose protocol for matrix multiplication that is of interest in its own right.

Our final contribution is the design of an interactive proof protocol targeted at general data parallel computation.  Compared to prior work, this protocol can more efficiently verify complicated computations  as long as that computation is applied independently to many different pieces of data.
]]></description>
<guid>http://eprint.iacr.org/2013/351</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/350</link>
<title><![CDATA[Ideal-Cipher (Ir)reducibility for Blockcipher-Based Hash Functions]]>, by Paul Baecher and Pooya Farshim and Marc Fischlin and Martijn Stam</title>
<description><![CDATA[Preneel et al.~(Crypto 1993) assessed 64 possible ways to construct a compression function out of a blockcipher. They conjectured that 12 out of these 64 so-called PGV constructions achieve optimal security bounds for collision resistance and preimage resistance. This was proven by Black et al.~(Journal of Cryptology, 2010), if one assumes that the blockcipher is ideal. This result, however, does not apply to ``non-ideal'' blockciphers such as AES. To alleviate this problem, we revisit the PGV constructions in light of the recently proposed idea of random-oracle reducibility (Baecher and Fischlin, Crypto 2011). We say that the blockcipher in one of the 12 secure PGV constructions reduces to the one in another construction, if \emph{any} secure instantiation of the cipher, ideal or not, for one construction also makes the other secure. This notion allows us to relate the underlying assumptions on blockciphers in different constructions, and show that the requirements on the blockcipher for one case are not more demanding than those for the other. It turns out that this approach divides the 12 secure constructions into two groups of equal size, where within each group a blockcipher making one construction secure also makes all others secure. Across the groups this is provably not the case, showing that the sets of ``good'' blockciphers for each group are qualitatively distinct. We also relate the ideal ciphers in the PGV constructions with those in double-block-length hash functions such as Tandem-DM, Abreast-DM, and Hirose-DM. Here, our results show that, besides achieving better bounds, the double-block-length hash functions rely on weaker assumptions on the blockciphers to achieve collision and everywhere preimage resistance.
]]></description>
<guid>http://eprint.iacr.org/2013/350</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/349</link>
<title><![CDATA[A Dynamic Tradeoff Between Active and Passive Corruptions in Secure Multi-Party Computation]]>, by Martin Hirt and Ueli Maurer and Christoph Lucas</title>
<description><![CDATA[At STOC '87, Goldreich et al.~presented two protocols for secure multi-party computation (MPC) among $n$ parties: The first protocol provides \emph{passive} security against $t<n$ corrupted parties. The second protocol provides even \emph{active} security, but only against $t<n/2$ corrupted parties. Although these protocols provide security against the provably highest possible number of corruptions, each of them has its limitation: The first protocol is rendered completely insecure in presence of a single active corruption, and the second protocol is rendered completely insecure in presence of $\lceil n/2 \rceil$ passive corruptions.

At Crypto 2006, Ishai et al.~combined these two protocols into a single protocol which provides passive security against $t<n$ corruptions and active security against $t<n/2$ corruptions. This protocol unifies the security guarantees of the passive world and the active world (``best of both worlds''). However, the corruption threshold $t<n$ can be tolerated only when \emph{all} corruptions are passive. With a single active corruption, the threshold is reduced to $t<n/2$.

As our main result, we introduce a \emph{dynamic tradeoff} between active and passive corruptions: We present a protocol which provides security against $t<n$ passive corruptions, against $t<n/2$ active corruptions, \emph{and everything in between}. In particular, our protocol provides full security against $k$ active corruptions, as long as less than $n-k$ parties are corrupted in total, for any unknown $k$.

The main technical contribution is a new secret sharing scheme that, in the reconstruction phase, releases secrecy \emph{gradually}. This allows to construct non-robust MPC protocols which, in case of an abort, still provide some level of secrecy. Furthermore, using similar techniques, we also construct protocols for reactive MPC with hybrid security, i.e., different thresholds for secrecy, correctness, robustness, and fairness. Intuitively, the more corrupted parties, the less security is guaranteed.

]]></description>
<guid>http://eprint.iacr.org/2013/349</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/348</link>
<title><![CDATA[Multi-file proofs of retrievability for cloud storage auditing]]>, by Bin Wang and Xiaojing Hong</title>
<description><![CDATA[    Cloud storage allows clients to store a large amount of data with the help of storage service providers (SSPs). Proof-of-retrievability(POR) protocols allow one server to prove to a verifier the availability of data stored by some client. Shacham et al. presented POR protocols based on homomorphic authenticators and proved security of their schemes under a stronger security model, which requires the existence of an extractor to retrieve the original file by receiving the program of a successful prover. When using their POR protocol with public verifiability to verify the availability of multiple files separately, the number of pairing operations computed by a verifier is linear with the number of files. To improve the heavy burden on the verifier, we introduce a notion called multi-proof-of-retrievability(MPOR), allowing one verifier to verify the availability of multiple files stored by a server in one pass. We also design a MPOR protocol with public verifiability by extending the work of Shacham et al. The advantage of our MPOR scheme is that computational overhead of a verifier in our scheme is constant, independent of the number of files. Nevertheless, the soundness of our MPOR protocol is proved under a relatively weak security notion. In particular, analysis of our MPOR protocol shows that each file can be extracted in expected polynomial time under certain restriction on the size of processed files. 
]]></description>
<guid>http://eprint.iacr.org/2013/348</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/347</link>
<title><![CDATA[STES: A Stream Cipher Based Low Cost Scheme for Securing Stored Data]]>, by Debrup Chakraborty and Cuauhtemoc Mancillas-Lopez and Palash Sarkar</title>
<description><![CDATA[The problem of securing data present on USB memories and SD cards has not been adequately addressed in the cryptography literature. While the formal notion of a tweakable enciphering scheme (TES) is well accepted as the proper primitive for secure data storage, the real challenge is to design a low cost TES which can perform at the data rates of the targeted memory devices. In this work, we provide the first answer to this problem. Our solution, called STES, combines a stream cipher with a XOR universal hash function. The security
of STES is rigorously analyzed in the usual manner of provable security approach. By carefully defining appropriate variants of the multi-linear hash function and the pseudo-dot product based
hash function we obtain controllable trade-offs between area and throughput. We combine the hash function with the recent hardware oriented stream ciphers, namely Mickey, Grain and Trivium. Our implementations are targeted towards two low cost FPGAs -- Xilinx Spartan~3 and Lattice ICE40. Simulation results demonstrate
that the speed of encryption/decryption matches the data rates of different USB and SD memories. We believe that our work opens up the possibility of actually putting FPGAs within controllers of such memories to perform low-level in-place  encryption.
]]></description>
<guid>http://eprint.iacr.org/2013/347</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/346</link>
<title><![CDATA[Using Bleichenbacher's Solution to the Hidden Number Problem to Attack Nonce Leaks in 384-Bit ECDSA]]>, by Elke De Mulder and Michael Hutter and Mark E. Marson and Peter Pearson</title>
<description><![CDATA[In this paper we describe an attack against nonce leaks in 384-bit ECDSA using an FFT-based attack due to Bleichenbacher. The signatures were computed by a modern smart card. We extracted the low-order bits of each nonce using a template-based power analysis attack against the modular inversion of the nonce. We also developed a BKZ-based method for the range reduction phase of the attack, as it was impractical to collect enough signatures for the collision searches originally used by Bleichenbacher. We confirmed our attack by extracting the entire signing key using a 5-bit nonce leak from 4000 signatures.
]]></description>
<guid>http://eprint.iacr.org/2013/346</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/345</link>
<title><![CDATA[Analysis and Improvement of the Generic Higher-Order Masking Scheme of FSE 2012]]>, by Arnab Roy and Srinivas Vivek</title>
<description><![CDATA[Masking is a well-known technique used to prevent block cipher implementations from side-channel attacks. Higher-order side channel attacks (e.g. higher-order DPA attack) on widely used block cipher like AES have motivated the design of efficient higher-order masking schemes. Indeed, it is known that as the masking order increases, the difficulty of side-channel attack increases exponentially. However, the main problem in higher-order masking is to design an efficient and secure technique for S-box computations in block cipher implementations. At FSE 2012, Carlet et al. proposed a generic masking scheme that can be applied to any S-box at any order. This is the first generic scheme for efficient software implementations. Analysis of the running time, or \textit{masking complexity}, of this scheme is related to a variant of the well-known problem of efficient exponentiation (\textit{addition chain}), and evaluation of polynomials. 

In this paper we investigate optimal methods for exponentiation
in $\mathbb{F}_{2^{n}}$ by studying a variant of addition chain,
which we call \textit{cyclotomic-class addition chain}, or \textit{CC-addition chain}. Among several interesting properties, we prove lower bounds on min-length CC-addition
chains. We define the notion of \GFn-polynomial chain, and use it to count the number of \textit{non-linear} multiplications required while evaluating polynomials over $\mathbb{F}_{2^{n}}$. We also give a lower bound on the length of such a chain for any polynomial. As a consequence, we show that a lower bound for the masking complexity of DES S-boxes is three, and that of PRESENT S-box is two. We disprove a claim previously made by Carlet et al. regarding min-length CC-addition chains. Finally, we give a polynomial evaluation method, which results into an improved masking scheme (compared to the technique of Carlet et al.) for DES S-boxes. As an illustration we apply this method to several other S-boxes and show significant improvement for them.
]]></description>
<guid>http://eprint.iacr.org/2013/345</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/344</link>
<title><![CDATA[Limits of provable security for homomorphic encryption]]>, by Andrej Bogdanov and Chin Ho Lee</title>
<description><![CDATA[We show that public-key bit encryption schemes which support weak (i.e., compact) homomorphic evaluation of any sufficiently "sensitive" collection of functions cannot be proved message indistinguishable beyond AM intersect coAM via general (adaptive) reductions, and beyond statistical zero-knowledge via reductions of constant query complexity. Examples of sensitive collections include parities, majorities, and the class consisting of all AND and OR functions.

Our techniques also give a method for converting a strong (i.e., distribution-preserving) homomorphic evaluator for essentially any boolean function (except the trivial ones, the NOT function, and the AND and OR functions) into a rerandomization algorithm: This is a procedure that converts a ciphertext into another ciphertext which is statistically close to being independent and identically distributed with the original one. Our transformation preserves negligible statistical error.
]]></description>
<guid>http://eprint.iacr.org/2013/344</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/343</link>
<title><![CDATA[Quantum one-time programs]]>, by Anne Broadbent and Gus Gutoski and Douglas Stebila</title>
<description><![CDATA[A one-time program is a hypothetical device by which a user may evaluate a circuit on exactly one input of his choice, before the device self-destructs.  One-time programs cannot be achieved by software alone, as any software can be copied and re-run. However, it is known that every circuit can be compiled into a one-time program using a very basic hypothetical hardware device called a one-time memory. At first glance it may seem that quantum information, which cannot be copied, might also allow for one-time programs. But it is not hard to see that this intuition is false: one-time programs for classical or quantum circuits based solely on quantum information do not exist, even with computational assumptions.  

