Selected Areas in Cryptography - SAC 2016

Name: Selected Areas in Cryptography - SAC 2016 | 23rd International Conference, St. John's, NL, Canada, August 10-12, 2016, Revised Selected Papers
Brand: Springer
Price: 53.49 EUR
Availability: OnlineOnly

23rd International Conference, St. John's, NL, Canada, August 10-12, 2016, Revised Selected Papers

Roberto Avanzi Howard Heys(Herausgeber*in)

Springer (Verlag)

Erschienen am 18. Oktober 2017

XIII, 580 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-319-69453-5 (ISBN)

53,49 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Preface
Organization
Contents
Invited Lectures
Physical Attacks and Beyond
1 Introduction
2 Overview of Physical Attacks
3 Challenge 1: Interaction Between Physical Attacks
4 .28em plus .1em minus .1emChallenge 2: Automatic Application of Countermeasures
5 Challenge 3: Physically Secure Cyber-Physical Systems
6 Conclusions
References
Post-quantum Key Exchange for the Internet and the Open Quantum Safe Project
1 Introduction
2 Lattice-Based Cryptography and the LWE Problems
2.1 The Learning with Errors Problem
2.2 The Ring Learning with Errors Problem
3 Key Exchange Protocols from LWE and Ring-LWE
3.1 Common Tools: Reconciliation
3.2 Ring-LWE-Based Key Exchange: BCNS15
3.3 LWE-Based Key Exchange: Frodo
3.4 Performance of Post-quantum Key Exchange
3.5 From Unauthenticated to Authenticated Key Exchange
4 Integrating Post-quantum Key Exchange into TLS
4.1 Performance of Post-quantum Key Exchange in TLS
5 Interlude: Programming is Hard
6 Open Quantum Safe: A Software Framework for Post-quantum Cryptography
6.1 liboqs
6.2 Application/Protocol Integrations
6.3 Case Study: Adding NewHope to liboqs and OpenSSL
7 Conclusion and Outlook
References
Side Channels and Fault Attacks
Detecting Side Channel Vulnerabilities in Improved Rotating S-Box Masking Scheme---Presenting Four Non-profiled Attacks
1 Introduction
2 Improved RSM Scheme
2.1 Algorithm Description
2.2 Acquisition Platform and Measurements
3 Detecting Non-profiled Vulnerabilities in RSM2.0
3.1 Analytical Methodology for Vulnerability Detection
3.2 Flaws in the Algorithm Design
3.3 Flaws in the Implementation Level
4 Practical Attacks and Official Evaluation Results
4.1 Second Order Attacks in the First RoundFor the need of expression, all the ``mod'' operation would be explicitly added in this subsection.
4.2 Second Order Attacks in the Ninth Round
5 Discussion of Possible Countermeasures
6 Conclusion
A Algorithm of Improved Rotating S-Boxes Masking
References
Bridging the Gap: Advanced Tools for Side-Channel Leakage Estimation Beyond Gaussian Templates and Histograms
1 Introduction
2 Background
3 New Proposals
3.1 Exponentially Modified Gaussian
3.2 Pearson Distribution System
3.3 Shifted Generalized Lognormal
3.4 Computational Complexity
4 Simulated Experiments
5 Practical Case Studies
5.1 Profiled Evaluations and Attacks
5.2 Selection of Tools
6 Conclusions
References
Uniform First-Order Threshold Implementations
1 Introduction
2 Threshold Implementations
2.1 Notation
2.2 Non-completeness
2.3 Uniformity
2.4 Correction Terms
2.5 Partial Uniformity
3 Fast Uniformity Check for Boolean Functions
3.1 Observations on the Rows of U
3.2 Observations on U when sout=3
4 Using Linear Correction Terms Efficiently to Satisfy Uniformity
4.1 Realizations Without Bent Component Functions
4.2 Realizations with Bent Component Functions
5 Finding Uniform Realizations of Quadratic Functions
5.1 Quadratic Forms
5.2 Quadratic Forms in TI Context
5.3 Using Quadratic Forms to Find Uniform Realizations