This observation raises the question, "what assumptions are required to achieve one-time programs for quantum circuits?" Our main result is that any quantum circuit can be compiled into a one-time program assuming only the same basic one-time memory devices used for classical circuits. Moreover, these quantum one-time programs achieve statistical universal composability (UC-security) against any malicious user. Our construction employs methods for computation on authenticated quantum data, and we present a new quantum authentication scheme called the trap scheme for this purpose. As a corollary, we establish UC-security of a recent protocol for delegated quantum computation.

]]></description>
<guid>http://eprint.iacr.org/2013/343</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/342</link>
<title><![CDATA[Attribute-Based Encryption for a Subclass of Circuits with Bounded Depth from Lattices]]>, by Xiang Xie and Rui Xue</title>
<description><![CDATA[In this work, we present two Key-Policy Attribute-Based Encryption (ABE) schemes for some subclass of circuits based on the Learning with Error (LWE) assumption. Our constructions are selectively secure in the standard model. More specifically, our first construction supports a subclass of circuits with polynomially bounded depth. We call this subclass the OR-restricted circuits which means that for any input $x$, if $f(x)=0$ then for all the OR gates in $f$, at least one of its incoming wires will evaluate to $0$. The second one is a Key-Policy ABE scheme for shallow circuits whose depth is bounded by $O(\log\log\lambda)$, where $\lambda$ is the security parameter.
]]></description>
<guid>http://eprint.iacr.org/2013/342</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/341</link>
<title><![CDATA[Trapdoor Smooth Projective Hash Functions]]>, by Fabrice Benhamouda and David Pointcheval</title>
<description><![CDATA[Katz and Vaikuntanathan recently improved smooth projective hash functions in order to build one-round password-authenticated key exchange protocols (PAKE). To achieve security in the UC framework they allowed the simulator to extract the hashing key, which required simulation-sound non-interactive zero-knowledge proofs that are unfortunately inefficient.

We improve the way the latter extractability is obtained by introducing the notion of trapdoor smooth projective hash function (TSPHF). A TSPHF is an SPHF with a trapdoor, which may not allow to recover the complete hashing key, but which still allows to compute the hash value, which is enough for an application to PAKE with UC-security against static corruptions. We additionally show that TSPHFs yield zero-knowledge proofs in two flows, with straight-line extractability.

Besides those quite interesting applications of TSPHF, we also show how to generically build them on languages of ciphertexts, using any ElGamal-like encryption. Our concrete instantiations lead to efficient one-round UC-secure PAKE, extractable zero-knowledge arguments, and verifiable encryption of Waters signatures. In the case of the PAKE, our construction is the most efficient one-round UC-secure PAKE to date.
]]></description>
<guid>http://eprint.iacr.org/2013/341</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/340</link>
<title><![CDATA[Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based]]>, by Craig Gentry and Amit Sahai and Brent Waters</title>
<description><![CDATA[We describe a comparatively simple fully homomorphic encryption (FHE) scheme based on the learning with errors (LWE) problem. In previous LWE-based FHE schemes, multiplication is a complicated and expensive step involving "relinearization". In this work, we propose a new technique for building FHE schemes that we call the "approximate eigenvector" method. In our scheme, for the most part, homomorphic addition and multiplication are just matrix addition and multiplication. This makes our scheme both asymptotically faster and (we believe) easier to understand.

In previous schemes, the homomorphic evaluator needs to obtain the user's "evaluation key", which consists of a chain of encrypted secret keys.  Our scheme has no evaluation key.  The evaluator can do homomorphic operations without knowing the user's public key at all, except for some basic parameters. This fact helps us construct the first identity-based FHE scheme. Using similar techniques, we show how to compile a recent attribute-based encryption scheme for circuits by Gorbunov et al. into an attribute-based FHE scheme that permits data encrypted under the same index to be processed homomorphically.
]]></description>
<guid>http://eprint.iacr.org/2013/340</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/339</link>
<title><![CDATA[On the Security of the TLS Protocol: A Systematic Analysis]]>, by Hugo Krawczyk and Kenneth G. Paterson and Hoeteck Wee</title>
<description><![CDATA[TLS is the most widely-used cryptographic protocol on the Internet. It comprises the TLS Handshake Protocol, responsible for authentication and key establishment, and the TLS Record Protocol, which takes care of subsequent use of those keys to protect bulk data. TLS has proved remarkably stubborn to analysis using the tools of modern cryptography. This is due in part to its complexity and its flexibility. In this paper, we present the most complete analysis to date of the TLS Handshake protocol and its application to data encryption (in the Record Protocol). We show how to extract a key-encapsulation mechanism (KEM) from the TLS Handshake Protocol, and how the security of the entire TLS protocol follows from security properties of this KEM when composed with a secure authenticated encryption scheme in the Record Protocol. The security notion we achieve is a variant of the ACCE notion recently introduced by Jager et al. (Crypto '12). Our approach enables us to analyse multiple different key establishment methods in a modular fashion, including the first proof of the most common deployment mode that is based on RSA PKCS #1v1.5 encryption, as well as Diffie-Hellman modes. Our results can be applied to settings where mutual authentication is provided and to the more common situation where only server authentication is applied.
]]></description>
<guid>http://eprint.iacr.org/2013/339</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/338</link>
<title><![CDATA[Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust]]>, by Yevgeniy Dodis and David Pointcheval and Sylvain Ruhault and Damien Vergnaud and Daniel Wichs </title>
<description><![CDATA[A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is indistinguishable from uniform. A formal security model for PRNGs with input was proposed in 2005 by Barak and Halevi (BH). This model involves an internal state that is refreshed with a (potentially biased) external random source, and a cryptographic function that outputs random numbers from the continually internal state. In this work we extend the BH model to also include a new security property capturing how it should accumulate the entropy of the input data into the internal state after state compromise. This property states that a good PRNG should be able to eventually recover from compromise even if the entropy is injected into the system at a very slow pace, and  expresses the real-life expected behavior of existing PRNG designs.

Unfortunately, we show that neither the model nor the specific PRNG construction proposed by Barak and Halevi meet this new property, despite meeting a weaker robustness notion introduced by BH. From a practical side, we also give a precise assessment of the security of the two Linux PRNGs, /dev/random and /dev/urandom. In particular, we show several attacks proving that these PRNGs are not robust according to our definition, and do not accumulate entropy properly. These attacks are due to the vulnerabilities of the entropy estimator and the internal mixing function of the Linux PRNGs. These attacks against the Linux PRNG show that it does not satisfy the "robustness" notion of security, but it remains unclear if these attacks lead to actual exploitable vulnerabilities in practice. Finally, we propose a simple and very efficient PRNG construction that is provably robust in our new and stronger adversarial model.
We therefore recommend to use this construction whenever a PRNG with input is used for cryptography.
]]></description>
<guid>http://eprint.iacr.org/2013/338</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/337</link>
<title><![CDATA[Attribute-Based Encryption for Circuits]]>, by Sergey Gorbunov and Vinod Vaikuntanathan and Hoeteck Wee</title>
<description><![CDATA[In an attribute-based encryption (ABE) scheme, a ciphertext is associated with 
an L-bit public index IND and a message m, and 
a secret key 
is associated with a
Boolean predicate P. The secret key allows to decrypt the ciphertext and learn m iff P(IND)=1. Moreover, the scheme should be secure against collusions of users, namely, 
given secret keys for polynomially many predicates, an adversary 
learns nothing about the message
if none of the secret keys can individually decrypt the ciphertext. 

We present
attribute-based encryption schemes for circuits
of any arbitrary polynomial size, where the public parameters and
the ciphertext grow linearly with the depth of the circuit. Our construction
is secure under the standard learning with errors (LWE) assumption. Previous
constructions of attribute-based encryption were for Boolean formulas, captured
by the complexity class  NC1.


In the course of our construction, we
present  a new framework for constructing ABE schemes.
As a by-product of our framework, we obtain ABE schemes 
for polynomial-size branching programs,
corresponding to the complexity class LOGSPACE, under
quantitatively better assumptions.
]]></description>
<guid>http://eprint.iacr.org/2013/337</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/336</link>
<title><![CDATA[A Novel Technique in Linear  Cryptanalysis]]>, by Wen-Long Sun Jie Guan Lin Ding</title>
<description><![CDATA[In this paper, we focus on a novel technique called cube-linear attack, which is obtained by combining the cube and linear attacks together, is first proposed to deal with the probabilistic polynomial, aiming to furthermore mine the available secret information. Based on different combination ways of the two attacks, moreover, two cube-linear schemes are discussed. Naturally, we can use cube-linear attack as an unordinary trick in linear cryptanalysis, which has never been considered by the previous linear cryptanalysis yet. As a new contribution to linear cryptanalysis, it is beneficial to allow for a reduction in the amount of data required for a successful attack in specific circumstances. Applying our method to a reduced-round Trivium, as an example, we get better linear cryptanalysis results. More importantly, we believe that the novel linear cryptanalysis technique introduced in this paper can be extended to other ciphers. In other words, it is worth considering for our method in linear cryptanalysis.
]]></description>
<guid>http://eprint.iacr.org/2013/336</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/335</link>
<title><![CDATA[Parallel and Dynamic Searchable Symmetric Encryption]]>, by Seny Kamara and Charalampos Papamanthou</title>
<description><![CDATA[Searchable symmetric encryption (SSE) enables a client to outsource a collection of encrypted documents in the cloud and retain the ability to perform keyword searches without revealing information about the contents of the documents and queries. Although efficient SSE constructions are known, previous solutions are highly sequential. This is mainly due to the fact that, currently, the only method for achieving sub-linear time search is the inverted index approach (Curtmola, Garay, Kamara and Ostrovsky, CCS '06) which requires the search algorithm to access a sequence of memory locations, each of which is unpredictable and stored at the previous location in the
sequence. 

Motivated by advances in multi-core architectures, we present a new method for constructing sub-linear SSE schemes. Our approach is highly parallelizable and dynamic. With roughly a logarithmic number of cores in place, searches for a keyword w in our scheme execute in o(r) parallel time, where r is the number of documents containing keyword w (with more cores, this bound can go down to O(log n), i.e., independent of the result size r). Such time complexity outperforms the optimal \theta(r) sequential search time--a similar bound holds for the updates. 

Our scheme also achieves the following important properties: (a) it enjoys a strong notion of security, namely security against adaptive chosen-keyword attacks; (b) compared to existing sub-linear dynamic SSE schemes (e.g., Kamara, Papamanthou, Roeder, CCS '12), updates in our scheme do not leak any information, apart from information that can be inferred from previous search tokens; (c) it can be implemented efficiently in external memory (with logarithmic I/O overhead). Our technique is simple and uses a red-black tree data structure; its security is proven in the random oracle model.
]]></description>
<guid>http://eprint.iacr.org/2013/335</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/334</link>
<title><![CDATA[Protecting PUF Error Correction by Codeword Masking]]>, by Dominik Merli and Frederic Stumpf and Georg Sigl</title>
<description><![CDATA[One of the main applications of Physical Unclonable Functions~(PUFs) is unique key generation. While the advantages of PUF-based key extraction and embedding have been shown in several papers, physical attacks on it have gained only little interest until now. In this work, we demonstrate the feasibility of a differential power analysis attack on the error correction module of a secure sketch. This attack can also be applied to code-offset fuzzy extractors because they build upon secure sketches. We propose a codeword masking scheme to protect key generation algorithms used for PUFs. Our proposed countermeasure enables masking of linear Error-Correcting Codes~(ECCs) without impact on their error correction capabilities while keeping the overhead low. This is achieved by random masking codewords, which can be efficiently generated by the ECC's encoding function. Further, it allows to consistently protect the PUF-based key generation process and can provide the masked key and its mask to a subsequent crypto module which implements masking as well. We demonstrate the practical protection of our codeword masking scheme by attacking a masked secure sketch implementation. We emphasize that, besides protecting code-offset algorithms, the proposed masking scheme can also be applied to index-based syndrome coding and other security-critical error correction modules.
]]></description>
<guid>http://eprint.iacr.org/2013/334</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/333</link>
<title><![CDATA[Double-authentication-preventing signatures]]>, by Bertram Poettering and Douglas Stebila</title>
<description><![CDATA[Digital signatures are often used by trusted authorities to make unique bindings between a subject and a digital object; for example, certificate authorities certify a public key belongs to a domain name, and time-stamping authorities certify that a certain piece of information existed at a certain time.  Traditional digital signature schemes however impose no uniqueness conditions, so a malicious or coerced authority can make multiple certifications for the same subject but different objects.  We propose the notion of a \emph{double-authentication-preventing signature}, in which a value to be signed is split into two parts: a \emph{subject} and a \emph{message}.  If a signer ever signs two different messages for the same subject, enough information is revealed to allow anyone to compute valid signatures on behalf of the signer.  This double-signature forgeability property prevents, or at least strongly \emph{discourages}, signers misbehaving.  We give a generic construction using a new type of trapdoor functions with extractability properties, which we show can be instantiated using the group of sign-agnostic quadratic residues modulo a Blum integer.
]]></description>
<guid>http://eprint.iacr.org/2013/333</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/332</link>
<title><![CDATA[A method for obtaining lower bounds on the higher order nonlinearity of Boolean function]]>, by Mikhail S. Lobanov</title>
<description><![CDATA[Obtainment of exact value or high lower bound on the $r$-th order nonlinearity of Boolean function is a very complicated problem (especial if $r > 1$). In a number of papers lower bounds on the $r$-th order nonlinearity of Boolean function via its algebraic immunity were obtain for different $r$. This bounds is rather high for function with maximum near maximum possible algebraic immunity. In this paper we prove theorem, which try to obtain rather high lower bound on the $r$-th order nonlinearity for many functions with small algebraic immunity.
]]></description>
<guid>http://eprint.iacr.org/2013/332</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/331</link>
<title><![CDATA[New Constructions and Applications of Trapdoor DDH Groups]]>, by Yannick Seurin</title>
<description><![CDATA[Trapdoor Decisional Diffie-Hellman (TDDH) groups, introduced by Dent and Galbraith (ANTS 2006), are groups where the DDH problem is hard, unless one is in possession of a secret trapdoor which enables solving it efficiently. Despite their intuitively appealing properties, they have found up to now very few cryptographic applications. Moreover, among the two constructions of such groups proposed by Dent and Galbraith, only a single one based on hidden pairings remains unbroken.
In this paper, we extend the set of trapdoor DDH groups by giving a construction based on composite residuosity. We also introduce a more restrictive variant of these groups that we name \emph{static} trapdoor DDH groups, where the trapdoor only enables to solve the DDH problem with respect to a fixed pair $(G,G^x)$ of group elements. We give two constructions for such groups whose security relies respectively on the RSA and the factoring assumptions. Then, we show that static trapdoor DDH groups yield elementary constructions of convertible undeniable signature schemes allowing delegatable verification. Using our constructions of static trapdoor DDH groups from the RSA or the factoring assumption, we obtain slightly simpler variants of the undeniable signature schemes of respectively Gennaro, Rabin, and Krawczyk (J. Cryptology, 2000) and Galbraith and Mao (CT-RSA 2003). These new schemes are conceptually more satisfying since they can strictly be viewed as instantiations, in an adequate group, of the original undeniable signature scheme of Chaum and van Antwerpen (CRYPTO~'89).
]]></description>
<guid>http://eprint.iacr.org/2013/331</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/330</link>
<title><![CDATA[Trapdoor Privacy in Asymmetric Searchable Encryption Schemes]]>, by Afonso Arriaga and Qiang Tang</title>
<description><![CDATA[We investigate the open problem, namely trapdoor privacy, in
asymmetric searchable encryption (ASE) schemes. We first present two trapdoor privacy definitions (i.e. 2-TRAP-PRIV and poly-TRAP-PRIV) which provide different levels of security guarantee. Motivated by the generic transformation from IBE to ASE, we introduce two key anonymity properties (i.e. 2-KEY-ANO and poly-KEY-ANO) for IBE schemes, so that these properties directly lead to the resulting ASE's 2-TRAP-PRIV and poly-TRAP-PRIV properties respectively at the end of a transformation. We then present a simplified
Boyen-Waters scheme and prove that it achieves IBE-IND-CPA, IBEANO
(anonymity), and 2-KEY-ANO security in the random oracle model. Finally, we extend the simplified Boyen-Waters scheme to be based on pairings over composite-order groups and prove that the extended scheme achieves poly-KEY-ANO security without random oracles.
]]></description>
<guid>http://eprint.iacr.org/2013/330</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/329</link>
<title><![CDATA[Protocol Variants and Electronic Identification]]>, by Kristian Gjøsteen</title>
<description><![CDATA[It is important to be able to evaluate information security systems involving humans. We propose an approach in which we consider the system as a cryptographic protocol, and users are modeled as ordinary players. To model the fact that users make mistakes that affect security, we introduce protocol variants that model mistakes or combinations of mistakes. By analysing the base protocol and its variants, and at the same time considering how likely each variant is, we get a reasonable estimate of the real security of the system.

Our work takes the form of a case study of four Norwegian federated identity systems, as well as two proposals for improved systems. The four systems span a good mix of various types of federated identity systems.
]]></description>
<guid>http://eprint.iacr.org/2013/329</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/328</link>
<title><![CDATA[A Proof that the ARX Cipher Salsa20 is Secure against Differential Cryptanalysis]]>, by Nicky Mouha and Bart Preneel</title>
<description><![CDATA[An increasing number of cryptographic primitives are built using the ARX operations: addition modulo $2^n$, bit rotation and XOR. Because of their very fast performance in software, ARX ciphers are becoming increasingly common. However, not a single ARX cipher has yet been proven to be secure against one of the most common attacks in symmetric-key cryptography: differential cryptanalysis. In this paper, we prove that no differential characteristic exists for 15 rounds of Salsa20 with a higher probability than $2^{-130}$. Thereby, we show that the full 20-round Salsa20 with a 128-bit key is secure against differential cryptanalysis, with a security margin of 5 rounds. Our proof holds both in single-key and related-key settings. Furthermore, our proof technique only involves writing out simple equations for every addition, rotation and XOR operation in the cipher, and applying an off-the-shelf SAT solver. To prove that Salsa20 is secure against differential cryptanalysis requires only about 20 hours of computation on a single CPU core.
]]></description>
<guid>http://eprint.iacr.org/2013/328</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/327</link>
<title><![CDATA[A Lightweight Hash Function Resisting Birthday Attack and Meet-in-the-middle Attack]]>, by Shenghui Su and Tao Xie and Shuwang Lu</title>
<description><![CDATA[In this paper, to match a lightweight digital signing scheme of which the length of modulus is between 80 and 160 bits, a lightweight hash function called JUNA is proposed. It is based on the intractabilities MPP and ASPP, and regards a short message or a message digest as an input which is treated as only one block. The JUNA hash contains two algorithms: an initialization algorithm and a compression algorithm, and converts a string of n bits into another of m bits, where 80 <= m <= n <= 4096. The two algorithms are described, and their securities are analyzed from several aspects. The analysis shows that the JUNA hash is one-way, weakly collision-free, strongly collision-free along with a proof, especially resistant to birthday attack and meet-in-the-middle attack, and up to the security of O(2 ^ m) arithmetic steps at present, while the time complexity of its compression algorithm is O(n) arithmetic steps. Moreover, the JUNA hash with short input and small computation may be used to reform a classical hash with output of n bits and security of O(2 ^ (n / 2)) into a compact hash with output of n / 2 bits and equivalent security. Thus, it opens a door to convenience for utilization of lightweight digital signing schemes.
]]></description>
<guid>http://eprint.iacr.org/2013/327</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/326</link>
<title><![CDATA[Key-Versatile Signatures and Applications: RKA, KDM and Joint Enc/Sig]]>, by Mihir Bellare and Sarah Meiklejohn and Susan Thomson</title>
<description><![CDATA[Given an *arbitrary* one-way function F, is it possible to design a signature scheme where the secret key is an input x to F and the public key is y = F(x)? We show that signatures that are "key-versatile" in this sense, while also meeting stronger-than-usual security conditions we define, enable us to add signature-based integrity that is "for-free" in terms of key material, meaning we can sign with keys already in use for another purpose without impacting the security of the original purpose or in turn being impacted by it. We show applications across diverse areas including (1) security against related-key attack (RKA) (2) security for key-dependent messages (KDM), and (3) joint encryption and signing. We show how to build key-versatile signature schemes and then obtain new results in all these application domains in a modular way.
]]></description>
<guid>http://eprint.iacr.org/2013/326</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/318</link>
<title><![CDATA[Fully-Anonymous Functional Proxy-Re-Encryption]]>, by Yutaka Kawai and Katsuyuki Takashima</title>
<description><![CDATA[In this paper, we introduce a general notion of functional proxy-re-encryption (F-PRE), where a wide class of functional encryption (FE) is combined with proxy-re-encryption (PRE) mechanism. The PRE encryption system should reveal minimal information to a proxy, in particular, hiding parameters of re-encryption keys and of original ciphertexts which he manipulate is highly desirable. We first formulate such a fully-anonymous security notion of F-PRE including usual payload-hiding properties. We then propose the first fully-anonymous inner-product PRE (IP-PRE) scheme, whose security is proven under the DLIN assumption and the existence of a strongly unforgeable one-time signature scheme in the standard model. Also, we propose the first ciphertext-policy F-PRE scheme with the access structures of Okamoto-Takashima (CRYPTO 2010), which also has an anonymity property for re-encryption keys as well as payload-hiding for original and re-encrypted ciphertexts. The security is proven under the same assumptions as the above IP-PRE scheme in the standard model. For these results, we develop novel blind delegation and new hidden subspace generation techniques on the dual system encryption (DSE) technique and the dual pairing vector spaces (DPVS). These techniques seem difficult to be realized by a composite-order bilinear group DSE approach. 
]]></description>
<guid>http://eprint.iacr.org/2013/318</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/313</link>
<title><![CDATA[Reducing Pairing Inversion to Exponentiation Inversion using Non-degenerate Auxiliary Pairing]]>, by Seunghwan Chang and Hoon Hong and Eunjeong Lee and Hyang-Sook Lee</title>
<description><![CDATA[
The security of pairing-based cryptosystems is closely related to the difficulty of the pairing inversion problem. Building on previous works, we provide  further contributions on the difficulty of pairing inversion.  In particular, we revisit the approach of   Kanayama-Okamoto who modified exponentiation inversion  and Miller inversion  by considering an ``auxiliary'' pairing. First,  by  generalizing   and simplifying Kanayama-Okamoto's approach, we provide a simpler approach for inverting generalized ate pairings of Vercauteren.  Then we provide a complexity of the  modified Miller inversion, showing that the complexity depends on the sum-norm of the integer vector defining the auxiliary pairing.   Next, we observe that the auxiliary pairings (choice of integer vectors) suggested by Kanayama-Okamoto are degenerate and thus the  modified exponentiation inversion   is expected to be harder than the original exponentiation inversion.   We provide a sufficient condition on the integer vector, in terms of its max norm, so that the corresponding auxiliary paring is non-degenerate. Finally, we define an infinite set of curve parameters, which includes those of typical pairing friendly curves, and we show that, within those parameters, pairing inversion of arbitrarily given generalized ate pairing can be reduced to exponentiation inversion in polynomial time.