6 Conclusion
A Algorithm to Find Partial Uniform Realizations
B Fast Uniformity Check for sout=3
C Finding Uniform Realizations Using Fast WHT
D Constructions to Avoid Bent Component Functions
E Using Quadratic Correction Terms For Uniformity
References
Attacking Embedded ECC Implementations Through cmov Side Channels
1 Introduction
2 Scalar Multiplication and Conditional Moves
3 Attack Setup
3.1 Target Implementations
3.2 Target Device and Measurement Setup
4 Attacking Arithmetic Cswaps
4.1 Target Implementation
4.2 Template Generation and Matching
4.3 Attack Results
5 Attacking Secret-Dependent Memory Accesses
5.1 Target Implementation
5.2 Template Generation
5.3 Point-of-Interest Selection
5.4 Template Matching
5.5 Attack Results
6 Error Detection and Correction
6.1 Algorithm Implementation and Experimental Results
7 Conclusions and Possible Countermeasures
References
Lattice Attacks Against Elliptic-Curve Signatures with Blinded Scalar Multiplication
1 Introduction
2 Implementation and Leakage Model
2.1 ECDSA Signature Scheme
2.2 Target Implementation
2.3 Leakage Model
2.4 Profiling Attack
3 Lattice Attack with Partially-Known Blinded Nonces
3.1 Attack Description
3.2 Attack Parameters
3.3 Experiments
4 Attacking Implementations with Classic Blinding
5 Attacking Implementations with Euclidean Blinding
6 Experimental Results
A Using Exhaustive Search
References
Loop-Abort Faults on Lattice-Based Fiat-Shamir and Hash-and-Sign Signatures
1 Introduction
2 Description of the Lattice-Based Signature Schemes We Consider
3 Attack on Fiat-Shamir Type Lattice-Based Signatures
4 Attack on Hash-and-Sign Type Lattice-Based Signatures
4.1 Description of the Attack
4.2 How Many Faults Do We Need?
5 Implementation of the Faults
5.1 Classical Fault Models
5.2 Fault Attacks on Software Implementations
5.3 Fault Attacks on Hardware Implementations
6 Conclusion and Possible Countermeasures
References
Design and Implementation of Symmetric Cryptography
On the Construction of Hardware-Friendly 44 and 55 S-Boxes
1 Introduction
2 Related Work
3 Preliminaries
3.1 Power and Energy
3.2 Cryptographic Properties of S-Boxes
4 Methodology and Results
4.1 Power Estimation
4.2 44 S-Boxes
4.3 55 S-Boxes
4.4 Discussion
5 Conclusions and Future Work
References
All the AES You Need on Cortex-M3 and M4
1 Introduction
2 Preliminaries
2.1 Implementing AES
2.2 ARM Cortex-M
2.3 Accelerating Memory Access
3 Making AES Fast
3.1 Our Implementations
3.2 Comparison to Existing Implementations
3.3 Benchmarking with FELICS
4 Protecting Against Timing Attacks
4.1 Our Implementation
5 Protecting Against Side-Channel Attacks
5.1 Our Implementation
5.2 Comparison to Existing Implementations
6 Conclusion and Outlook
References
Efficient Symmetric Primitives
Hold Your Breath, PRIMATEs Are Lightweight
1 Introduction
2 Preliminaries
2.1 AEAD Scheme
2.2 PRIMATEs
3 Implementations of PRIMATE
3.1 PRIMATE Permutations' Control
3.2 Core Permutations P80 and P120
4 Threshold Implementations
4.1 The Shared S-Box
4.2 Architectures
5 Implementation Results
6 Usability, Comparison, and Discussion
7 PRIMATEs Coprocessor
7.1 HANUMAN-80 Coprocessor
8 Conclusions and Future Work
References
Keymill: Side-Channel Resilient Key Generator, A New Concept for SCA-Security by Design
1 Introduction
2 Background
2.1 Nonlinear Feedback Shift Registers
2.2 Taxonomy of SCA
2.3 SCA's Divide-and-Conquer
3 Design Goals
3.1 A New Definition: SCA-Security
3.2 Practical Applications
4 Introductory Toy Models
4.1 Toy Model I: One 8-Bit NLFSR