]]></description>
<guid>http://eprint.iacr.org/2013/313</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/311</link>
<title><![CDATA[Four dimensional GLV via the Weil restriction]]>, by Aurore Guillevic and Sorina Ionica</title>
<description><![CDATA[The Gallant-Lambert-Vanstone (GLV) algorithm uses efficiently computable endomorphisms to accelerate the computation of scalar multiplication of points on an abelian variety. Freeman and Satoh proposed for cryptographic use two families of genus 2 curves defined over $\F_{p}$ which have the property that the corresponding Jacobians are $(2,2)$-isogenous over an extension field to a product of elliptic curves defined over $\F_{p^2}$. We exploit the relationship between the endomorphism rings of isogenous abelian varieties to exhibit efficiently computable endomorphisms on both the genus 2 Jacobian and the elliptic curve. This leads to a four dimensional GLV method on Freeman and Satoh's Jacobians and on two new families of elliptic curves defined over $\F_{p^2}$. 
]]></description>
<guid>http://eprint.iacr.org/2013/311</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/304</link>
<title><![CDATA[Secure PRNG Seeding on Commercial Off-the-Shelf Microcontrollers]]>, by Anthony Van Herrewege and Vincent van der Leest and Andr\'e Schaller and Stefan Katzenbeisser and Ingrid Verbauwhede</title>
<description><![CDATA[The generation of high quality random numbers is crucial to many cryptographic applications, including cryptographic protocols, secret of keys, nonces or salts. Their values must contain enough randomness to be unpredictable to attackers. Pseudo-random number generators require initial data with high entropy as a seed to produce a large stream of high quality random data. Yet, despite the importance of randomness, proper high quality random number generation is often ignored. Primarily embedded devices often suffer from weak random number generators. In this work, we focus on identifying and evaluating SRAM in commercial off-the-shelf microcontrollers as an entropy source for PRNG seeding. We measure and evaluate the SRAM start-up patterns of two popular types of microcontrollers, a STMicroelectronics STM32F100R8 and a Microchip PIC16F1825. We also present an efficient software-only architecture for secure PRNG seeding. After analyzing over 1 000 000 measurements in total, we conclude that of these two devices, the PIC16F1825 cannot be used to securely seed a PRNG. The STM32F100R8, however, has the ability to generate very strong seeds from the noise in its SRAM start-up pattern. These seeds can then be used to ensure a PRNG generates high quality data.
]]></description>
<guid>http://eprint.iacr.org/2013/304</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/250</link>
<title><![CDATA[Fully Homomorphic Encryption for Mathematicians]]>, by Alice Silverberg</title>
<description><![CDATA[We give an introduction to Fully Homomorphic Encryption for mathematicians. Fully Homomorphic Encryption allows untrusted parties to take encrypted data Enc(m_1),...,Enc(m_t) and any efficiently computable function f, and compute an encryption of f(m_1,...,m_t), without knowing or learning the decryption key or the raw data m_1,...,m_t. The problem of how to do this was recently solved by Craig Gentry, using ideas from algebraic number theory and the geometry of numbers. In this paper we discuss some of the history and background, give examples of Fully Homomorphic Encryption schemes, and discuss the hard mathematical problems on which the cryptographic security is based.

]]></description>
<guid>http://eprint.iacr.org/2013/250</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/246</link>
<title><![CDATA[A Lever Function to a New Codomain with Adequate Indeterminacy]]>, by Shenghui Su and Maozhi Xu and Shuwang Lu</title>
<description><![CDATA[The key transforms of the REESSE1+ cryptosystem is Ci = (Ai * W ^ l(i)) ^ d (% M) with l(i) in O = {5, 7, ..., 2n + 3} for i = 1, ..., n, where l(i) is called a lever function. In this paper, the authors give a new codomain O± from {±5, ..., ±(n + 4)} and with x + y != 0 for any x, y in O±, where "±x" means the coexistence of "+x" and "-x", which indicates that O± is indeterminate. Then, discuss the necessity and sufficiency of l(.) to O± for resisting continued fraction attack (CFA), prove indeterminacy and other properties of l(.) to O±, illustrate the ineffectualness of CFA by using two examples which show that some conditions are only necessary but not sufficient for the counteraction of powers of W and W ^ -1 even though O± = {5, ..., n + 4} is selected and known, analyze the time complexities of CFA and root finding attack with guess, and expound a relation between a lever function and a random oracle. Our research manifests that l(.) to O± makes it generally impossible to extract a private key from a flat public key Ci = Ai * W ^ l(i)(% M) for i = 1, ..., n in polynomial time. 


]]></description>
<guid>http://eprint.iacr.org/2013/246</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/235</link>
<title><![CDATA[Ballot secrecy and ballot independence coincide]]>, by Ben Smyth and David Bernhard</title>
<description><![CDATA[We study ballot independence for election schemes:

* We formally define ballot independence as a cryptographic game and prove that ballot secrecy implies ballot independence.

* We introduce a notion of controlled malleability and show that it is sufficient for ballot independence. We also show that non-malleable ballots are sufficient, but not necessary, for ballot independence.

* We prove that ballot independence is sufficient for ballot secrecy under practical assumptions.

Our results show that ballot independence is necessary in election schemes satisfying ballot secrecy. Furthermore, our sufficient conditions will enable simpler proofs of ballot secrecy.
]]></description>
<guid>http://eprint.iacr.org/2013/235</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/229</link>
<title><![CDATA[How to Run Turing Machines on Encrypted Data]]>, by Shafi Goldwasser and Yael Kalai and Raluca Ada Popa and Vinod Vaikuntanathan and and Nickolai Zeldovich</title>
<description><![CDATA[Algorithms for computing on encrypted data promise to be a fundamental building block of cryptography. The way one models such algorithms has a crucial effect on the efficiency and usefulness of the resulting cryptographic schemes. As of today, almost all known schemes for fully homomorphic encryption, functional encryption, and garbling schemes work by modeling algorithms as circuits rather than as Turing machines.

As a consequence of this modeling, evaluating an algorithm over encrypted data is as slow as the worst-case running time of that algorithm, a dire fact for many tasks. In addition, in settings where an evaluator needs a description of the algorithm itself in some "encoded" form, the cost of computing and communicating such encoding is as large as the worst-case running time of this algorithm.

In this work, we construct cryptographic schemes for computing Turing machines on encrypted data that avoid the worst-case problem. Specifically, we show:

- An attribute-based encryption scheme for any polynomial-time Turing machine and Random Access Machine (RAM).

- A (single-key and succinct) functional encryption scheme for any polynomial-time Turing machine.

- A reusable garbling scheme for any polynomial-time Turing machine.

These three schemes have the property that the size of a key or of a garbling for a Turing machine is very short: it depends only on the description of the Turing machine and not on its running time. 

Previously, the only existing constructions of such schemes were for depth-d circuits, where all the parameters grow with d. Our constructions remove this depth d restriction, have short keys, and moreover, avoid the worst-case running time.

- A variant of fully homomorphic encryption scheme for Turing machines, where one can evaluate a Turing machine M on an encrypted input x in time that is dependent on the running time of M on input x as opposed to the worst-case runtime of M. Previously, such a result was known only for a restricted class of Turing machines and it required an expensive preprocessing phase (with worst-case runtime); our constructions remove both restrictions.

Our results are obtained via a reduction from SNARKs (Bitanski et al) and an "extractable" variant of witness encryption, a scheme introduced by Garg et al.. We prove that the new assumption is secure in the generic group model. We also point out the connection between (the variant of) witness encryption and the obfuscation of point filter functions as defined by Goldwasser and Kalai in 2005.
]]></description>
<guid>http://eprint.iacr.org/2013/229</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/183</link>
<title><![CDATA[Practical Multilinear Maps over the Integers]]>, by Jean-Sebastien Coron and Tancrede Lepoint and Mehdi Tibouchi</title>
<description><![CDATA[Extending bilinear elliptic curve pairings to multilinear maps is a long-standing open problem. The first plausible construction of such multilinear maps has recently been  described by Garg, Gentry and Halevi, based on ideal lattices.  In this paper we describe a
different construction that works over the integers instead of ideal lattices, similar to the DGHV fully homomorphic encryption scheme. We also describe a different technique for proving the full randomization of encodings: instead of  Gaussian linear sums, we apply the classical leftover hash lemma over a quotient lattice. We show that our construction is relatively practical: for reasonable security  parameters a one-round 7-party Diffie-Hellman key exchange requires about $25$ seconds per party.
]]></description>
<guid>http://eprint.iacr.org/2013/183</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/167</link>
<title><![CDATA[Single Password Authentication]]>, by Tolga Acar and Mira Belenkiy and Alptekin Küpçü</title>
<description><![CDATA[Users frequently reuse their passwords when authenticating to various online services. Combined with the use of weak passwords or honeypot/phishing attacks, this brings high risks to the security of the user's account information. In this paper, we propose several protocols that can allow a user to use a single password to authenticate to multiple services securely. All our constructions provably protect the user from dictionary attacks on the password, and cross-site impersonation or honeypot attacks by the online service providers.

Our solutions assume the user has access to either an untrusted online cloud storage service (as per Boyen [14]), or a mobile storage device that is trusted until stolen. In the cloud storage scenario, we consider schemes that optimize for either storage server or online service performance, as well as anonymity and unlinkability of the user's actions. In the mobile storage scenario, we minimize the assumptions we make about the capabilities of the mobile device: we do not assume synchronization, tamper resistance, special or expensive hardware, or extensive cryptographic capabilities. Most importantly, the user's password remains secure even after the mobile device is stolen. Our protocols provide another layer of security against malware and phishing. To the best of our knowledge, we are the first to propose such various and provably secure password-based authentication schemes. Lastly, we argue that our constructions are relatively easy to deploy, especially if a few single sign-on services (e.g., Microsoft, Google, Facebook) adopt our proposal.
]]></description>
<guid>http://eprint.iacr.org/2013/167</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/158</link>
<title><![CDATA[Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and their Implementation on GLV-GLS Curves]]>, by Armando Faz-Hernandez and Patrick Longa and Ana H. Sanchez</title>
<description><![CDATA[We propose efficient algorithms and formulas that improve the performance of side-channel protected elliptic curve computations, with special focus on scalar multiplication exploiting the Gallant-Lambert-Vanstone (CRYPTO 2001) and Galbraith-Lin-Scott (EUROCRYPT 2009) methods. Firstly, by adapting Feng et al.'s recoding to the GLV setting, we derive new regular algorithms for variable-base scalar multiplication that offer protection against simple side-channel and timing attacks. Secondly, we propose an efficient algorithm for fixed-base scalar multiplication that is also protected against side-channel attacks by combining Feng et al.'s recoding with Lim-Lee's comb method. Thirdly, we propose an efficient technique that interleaves ARM-based and NEON-based multiprecision operations over an extension field, as typically found on GLS curves and pairing computations, to improve performance on modern ARM processors. Finally, we showcase the efficiency of the proposed techniques by implementing a state-of-the-art GLV-GLS curve in twisted Edwards form defined over GF(p^2), which supports a four dimensional decomposition of the scalar and is fully protected against timing attacks. Analysis and performance results are reported for modern x64 and ARM processors. For instance, using a precomputed table of only 512 bytes, we compute a variable-base scalar multiplication in 92,000  and 244,000 cycles on an Intel Ivy Bridge and an ARM Cortex-A15 processor (respect.); using an off-line precomputed table of 6KB, we compute a fixed-base scalar multiplication in 53,000 and 116,000 cycles (respect.); and using a precomputed table of 3KB, we compute a double scalar multiplication in 118,000 and 285,000 cycles (respect.). All of these numbers and the proposed techniques represent a significant improvement of the state-of-the-art performance of elliptic curve computations. Most notably, our techniques allow us to reduce the cost of adding protection against timing attacks in the computation of GLV-based variable-base scalar multiplication to below 10%.
]]></description>
<guid>http://eprint.iacr.org/2013/158</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/149</link>
<title><![CDATA[Secure and Constant Cost Public Cloud Storage Auditing with Deduplication]]>, by Jiawei Yuan and Shucheng Yu</title>
<description><![CDATA[Data integrity and storage efficiency are two important requirements for cloud storage. Proof of Retrievability (POR) and Proof of Data Possession (PDP) techniques assure data integrity for cloud storage. Proof of Ownership (POW) improves storage efficiency by securely removing unnecessarily duplicated data on the storage server. However, trivial combination of the two techniques, in order to achieve both data integrity and storage efficiency, results in non-trivial duplication of metadata (i.e., authentication tags), which contradicts the objectives of POW. Recent attempts to this problem introduce tremendous computational and communication costs and have been proven not secure. It calls for a new solution to support efficient and secure data integrity auditing with storage deduplication for cloud storage. In this paper we solve this open problem with a novel scheme based on techniques including polynomial-based authentication tags and homomorphic linear authenticators. Our design allows deduplication of both files and their corresponding authentication tags. Data integrity auditing and storage deduplication are achieved simultaneously. Our proposed scheme is also characterized by constant realtime communication and computational cost on the user side. Public auditing and batch auditing are both supported. Hence, our proposed scheme outperforms existing POR and PDP schemes while providing the additional functionality of deduplication. We prove the security of our proposed scheme based on the Computational Diffie-Hellman problem and the Strong Diffie-Hellman assumption. Numerical analysis and experimental results on Amazon AWS show that our scheme is efficient and scalable.
]]></description>
<guid>http://eprint.iacr.org/2013/149</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/134</link>
<title><![CDATA[Hard-Core Predicates for a Diffie-Hellman Problem over Finite Fields]]>, by Nelly Fazio and Rosario Gennaro and Irippuge Milinda Perera and William E. Skeith III</title>
<description><![CDATA[A long-standing open problem in cryptography is proving the existence of (deterministic) hard-core predicates for the Diffie-Hellman problem defined over finite fields. In this paper, we make progress on this problem by defining a very natural variation of the Diffie-Hellman problem over $\mathbb{F}_{p^2}$ and proving the unpredictability of every single bit of one of the coordinates of the secret DH value.

To achieve our result, we modify an idea presented at CRYPTO'01 by Boneh and Shparlinski [4] originally developed to prove that the LSB of the elliptic curve Diffie-Hellman problem is hard. We extend this idea in two novel ways:

1. We generalize it to the case of finite fields $\mathbb{F}_{p^2}$;

2. We prove that any bit, not just the LSB, is hard using the list decoding techniques of Akavia et al. [1] (FOCS'03) as generalized at CRYPTO'12 by Duc and Jetchev [6].

In the process, we prove several other interesting results:

- Our result also hold for a larger class of predicates, called \emph{segment predicates} in [1];

- We extend the result of Boneh and Shparlinski to prove that every bit (and every segment predicate) of the elliptic curve Diffie-Hellman problem is hard-core;

- We define the notion of \emph{partial one-way function} over finite fields $\mathbb{F}_{p^2}$ and prove that every bit (and every segment predicate) of one of the input coordinates for these functions is hard-core.
]]></description>
<guid>http://eprint.iacr.org/2013/134</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/131</link>
<title><![CDATA[Lambda coordinates for binary elliptic curves]]>, by Thomaz Oliveira and Julio López and Diego F. Aranha and Francisco Rodríguez-Henríquez</title>
<description><![CDATA[In this work we present the $\lambda$-coordinates, a new system for representing points in binary elliptic curves. We also provide efficient elliptic curve operations based on the new representation and timing results of our software implementation over the field $\mathbb{F}_{2^{254}}$. As a result, we improve speed records for protected/unprotected single/multi-core software implementations of random-point elliptic curve scalar multiplication at the 128-bit security level. When implemented on a Sandy Bridge 3.4GHz Intel Xeon processor, our software is able to compute a single/multi-core unprotected scalar multiplication in 72,300 and 47,900 clock cycles, respectively; and a protected single-core scalar multiplication in 114,800 cycles. These numbers improve by around 2\% on the newer Core i7 2.8GHz Ivy Bridge platform.
]]></description>
<guid>http://eprint.iacr.org/2013/131</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/128</link>
<title><![CDATA[Attribute-Based Encryption for Circuits from Multilinear Maps]]>, by Sanjam Garg and Craig Gentry and Shai Halevi and Amit Sahai and Brent Waters</title>
<description><![CDATA[In this work, we provide the first construction of Attribute-Based Encryption (ABE) for general circuits. Our construction is based on the existence of multilinear maps. We prove selective security of our scheme in the standard model under the natural multilinear generalization of the BDDH assumption. Our scheme achieves both Key-Policy and Ciphertext-Policy variants of ABE. Our scheme and its proof of security directly translate to the recent multilinear map framework of Garg, Gentry, and Halevi.

This paper is the result of a merge of the works of Garg, Genry, and Halevi and of Sahai and Waters, and subsumes both these works.
]]></description>
<guid>http://eprint.iacr.org/2013/128</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/088</link>
<title><![CDATA[Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World]]>, by Dan Boneh and Mark Zhandry</title>
<description><![CDATA[We initiate the study of quantum-secure digital signatures and quantum chosen ciphertext security.  In the case of signatures, we enhance the standard chosen message
query model by allowing the adversary to issue quantum chosen message queries: given a superposition of messages, the adversary receives a superposition of signatures on those
messages.  Similarly, for encryption, we allow the adversary to issue quantum chosen ciphertext queries: given a superposition of ciphertexts, the adversary receives a superposition of their
decryptions.  These adversaries model a natural ubiquitous quantum computing environment where end-users sign messages and decrypt ciphertexts on a personal quantum computer.

We construct classical systems that remain secure when exposed to such quantum queries.  For signatures, we construct two compilers that convert classically secure signatures into signatures secure in the quantum setting and apply these compilers to existing post-quantum signatures.  We also show that standard constructions such as Lamport one-time signatures and Merkle signatures remain secure under quantum chosen message attacks, thus giving signatures whose quantum security is based on  generic assumptions.  For encryption, we define security under quantum chosen ciphertext attacks and present both public-key and symmetric-key constructions.
]]></description>
<guid>http://eprint.iacr.org/2013/088</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/081</link>
<title><![CDATA[Efficient Secure Two-Party Computation Using Symmetric Cut-and-Choose]]>, by Yan Huang and Jonathan Katz and Dave Evans</title>
<description><![CDATA[Beginning with the work of Lindell and Pinkas, researchers have proposed several protocols for secure two-party computation based on the cut-and-choose paradigm. In existing instantiations of this paradigm, one party generates $\kappa$ garbled circuits; some fraction of those are ``checked'' by the other party, and the remaining fraction are evaluated.