4.2 Toy Model II: Two 8-Bit NLFSRs with Rotating Cross-Connect
4.3 Toy Model III: Two 8-Bit Registers with 4-Bit Feedback Function
5 Keymill, The Proposed Design
6 Security Analysis
6.1 Failure of Other NLFSRs
6.2 Similarity to GGM Structures
6.3 Cautionary Notes
7 Hardware Results
8 Conclusion
References
Lightweight Fault Attack Resistance in Software Using Intra-instruction Redundancy
1 Introduction
2 Fault Models
3 Related Work
4 Proposed Software Countermeasures for Fault Attacks
4.1 Bit-Slicing Without Fault Attack Protection
4.2 Intra-instruction Redundancy
4.3 Pipelined Intra-instruction Redundancy
4.4 Shuffled, Pipelined Intra-instruction Redundancy
4.5 Secure, Comparison-Free Fault Handling
5 Security Analysis of the Proposed Countermeasures
5.1 Security Analysis of Unprotected AES
5.2 Security Analysis of IIR-AES
5.3 Security Analysis of Pipelined IIR-AES
5.4 Security Analysis of Shuffled Pipelined IIR-AES
6 Results
6.1 Performance and Footprint
6.2 Experimental Fault Coverage
7 Conclusion
References
Cryptanalysis of Symmetric Primitives
New Second Preimage Attacks on Dithered Hash Functions with Low Memory Complexity
1 Introduction
1.1 Related Work
1.2 Our Results
1.3 Organization of the Paper
2 Background and Notations
2.1 General Notations
2.2 Merkle-Damgård
2.3 Dithering Sequence
2.4 Diamond Structure
3 Previous Attacks on Merkle-Damgård Hash Functions
3.1 Dean's Attack
3.2 Kelsey and Schneier's Expandable Messages Attack
3.3 Adapted Kelsey-Kohno
3.4 Kite Generator and More Second Preimage Attacks
4 A New Second Preimage Attack on Dithered Merkle-Damgård
4.1 Adapting Diamond Structure to Dithered Merkle-Damgård
4.2 Generalization
5 Optimizations and Improvements
5.1 Reducing Offline Time Complexity
5.2 Treating (Almost)-Regular Sequences
6 Memory Optimizations
6.1 Reducing Memory in the Offline Phase
6.2 Time-Memory Trade-Off
7 Memoryless Diamond Structure Generation
8 Summary
A Compact Representations of Message Blocks in the Considered Attacks
References
New Differential Bounds and Division Property of LILLIPUT: Block Cipher with Extended Generalized Feistel Network
1 Introduction
2 Related Work
2.1 Extended Generalized Feistel Network (EGFN)
2.2 LILLIPUT Specification
3 Difficulties of Analyzing LILLIPUT Round Function
4 New Differential Bounds
4.1 Background of Mixed Integer Linear Programming (MILP)
4.2 Nibble-Wise Search
4.3 Bit-Wise Search
5 Attacks Based on Division Property
5.1 Background of Division Property
5.2 Integral Distinguisher on LILLIPUT
5.3 Key Recovery
6 Concluding Remarks
References
Cryptanalysis of Simpira v1
1 Introduction
2 Description of Simpira
2.1 F-Function
2.2 Round Function and Permutation
2.3 Permutation-Based Hashing
3 Collision Attacks on Simpira-4 Hash
3.1 Differential Trail with 40 Active S-Boxes over 15 Rounds
3.2 Collision Attack on 8 Rounds
3.3 Collision Attack on 16 Rounds
3.4 Collision Attack on 15 Rounds with Truncation
4 Conclusion
References
An Efficient Affine Equivalence Algorithm for Multiple S-Boxes and a Structured Affine Layer
1 Introduction
2 Preliminaries
2.1 Structured Matrix
2.2 Notation
2.3 Our Problem Related to the Affine Equivalence Problem
2.4 Useful Lemmas
3 Cryptanalysis of the ASA Structure with a Structured Affine Layer
3.1 Decomposing the Linear Part of B
3.2 Recovering A and B
3.3 Generalizations
4 Application to the White-Box AES Implementation
4.1 The BCH Implementation
4.2 Cryptanalysis of the BCH Implementation
5 Conclusion
References
Estimating the Cost of Generic Quantum Pre-image Attacks on SHA-2 and SHA-3