We introduce here the idea of symmetric cut-and-choose protocols, in which each party generates $\kappa$ circuits to be checked by the other party. The main advantage of our technique is that the number $\kappa$ of garbled circuits can be reduced by a factor of 3 while attaining the same statistical security level as in prior work. Since the number of garbled circuits dominates the costs of the protocol, especially as larger circuits are evaluated, our protocol is expected to run up to 3 times faster than existing schemes. Preliminary experiments validate this claim.
]]></description>
<guid>http://eprint.iacr.org/2013/081</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/079</link>
<title><![CDATA[Fast Cut-and-Choose Based Protocols for Malicious and Covert Adversaries]]>, by Yehuda Lindell</title>
<description><![CDATA[In the setting of secure two-party computation, two parties wish to securely compute a joint function of their private inputs, while revealing only the output. One of the primary techniques for achieving efficient secure two-party computation is that of Yao's garbled circuits (FOCS 1986). In the semi-honest model, where just one garbled circuit is constructed and evaluated, Yao's protocol has proven itself to be very efficient. However, a malicious adversary who constructs the garbled circuit may construct a garbling of a different circuit computing a different function, and this cannot be detected (due to the garbling). In order to solve this problem, many circuits are sent and some of them are opened to check that they are correct while the others are evaluated. This methodology, called \emph{cut-and-choose}, introduces significant overhead, both in computation and in communication, and is mainly due to the number of circuits that must be used in order to prevent cheating.

In this paper, we present a cut-and-choose protocol for secure computation based on garbled circuits, with security in the presence of malicious adversaries, that vastly improves on  all previous protocols of this type. Concretely, for a cheating probability of at most $2^{-40}$, the best previous works send between 125 and 128 circuits. In contrast, in our protocol 40 circuits alone suffice (with some additional overhead). Asymptotically, we achieve a cheating probability of $2^{-s}$ where $s$ is the number of garbled circuits, in contrast to the previous best of $2^{-0.32s}$. We achieve this by introducing a new cut-and-choose methodology with the property that in order to cheat, \emph{all} of the evaluated circuits must be incorrect, and not just the \emph{majority} as in previous works.
]]></description>
<guid>http://eprint.iacr.org/2013/079</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/078</link>
<title><![CDATA[Broadcast Steganography]]>, by Nelly Fazio and Antonio R. Nicolosi and Irippuge Milinda Perera</title>
<description><![CDATA[We initiate the study of broadcast steganography (BS), an extension of steganography to the multi-recipient setting. BS enables a sender to communicate covertly with a dynamically designated set of receivers, so that the recipients recover the original content, while unauthorized users and outsiders remain \emph{unaware} of the covert communication. One of our main technical contributions is the introduction of a new variant of anonymous broadcast encryption that we term \emph{outsider-anonymous broadcast encryption with pseudorandom ciphertexts} (oABE$). Our oABE$ construction achieves sublinear ciphertext size and is secure in the standard model. Besides being of interest in its own right, oABE$ enables an efficient construction of BS secure in the standard model against adaptive adversaries with sublinear communication complexity.
]]></description>
<guid>http://eprint.iacr.org/2013/078</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/074</link>
<title><![CDATA[On the Function Field Sieve and the Impact of Higher Splitting Probabilities: Application to Discrete Logarithms in $\F_{2^{1971}}$ and $\F_{2^{3164}}$]]>, by Faruk G\"olo\u{g}lu and Robert Granger and Gary McGuire and Jens Zumbr\"agel</title>
<description><![CDATA[In this paper we propose a binary field variant of the Joux-Lercier medium-sized Function Field Sieve, which results not only in complexities as low as $L_{q^n}(1/3,(4/9)^{1/3})$ for computing arbitrary logarithms, but also in an heuristic {\em polynomial time} algorithm for finding the discrete logarithms of degree one and two elements when the field has a subfield of an appropriate size.  To illustrate the efficiency of the method, we have successfully solved the DLP in the finite fields with $2^{1971}$ and $2^{3164}$ elements, setting a record for binary fields.

]]></description>
<guid>http://eprint.iacr.org/2013/074</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/069</link>
<title><![CDATA[Hardness of SIS and LWE with Small Parameters]]>, by Daniele Micciancio and Chris Peikert</title>
<description><![CDATA[The Short Integer Solution (SIS) and Learning With Errors (LWE) problems are the foundations for countless applications in lattice-based cryptography, and are provably as hard as approximate lattice problems in the worst case.  A important question from both a practical and theoretical perspective is how small their parameters can be made, while preserving their hardness.

We prove two main results on SIS and LWE with small parameters.  For SIS, we show that the problem retains its hardness for moduli $q \geq \beta \cdot n^{\delta}$ for any constant $\delta > 0$, where $\beta$ is the bound on the Euclidean norm of the solution.  This improves upon prior results which required $q \geq \beta \cdot \sqrt{n \log n}$, and is essentially optimal since the problem is trivially easy for $q \leq \beta$.  For LWE, we show that it remains hard even when the errors are small (e.g., uniformly random from $\set{0,1}$), provided that the number of samples is small enough (e.g., linear in the dimension $n$ of the LWE secret). Prior results required the errors to have magnitude at least $\sqrt{n}$ and to come from a Gaussian-like distribution.

]]></description>
<guid>http://eprint.iacr.org/2013/069</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/061</link>
<title><![CDATA[On the Indifferentiability of Key-Alternating Ciphers]]>, by Elena Andreeva and Andrey Bogdanov and Yevgeniy Dodis and Bart Mennink and John P. Steinberger</title>
<description><![CDATA[The Advanced Encryption Standard (AES) is the most widely used block cipher. The high level structure of AES can be viewed as a (10-round) key-alternating cipher, where a t-round key-alternating cipher KA_t consists of a small number $t$ of fixed permutations P_i on n bits, separated by key addition:

KA_t(K,m)= k_t + P_t(... k_2 + P_2(k_1 + P_1(k_0 + m))...),

where (k_0,...,k_t) are obtained from the master key K using some key derivation function.

For t=1, KA_1 collapses to the well-known Even-Mansour cipher, which is known to be indistinguishable from a (secret) random permutation, if P_1 is modeled as a (public) random permutation. In this work we seek for stronger security of key-alternating ciphers --- indifferentiability from an ideal cipher --- and
ask the question under which  conditions on the key derivation function and for how many rounds t is the key-alternating cipher KA_t indifferentiable from the ideal cipher, assuming P_1,...,P_t are (public) random permutations?

As our main result, we give an affirmative answer for t=5, showing that the 5-round key-alternating cipher KA_5 is indifferentiable from an ideal cipher, assuming P_1,...,P_5 are five independent random permutations, and the key derivation function sets all rounds keys
k_i=f(K), where 0<= i<= 5 and f is modeled as a random oracle. Moreover, when |K|=|m|, we show we can set f(K)=P_0(K)+K, giving an n-bit block cipher with an n-bit key, making only six calls to n-bit permutations P_0,P_1,P_2,P_3,P_4,P_5.

]]></description>
<guid>http://eprint.iacr.org/2013/061</guid>
</item>
<item>
<link>http://eprint.iacr.org/2013/019</link>
<title><![CDATA[Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers]]>, by Peter Gazi</title>
<description><![CDATA[Cascading-based constructions represent the predominant approach
to the problem of key-length extension for block ciphers.
Besides the plain cascade, existing works also consider its
modification containing key-whitening steps between the
invocations of the block cipher, called randomized cascade or
XOR-cascade.  We contribute to the understanding of the security
of these two designs by giving the following attacks and security
proofs, assuming an underlying ideal block cipher with key length
$k$ and block length $n$:

 - For the plain cascade of odd (resp. even) length $l$ we
   present a generic attack requiring roughly
   $2^{k+\frac{l-1}{l+1}n}$ (resp. $2^{k+\frac{l-2}{l}n}$)
   queries, being a generalization of both the meet-in-the-middle
   attack on double encryption and the best known attack on triple
   cascade.

 - For XOR-cascade of odd (resp. even) length $l$ we prove
   security up to $2^{k+\frac{l-1}{l+1}n}$ (resp.
   $2^{k+\frac{l-2}{l}n}$) queries and also an improved bound
   $2^{k+\frac{l-1}{l}n}$ for the special case $l\in\{3,4\}$ by
   relating the problem to the security of key-alternating ciphers
   in the random-permutation model.

 - Finally, for a natural class of sequential constructions where
   block-cipher encryptions are interleaved with key-dependent
   permutations, we show a generic attack requiring roughly
   $2^{k+\frac{l-1}{l}n}$ queries. Since XOR-cascades are
   sequential, this proves tightness of our above result for
   XOR-cascades of length $l\in\{3,4\}$ as well as their optimal
   security within the class of sequential constructions.

These results suggest that XOR-cascades achieve a better
security/efficiency trade-off than plain cascades and should be
preferred.

]]></description>
<guid>http://eprint.iacr.org/2013/019</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/685</link>
<title><![CDATA[Square root computation over even extension fields]]>, by Gora Adj and Francisco Rodr\'iguez-Henr\'iquez</title>
<description><![CDATA[This paper presents a comprehensive study of the computation of square roots over finite extension fields.
We propose two novel algorithms for computing square roots over even field extensions 
of the form $\F_{q^{2}}$, with $q=p^n,$ $p$ an odd prime and $n\geq 1$. Both algorithms have an associate 
computational cost roughly equivalent to one exponentiation in $\F_{q^{2}}$.
The first algorithm is devoted to the case when $q\equiv 1 \bmod 4$, whereas the second one handles the case when
$q\equiv 3 \bmod 4$. Numerical comparisons show that the two algorithms presented in this paper are competitive 
and in some cases more efficient than the square root methods previously known.

]]></description>
<guid>http://eprint.iacr.org/2012/685</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/658</link>
<title><![CDATA[Digital Signatures with Minimal Overhead from Indifferentiable Random Invertible Functions]]>, by Eike Kiltz and Krzysztof Pietrzak and Mario Szegedy</title>
<description><![CDATA[In a digital signature scheme with message recovery, rather than transmitting the message $m$ and its signature $\sigma$, a single enhanced signature $\tau$ is transmitted. The verifier is able to recover $m$ from $\tau$ and at the same time
verify its authenticity. The two most important parameters of such a scheme are its security and overhead $|\tau|-|m|$. A simple argument shows that for any scheme with ``$n$ bits security" $|\tau|-|m|\ge n$, i.e., the overhead is lower bounded by the security parameter $n$.

Currently, the best known constructions in the random oracle model are far from this lower bound requiring an overhead of $n+\log q_h$, where $q_h$ is the number of queries to the random oracle. In this paper we give a construction which basically matches the $n$ bit lower bound. We propose a simple digital signature scheme with $n+o(\log q_h)$ bits overhead, where $q_h$ denotes the number of random oracle queries.

Our construction works in two steps. First, we propose a signature scheme with message recovery having optimal overhead in a new ideal model, the random invertible function model. Second, we show that a four-round Feistel network with random oracles as round functions is tightly "public-indifferentiable'' from a random invertible function. At the core of our indifferentiability proof is an almost tight upper bound for the expected number of edges of the densest "small'' subgraph of a random Cayley graph, which may be of independent interest.
]]></description>
<guid>http://eprint.iacr.org/2012/658</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/494</link>
<title><![CDATA[Protocol Misidentification Made Easy with Format-Transforming Encryption]]>, by Kevin P. Dyer and Scott E. Coull and Thomas Ristenpart and Thomas Shrimpton</title>
<description><![CDATA[Deep packet inspection (DPI) technologies provide much-needed visibility and control of network traffic using port-independent protocol identification, where a network flow is labeled with its application-layer protocol based on packet contents.  In this paper, we provide the first comprehensive evaluation of a large set of DPI systems from the point of view of protocol misidentification attacks, in which adversaries on the network attempt to force the DPI to mislabel connections.  Our approach uses a new cryptographic primitive called format-transforming encryption (FTE), which, intuitively, extends conventional symmetric encryption with the ability to transform the ciphertext into a format of our choosing.  We design an FTE-based record layer that can encrypt arbitrary application-layer traffic, and we experimentally 
show that this forces misidentification for all of the evaluated DPI systems. This set includes
a proprietary, enterprise-class DPI system used by large corporations and nation-states.
We also show that using FTE as a proxy system incurs no latency overhead and only 16\% more bandwidth than standard SSH tunnels.  Finally, we integrate our FTE proxy into Tor and demonstrate that it evades real-world censorship by the Great Firewall of China.
]]></description>
<guid>http://eprint.iacr.org/2012/494</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/472</link>
<title><![CDATA[On the Simplicity of Converting Leakages from Multivariate to Univariate - Case Study of a Glitch-Resistant Masking Scheme -]]>, by Amir Moradi and Oliver Mischke</title>
<description><![CDATA[Several masking schemes to protect cryptographic implementations against side-channel attacks have been proposed. A few considered the glitches, and provided security proofs in presence of such inherent phenomena happening in logic circuits. One which is based on multi-party computation protocols and utilizes Shamir's secret sharing scheme was presented at CHES 2011. It aims at providing security for hardware implementations - mainly of AES - against those sophisticated side-channel attacks that also take glitches into account. One part of this article deals with the practical issues and relevance of the aforementioned masking scheme. Following the recommendations given in the extended version of the mentioned article, we first provide a guideline on how to implement the scheme for the simplest settings. Constructing an exemplary design of the scheme, we provide practical side-channel evaluations based on a Virtex-5 FPGA. Our results demonstrate that the implemented scheme is indeed secure against univariate power analysis attacks given a basic measurement setup. In the second part of this paper we show how using very simple changes in the measurement setup opens the possibility to exploit multivariate leakages while still performing a univariate attack. Using these techniques the scheme under evaluation can be defeated using only a moderate number of measurements. This is applicable not only to the scheme showcased here, but also to most other known masking schemes where the shares of sensitive values are processed in adjacent clock cycles.
]]></description>
<guid>http://eprint.iacr.org/2012/472</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/409</link>
<title><![CDATA[MDPC-McEliece: New McEliece Variants from Moderate Density Parity-Check Codes]]>, by Rafael Misoczki and Jean-Pierre Tillich and Nicolas Sendrier and Paulo S. L. M. Barreto</title>
<description><![CDATA[In this work, we propose two McEliece cryptosystem variants: one from Moderate Density Parity-Check (MDPC) codes and another from quasi-cyclic MDPC codes. MDPC codes are LDPC codes of higher density than what is usually adopted for telecommunication applications. In general, this leads to a worse error-correction capability. However, in code-based cryptography we are not necessarily interested in correcting many errors, but only a number which ensures an adequate security level, a condition satisfied by MDPC codes. The benefits of their employment are many. Under a reasonable assumption, MDPC codes reduce the key-distinguishing McEliece problem to the problem of decoding linear codes. Since the message-attacks against the McEliece scheme also reduce to this problem, the security of our scheme has the benefit of relying on a single, well studied coding-theory problem. Furthermore, adding a quasi-cyclic structure, our proposal provides extremely compact-keys: for $80$-bits of security, the public-key has only $4801$ bits. 
]]></description>
<guid>http://eprint.iacr.org/2012/409</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/381</link>
<title><![CDATA[A Strongly Secure Authenticated Key Exchange Protocol from Bilinear Groups without Random Oracles]]>, by Zheng Yang</title>
<description><![CDATA[Since the introducing of extended Canetti-Krawczyk~(eCK) security model for two party key exchange, many protocols have been proposed to provide eCK security. However, most of those protocols are provably secure in the random oracle model or rely on special design technique well-known as the NAXOS trick. In contrast to previous schemes, we present an eCK secure protocol in the standard model, without NAXOS trick and without knowledge of secret key (KOSK) assumption for public key registration. The security proof of our scheme is based on standard pairing assumption, collision resistant hash functions, Bilinear Decision Diffie-Hellman (BDDH) and Decision Linear Diffie-Hellman (DLIN) assumptions, and pseudo-random functions with pairwise independent random source. Although our proposed protocol is based on bilinear groups, it doesn't need any pairing operations during protocol execution.
]]></description>
<guid>http://eprint.iacr.org/2012/381</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/319</link>
<title><![CDATA[Bounds on the Threshold Gap in Secret Sharing and its Applications]]>, by Ignacio Cascudo and Ronald Cramer and Chaoping Xing</title>
<description><![CDATA[We consider the class of  secret sharing schemes where there is no a priori bound on the  number of players $n$ but where each of the $n$ share-spaces has fixed cardinality~$q$.  We show two fundamental lower bounds on the {\em threshold gap} of such schemes.
The threshold gap $g$ is defined as $r-t$, where $r$  is minimal and $t$ is maximal such that
the following holds: for a secret with arbitrary a priori distribution, each $r$-subset of players can
 reconstruct this secret from their joint shares without error ($r$-reconstruction) and the information
 gain about the secret is nil for each $t$-subset of players jointly ($t$-privacy).
Our first bound, which is completely general, implies that if $1\leq t<r\leq n$,
then $g \geq \frac{n-t+1}{q}$  independently of the cardinality of the secret-space.  Our second bound pertains to
$\FF_q$-linear schemes with secret-space $\Fq^k$ ($k\geq 2$). It improves the first bound when $k$ is large enough. Concretely, it  implies that
 $g\geq\frac{n-t+1}{q}+f(q,k,t,n)$, for some function $f$ that is strictly positive when $k$ is large enough.
 Moreover, also in the $\FF_q$-linear case,  bounds on the threshold gap {\em independent} of $t$ or $r$ are obtained by additionally employing a dualization argument.
As an application of our results, we answer
 an open question about the asymptotics of {\em arithmetic secret sharing schemes} and prove that the asymptotic optimal corruption tolerance rate is strictly smaller than~1.
]]></description>
<guid>http://eprint.iacr.org/2012/319</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/199</link>
<title><![CDATA[Using Symmetries in the Index Calculus for Elliptic Curves Discrete Logarithm]]>, by Jean-Charles Faugère and Pierrick Gaudry and Louise Huot and Guénaël Renault</title>
<description><![CDATA[In 2004, an algorithm is introduced to solve the DLP for elliptic
curves defined over a non prime finite field $\F_{q^n}$.  One of the
main steps of this algorithm requires decomposing points of the curve
$E(\F_{q^n})$ with respect to a factor base, this problem is denoted
PDP. In this paper, we will apply this algorithm to the case of
Edwards curves, the well-known family of elliptic curves that allow
faster arithmetic as shown by Bernstein and Lange. More precisely, we
show how to take advantage of some symmetries of twisted Edwards and
twisted Jacobi intersections curves to gain an exponential factor
\(2^{\omega (n-1)}\) to solve the corresponding PDP where $\omega$ is
the exponent in the complexity of multiplying two dense
matrices. Practical experiments supporting the theoretical result are
also given.  For instance, the complexity of solving the ECDLP for
twisted Edwards curves defined over $\F_{q^5}$, with
\(q\approx2^{64}\), is supposed to be $\sim$ $2^{160}$ operations in
$E(\F_{q^5})$ using generic algorithms compared to \(2^{130}\)
operations (multiplication of two $32$-bits words) with our
method. For these parameters the PDP is intractable with the original
algorithm.