1 Introduction
2 Pre-image Search via Grover's Algorithm
3 A Cost Metric for Quantum Computation
4 Intrinsic Cost of Grover Search
5 Reversible Implementation of a SHA-256 Oracle
5.1 Reversible Implementation
5.2 Quantum Implementation
6 Reversible Implementation of a SHA3-256 Oracle
6.1 Reversible Implementation
6.2 Quantum Implementation
7 Fault-Tolerant Cost
7.1 SHA-256
7.2 SHA3-256
8 Conclusions and Open Questions
A Tables
B Parallel quantum search
References
MACs and PRNGs
Output Masking of Tweakable Even-Mansour Can Be Eliminated for Message Authentication Code
1 Introduction
2 Notation and Security Definition
3 PMAC with XP and the PRF-Security
3.1 PMAC_XP
3.2 Uniform AXU Hash Function Family
3.3 The PRF-Security of PMAC_XP
4 Proof of Theorem1
4.1 Upper-Bound of Pr[DG1 1] - Pr[DG2 1]
4.2 Upper-Bound of Pr[DG2 1] - Pr[DG3 1]
4.3 Upper-Bound of AdvprfPMAC_XP(D)
5 Discussion
5.1 Benefit in Hardware Implementation
5.2 Open Problem
A Deriving Pr[DG2 1] - Pr[DG3 1] Pr[coll]
References
Improved Algebraic MACs and Practical Keyed-Verification Anonymous Credentials
1 Introduction
2 Preliminaries
2.1 Classical Tools
2.2 Message Authentication Codes (MACs)
3 An Algebraic MAC Scheme Based on Boneh-Boyen Signatures
3.1 MACBB
3.2 MACBBn
4 A Keyed-Verification Anonymous Credentials System Based on MACBBn
4.1 Overview on KVAC Systems
4.2 Our Keyed-Verification Anonymous Credentials System
4.3 From Keyed-Verification to Public Key Anonymous Credentials
5 Efficiency Comparison and Performance Assessment
6 Conclusion
A MAC Security
A.1 Security Proof of MACBB (Theorem1)
A.2 Security Proof of MACBBn (Theorem2)
B Security Proofs of Theorem3
C ZKPK 3 - Proof of Possession of a Credential
References
A Robust and Sponge-Like PRNG with Improved Efficiency
1 Introduction
2 Preliminary Definitions
2.1 Probabilities and Further Notation
2.2 PRGs and PRNGs
2.3 The Ideal Permutation Model (IPM)
2.4 Patarin's H-Coefficient Technique
3 Security Notions
3.1 Preserving Security
3.2 Recovering Security
4 Improved Construction
5 Security of Reverie
5.1 Preserving Security
5.2 Recovering Security
6 Conclusion
A GLEGqD,i*(A,D)
B Proof of next Security
References
Lattice-Based Cryptography
Fixed-Point Arithmetic in SHE Schemes
1 Introduction
2 Integer Arithmetic
2.1 Representing Integers as Polynomials
3 Fixed-Point Arithmetic
3.1 Balanced Base-B Encoding
3.2 Fractional Encoding
3.3 Relating R1 to R2
4 Bounds on Integer Arithmetic
4.1 Bounding c[(d1,e1),?,(dt,et)]
4.2 Applying the Bounds
4.3 Lower Bounds on p for Regular Circuits
A Homomorphic Image Processing via the Fourier Transform
A.1 The Mixed Fourier Transform Algorithm
A.2 Comparison with Prior Work
A.3 FFT-Hadamard-iFFT Pipeline
References
A Full RNS Variant of FV Like Somewhat Homomorphic Encryption Schemes
1 Introduction
2 Preliminaries
3 Towards a Full RNS Decryption
3.1 Fast RNS Base Conversion
3.2 Approximate RNS Rounding
3.3 Correcting the Approximate RNS Rounding
3.4 A Full RNS Variant of DecFV
3.5 Staying in RNS is Asymptotically Better
4 Towards a Full RNS Homomorphic Multiplication
4.1 Preliminaries About MultFV
4.2 Auxiliary RNS Bases
4.3 Adapting the First Step
4.4 Transitional Step
4.5 Adapting the Second Step
4.6 Reducing the Size of the Relinearization Key rlkRNS
4.7 About Computational Complexity
5 Software Implementation
5.1 Concrete Examples of Parameter Settings
5.2 Influence of Over Noise Growth
5.3 Some Remarks
5.4 Results
6 Conclusion
References
Security Considerations for Galois Non-dual RLWE Families
1 Introduction
1.1 Summary of Contributions
2 Background
2.1 Discrete Gaussian on Lattices
2.2 Non-dual RLWE
2.3 Comparing RLWE with Non-dual RLWE
2.4 Comparing Discrete and Continuous Errors
2.5 Search and Decision RLWE Problems
2.6 Comparing Non-dual RLWE with PLWE for 2-Power Cyclotomic Fields
2.7 Scaling Factors
2.8 Overview of Attack
2.9 Comparison to Related Works
3 An Improved Attack Using Cosets
3.1 Examples of Successful Attacks
3.2 Proof of Proposition1
4 Infinite Family of Vulnerable Galois RLWE Instances
4.1 Examples
4.2 Remarks on Other Possible Attacks
5 Security of 2-Power Cyclotomic Rings with Unramified Moduli
5.1 Bounding the Distance from Uniform
5.2 Numerical Distance from Uniform
References
Efficient Classical Public Key Cryptography
Fast, Uniform Scalar Multiplication for Genus 2 Jacobians with Fast Kummers
1 Introduction
2 Genus 2 Jacobians with fast Kummer Surfaces
3 Point Recovery in Genus 2
4 Uniform One-Dimensional Scalar Multiplication
5 Uniform Two-Dimensional Scalar Multiplication
A Fast Kummer Arithmetic
B Constant-Time Conditional Swaps and Selects
References
PhiRSA: Exploiting the Computing Power of Vector Instructions on Intel Xeon Phi for RSA
1 Introduction
2 Related Work
3 Preliminaries
3.1 Overview of Intel Xeon Phi
3.2 Montgomery Multiplication
4 Montgomery Multiplication Design
4.1 Vector Carry Propagation Chain Method
4.2 Computing q
4.3 Performance Analysis
5 Implementation
5.1 Montgomery Multiplication Implementation
5.2 RSA Implementation
6 Experimental Results
6.1 Implementation Result
6.2 Comparisons with the Previous Works on Intel Xeon Phi
6.3 Comparisons with the Implementations on CPUs and GPUs
7 Conclusions
A Appendix
References
FourQNEON: Faster Elliptic Curve Scalar Multiplications on ARM Processors
1 Introduction
2 The FourQ Curve
3 ARM NEON Architecture
3.1 Targeted Platforms
4 Vectorization Using NEON
4.1 Vectorization of F(2127-1)2 Arithmetic
4.2 Additional Optimizations to the Fp2 Implementation
4.3 Putting Pieces Together
5 Implementation and Results
5.1 Results
A Algorithms for Point Operations
References
Cryptanalysis of Asymmetric Primitives
Sieving for Closest Lattice Vectors (with Preprocessing)
1 Introduction
1.1 Contributions
2 Preliminaries
2.1 Lattice Sieving for Solving SVP
2.2 Nearest Neighbor Searching
3 Adaptive Sieving for CVP
4 Non-adaptive Sieving for CVPP
4.1 Bounded Distance Decoding with Preprocessing
4.2 Approximate Closest Vector Problem with Preprocessing
A Pseudocode of SVP Algorithms
B Pseudocode of Phase 1 for Non-adaptive Sieving
References
Key Recovery Attack on the Cubic ABC Simple Matrix Multivariate Encryption Scheme
1 Introduction
2 The Cubic ABC Matrix Encryption Scheme
3 Subspace Differential Invariants for Cubic Maps
4 The Differential Invariant Structure of the Cubic ABC Scheme
4.1 Column Band Spaces
5 A Variant of MinRank Exploiting the Column Band Space Structure
6 Complexity of Invariant Attack
7 Experiments
8 Conclusion
References
Solving Discrete Logarithms on a 170-Bit MNT Curve by Pairing Reduction
1 Introduction
2 Background and Notations
2.1 Using Pairing Embedding to Break DLP
2.2 MNT Curves
2.3 A Brief Overview of NFS-DL
3 Polynomial Selection
3.1 A First Comparison
3.2 Probing the Sieving Yield
4 Solving DLP over Fp3
4.1 Sieving and Linear Algebra
4.2 Computing Individual Discrete Logarithms in Fp3
4.3 Solving the Challenge
5 Conclusion and Future Work
5.1 Consequences for Pairing-Based Cryptography
5.2 Future Work
A Polynomial Selection Methods
References
Author Index

Systemvoraussetzungen

Als PDF speichern Als Link merken