The main tool to achieve these results relies on the use of the
symmetries and the quasi-homogeneous structure induced by these
symmetries during the polynomial system solving step. Also, we use a
recent work on a new algorithm for the change of ordering of Gröbner
basis which provides a better heuristic complexity of the total
solving process.
]]></description>
<guid>http://eprint.iacr.org/2012/199</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/196</link>
<title><![CDATA[Multi-Instance Security and its Application to Password-Based Cryptography]]>, by Mihir Bellare and Thomas Ristenpart and Stefano Tessaro</title>
<description><![CDATA[This paper develops a theory of multi-instance (mi) security and
applies it to provide the first proof-based support for the classical
practice of salting in password-based cryptography. Mi-security comes
into play in settings (like password-based cryptography) where it is
computationally feasible to compromise a single instance, and provides
a second line of defense, aiming to ensure (in the case of passwords,
via salting) that the effort to compromise all of some large number
$m$ of instances grows linearly with m. The first challenge is
definitions, where we suggest LORX-security as a good metric for mi
security of encryption and support this claim by showing it implies
other natural metrics, illustrating in the process that even lifting
simple results from the si setting to the mi one calls for new
techniques. Next we provide a composition-based framework to transfer
standard single-instance (si) security to mi-security with the aid of
a key-derivation function.  Analyzing password-based KDFs from the
PKCS#5 standard to show that they meet our indifferentiability-style
mi-security definition for KDFs, we are able to conclude with the
first proof that per password salts amplify mi-security as hoped in
practice.  We believe that mi-security is of interest in other domains
and that this work provides the foundation for its further theoretical
development and practical application.
]]></description>
<guid>http://eprint.iacr.org/2012/196</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/139</link>
<title><![CDATA[Formal verication of secure ad-hoc network routing protocols using deductive model-checking]]>, by Ta Vinh Thong </title>
<description><![CDATA[Ad-hoc networks do not rely on a pre-installed infrastructure, but they
are formed by end-user devices in a self-organized manner. A consequence
of this principle is that end-user devices must also perform routing functions.
However, end-user devices can easily be compromised, and they
may not follow the routing protocol faithfully. Such compromised and
misbehaving nodes can disrupt routing, and hence, disable the operation
of the network. In order to cope with this problem, several secured routing
protocols have been proposed for ad-hoc networks. However, many of
them have design 
aws that still make them vulnerable to attacks mounted
by compromised nodes. In this paper, we propose a formal verication
method for secure ad-hoc network routing protocols that helps increasing
the condence in a protocol by providing an analysis framework that
is more systematic, and hence, less error-prone than the informal analysis.
Our approach is based on a new process algebra that we specically
developed for secure ad-hoc network routing protocols and a deductive
proof technique. The novelty of this approach is that contrary to prior
attempts to formal verication of secure ad-hoc network routing protocols,
our verication method can be made fully automated, and provides
expressiveness for explicitly modelling cryptography privitives
]]></description>
<guid>http://eprint.iacr.org/2012/139</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/131</link>
<title><![CDATA[Composition Theorems for CCA Cryptographic Security]]>, by Rodolphe Lampe and Jacques Patarin</title>
<description><![CDATA[We present two new theorems to analyze the indistinguishability of the composition of cryptographic permutations and the indistinguishability of the XOR of cryptographic functions. Using the H Coefficients technique of \cite{Patarin-2001}, for any two families of permutations $F$ and $G$ with CCA distinghuishability advantage $\leq\alpha_F$ and $\leq\alpha_G$, we prove that the set of permutations $f\circ g, f\in F, g\in G$ has CCA distinguishability advantage $\leq\alpha_F\times\alpha_G$. This simple composition result gives a CCA indistinguishability geometric gain when composing blockciphers (unlike previously known clasical composition theorems). As an example, we apply this new theorem to analyze $4r$ and $6r$ rounds Feistel schemes with $r\geq 1$ and we improve previous best known bounds for a certain range of queries. Similarly, for any two families of functions $F$ and $G$ with distinghuishability advantage $\leq\alpha_F$ and $\leq\alpha_G$, we prove that the set of functions $f\oplus g, f\in F, g\in G$ has distinguishability advantage $\leq\alpha_F\times\alpha_G$. As an example, we apply this new theorem to analyze the XOR of $2r$ permutations and we improve the previous best known bounds for certain range of queries
]]></description>
<guid>http://eprint.iacr.org/2012/131</guid>
</item>
<item>
<link>http://eprint.iacr.org/2012/129</link>
<title><![CDATA[Outsider-Anonymous Broadcast Encryption with Sublinear Ciphertexts]]>, by Nelly Fazio and Irippuge Milinda Perera</title>
<description><![CDATA[In the standard setting of broadcast encryption, information about the receivers is transmitted as part of the ciphertext. In several broadcast scenarios, however, the identities of the users authorized to access the content are often as sensitive as the content itself. In this paper, we propose the first broadcast encryption scheme with sublinear ciphertexts to attain meaningful guarantees of receiver anonymity. We formalize the notion of \emph{outsider-anonymous broadcast encryption} (oABE), and describe generic constructions in the standard model that achieve outsider-anonymity under adaptive corruptions in the chosen-plaintext and chosen-ciphertext settings. We also describe two constructions with enhanced decryption, one under the gap Diffie-Hellman assumption, in the random oracle model, and the other under the decisional Diffie-Hellman assumption, in the standard model.
]]></description>
<guid>http://eprint.iacr.org/2012/129</guid>
</item>
<item>
<link>http://eprint.iacr.org/2011/163</link>
<title><![CDATA[Improved Integral Attacks on Reduced Round Camellia]]>, by Yanjun Li, Wenling Wu, Liting Zhang and Lei Zhang</title>
<description><![CDATA[In this paper a method is presented to extend the length of integral distinguisher of Feistel-SP structure, based on which a new 8-round distinguisher of Camellia is proposed. Moreover, we improve integral attacks on reduced round Camellia without FL/FL^{-1}. We attack 11-round Camellia-128 with the data complexity of 2^{120} and the time complexity of 2^{125.5}, and 12-round Camellia-256 with the data complexity of 2^{120} and the time complexity of 2^{214.3}. The result is the best one of integral attacks on reduced round Camellia so far.
]]></description>
<guid>http://eprint.iacr.org/2011/163</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/610</link>
<title><![CDATA[Separating Succinct Non-Interactive Arguments From All Falsifiable Assumptions]]>, by Craig Gentry and Daniel Wichs</title>
<description><![CDATA[In this paper, we study succinct computationally sound proofs (arguments) for NP, whose communication complexity is  polylogarithmic the instance and witness sizes. The seminal works of Kilian '92 and Micali '94 show that such arguments can be constructed under standard cryptographic hardness assumptions with four rounds of interaction, and that they be made non-interactive in the random-oracle model. The latter construction also gives us some evidence that succinct non interactive arguments (SNARGs) may exist in the standard model with a common reference string (CRS), by replacing the oracle with a sufficiently complicated hash function whose description goes in the CRS. However, we currently do not know of any construction of SNARGs with a formal proof of security under any simple cryptographic assumption.

In this work, we give a broad black-box separation result, showing that black-box reductions cannot be used to prove the security of any SNARG construction based on any falsifiable cryptographic assumption. This includes essentially all common assumptions used in cryptography (one-way functions, trapdoor permutations, DDH, RSA, LWE etc.). More generally, we say that an assumption is falsifiable if it can be modeled as an interactive game between an adversary and an efficient challenger that can efficiently decide if the adversary won the game. This is similar, in spirit, to the notion of falsifiability of Naor '03, and captures the fact that we can efficiently check if an adversarial strategy breaks the assumption.

 Our separation result also extends to designated verifier SNARGs, where the verifier needs a trapdoor associated with the CRS to verify arguments, and slightly succinct SNARGs, whose size is only required to be sublinear in the statement and witness size.
]]></description>
<guid>http://eprint.iacr.org/2010/610</guid>
</item>
<item>
<link>http://eprint.iacr.org/2010/429</link>
<title><![CDATA[A Family of Implementation-Friendly BN Elliptic Curves]]>, by Geovandro C. C. F. Pereira and Marcos A. Simplício Jr and Michael Naehrig and Paulo S. L. M. Barreto</title>
<description><![CDATA[For the last decade, elliptic curve cryptography has gained increasing interest in industry and in the academic community. This is especially due to the high level of security it provides with relatively small keys and to its ability to create very efficient and multifunctional cryptographic schemes by means of bilinear pairings. Pairings require pairing-friendly elliptic curves and among the possible choices, Barreto-Naehrig (BN) curves arguably constitute one of the most versatile families. 
In this paper, we further expand the potential of the BN curve family. We describe BN curves that are not only computationally very simple to generate, but also specially suitable for efficient implementation on a very broad range of scenarios. We also present implementation results of the optimal ate pairing using such a curve defined over a 254-bit prime field.
]]></description>
<guid>http://eprint.iacr.org/2010/429</guid>
</item>
<item>
<link>http://eprint.iacr.org/2009/427</link>
<title><![CDATA[Efficient Verifiable Escrow and Fair Exchange with Trusted Hardware]]>, by Stephen R. Tate and Roopa Vishwanathan</title>
<description><![CDATA[At the heart of many fair exchange problems is verifiable escrow: a
sender encrypts some value using the public key of a trusted party
(called the recovery agent), and then must convince the receiver of
the ciphertext that the corresponding plaintext satisfies some
property (e.g., it contains the sender's signature on a
contract). Previous solutions to this problem are interactive, and
often rely on communication-intensive cut-and-choose zero-knowledge
proofs. In this paper, we provide a solution that uses generic trusted
hardware to create an efficient, non-interactive verifiable escrow
scheme. Our solution allows the protocol to use a set of recovery
agents with a threshold access structure, the \emph{verifiable group
  escrow} notion which was informally introduced by Camenisch and
Damgard and which is formalized here.  Finally, this paper shows how
this new non-interactive verifiable escrow scheme can be used to
create an efficient optimistic protocol for fair exchange of
signatures.

]]></description>
<guid>http://eprint.iacr.org/2009/427</guid>
</item>
<item>
<link>http://eprint.iacr.org/2008/010</link>
<title><![CDATA[A Proof of Security in $O(2^n)$ for the Xor of Two Random Permutations\\ -- Proof with the ``$H_{\sigma}$ technique''--]]>, by Jacques Patarin</title>
<description><![CDATA[Xoring two permutations is a very simple way to construct pseudorandom functions from pseudorandom permutations. The aim of this paper is to get precise security results for this construction. Since such construction has many applications in cryptography (see \cite{BI,BKrR,HWKS,SL} for example), this problem is interesting both from a theoretical and from a practical point of view. In \cite{SL}, it was proved that Xoring two random permutations gives a secure pseudorandom function if $m \ll 2^{\frac {2n}{3}}$. By ``secure'' we mean here that the scheme will resist all adaptive chosen plaintext attacks limited to $m$ queries (even with unlimited computing power). More generally in \cite{SL} it is also proved that with $k$ Xor, instead of 2, we have security when $m \ll 2^{\frac {kn}{k+1}}$. In this paper we will prove that for $k=2$, we have in fact already security when $m \ll O(2^n)$. Therefore we will obtain a proof of a similar result claimed in \cite{BI} (security when $m\ll O(2^n /n^{2/3})$). Moreover our proof is very different from the proof strategy suggested in \cite{BI} (we do not use Azuma inequality and Chernoff bounds for example, but we will use the ``$H_{\sigma}$ technique'' as we will explain), and we will get precise and explicit $O$ functions. Another interesting point of our proof is that we will show that this (cryptographic) problem of security is directly related to a very simple to describe and purely combinatorial problem.
]]></description>
<guid>http://eprint.iacr.org/2008/010</guid>
</item>
</channel></rss>
