Topics in Cryptology - CT-RSA 2022

Name: Topics in Cryptology - CT-RSA 2022 | Cryptographers' Track at the RSA Conference 2022, Virtual Event, March 1-2, 2022, Proceedings
Brand: Springer
Price: 106.99 EUR
Availability: OnlineOnly

Cryptographers' Track at the RSA Conference 2022, Virtual Event, March 1-2, 2022, Proceedings

Steven D. Galbraith(Herausgeber*in)

Springer (Verlag)

Erschienen am 29. Januar 2022

XI, 621 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-030-95312-6 (ISBN)

106,99 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Preface
Organization
Contents
Multicast Key Agreement, Revisited
1 Introduction
1.1 Contributions
2 Preliminaries
3 Multicast Key Agreement
3.1 MKA Syntax
3.2 MKA Efficiency Measures
3.3 MKA Security
4 MKA Construction
4.1 MKA Trees
4.2 GUS MKA Protocol
4.3 Security of GUS MKA Protocol
4.4 Comparison of Trees in GUS
5 Adding Security for Group Manager Corruptions
5.1 Group Manager State Separation and Efficiency Measures
5.2 MKA Security with Group Manager FS and Eventual PCS
References
A Pairing-Free Signature Scheme from Correlation Intractable Hash Function and Strong Diffie-Hellman Assumption
1 Introduction
2 Definitions
2.1 Signature Schemes
2.2 Intractability Assumptions
3 Prior Art
3.1 The EDL Family of Signatures
3.2 Boneh-Boyen Signatures
3.3 Existing Pairing-Free Discrete-Log Signature Schemes in the Standard Model
3.4 OR-Based Signature Schemes
4 Our Signature Scheme
4.1 Intuition of the Design
4.2 Description
4.3 Introducing Discrete-Log Collisions
4.4 Security Proof
5 Conclusion
References
Faster Isogenies for Post-quantum Cryptography: SIKE
1 Introduction
2 Preliminaries: Isogenies on Elliptic Curves
2.1 Isogeny-Based Cryptography
2.2 Supersingular Isogeny Key Encapsulation
3 Proposed Method for Large-Degree Isogenies of Odd Power Degree
3.1 Large-Degree Isogenies
3.2 Large-Degree Isogenies of an Odd Power
4 Proposed Explicit Formulas for Large-Degree Isogenies
4.1 Proposed Efficient Algorithm for Large-Degree Isogenies with a Remainder
4.2 Proposed Faster 2-Isogeny Formulas for Large-Degree Isogenies
5 Benchmarking and Evaluation
6 Conclusion
References
Fully Projective Radical Isogenies in Constant-Time
1 Introduction
2 Preliminaries
2.1 CSIDH and Its Surface
2.2 The Group Action of CSIDH and CSURF
2.3 The Tate Normal Form
2.4 Radical Isogenies
3 Fully Projective Radical Isogenies
3.1 Efficient Radicals for Projective Coordinates
3.2 Explicit Projective Formulas for Low Degrees
3.3 Cost of Projective Radical Isogenies per Degree
4 Cost Analysis of Constant-Time Radical Isogenies
4.1 Analysis of Effectiveness of Radical Isogenies
4.2 Further Discussion
5 A Hybrid Strategy for Radical Isogenies
5.1 A Hybrid Strategy for Integration of Radical Isogenies
5.2 Choosing Parameters for Hybrid Strategy
5.3 Algorithm for Evaluation of Hybrid Strategy
6 Implementation and Performance Benchmark
6.1 Performance Benchmark of Radical Isogenies
6.2 Performance of Radical Isogenies Using the Hybrid Strategy
7 Concluding Remarks and Future Research
References
Private Liquidity Matching Using MPC
1 Introduction
2 Preliminaries
2.1 The Gridlock Resolution Problem
2.2 Multiparty Computation (MPC)
3 The Gridlock Resolution Algorithm with MPC
3.1 Leakage
3.2 Experiments
4 Simulating an RTGS
References
Approximate Homomorphic Encryption with Reduced Approximation Error*-8pt
1 Introduction
2 Preliminaries
3 Reducing the Approximation Error in the CKKS Scheme
3.1 Approximation Errors in the CKKS Scheme
3.2 Eliminating LWE and Encoding Approximation Errors
3.3 Theoretical Estimates of Error Reduction
4 Reducing the Approximation Error in the RNS Instantiation of CKKS
4.1 Eliminating the Scaling Factor Approximation Error in RNS CKKS
4.2 Applying the Reduced-Error CKKS Modifications
5 Implementation Details and Results
5.1 Setting the Parameters
5.2 Software Implementation and Experimental Setup
5.3 Experimental Results
6 Concluding Remarks
References
Attacks on Pseudo Random Number Generators Hiding a Linear Structure
1 Introduction
2 Coppersmith Method
3 Attacks on the Linear Congruential Generator
3.1 Attacks via a Coppersmith Method
3.2 Attack 3: With Stern's Algorithm
4 Attacks Against the Fast Knapsack Generator
4.1 Attack via Coppersmith Method with Consecutive Outputs
4.2 Attack via Coppersmith Method Without Consecutive Outputs
4.3 Attack via Stern's Attack on the LCG
4.4 Summary of Our Results
5 Combined Multiple Recursive Generators (CMRG)
5.1 Attack on the MRG32
5.2 The MRG32k3a by L'Écuyer
A Bernoulli Trials
B Improvement of Coppersmith?
B.1 Consecutive Outputs
B.2 Not Consecutive Outputs
References
Lattice-Based Fault Attacks on Deterministic Signature Schemes of ECDSA and EdDSA
1 Introduction
2 Preliminaries
2.1 Notations
2.2 The Deterministic Signature Algorithms
2.3 Problems in Some Lattice
3 Adversarial Model
3.1 Fault Injection Model
3.2 Key Recovery by Solving Problems in Some Lattice
4 Concrete Lattice-Based Fault Attacks on Deterministic ECDSA and EdDSA Algorithms
4.1 Fault Attacks with Target r During the Calculation of s
4.2 Fault Attacks with Target k Before the Calculation of kG
4.3 Fault Attacks with the Targets During the Calculation of k
5 Experiment and Complexity Discussion
6 Countermeasures
7 Conclusion
A Appendix
A.1 Fault Attacks with Target k During the Calculation of s to Deterministic ECDSA
A.2 Fault Attacks with Target k-1-5mumod5mu-n During the Calculation of s to Deterministic ECDSA
A.3 Fault Attacks with Target d During the Calculation of s to Deterministic ECDSA
A.4 Fault Attacks with Targets e, rd and e+rd During the Calculation of s to Deterministic ECDSA
A.5 Fault Attacks with Targets During the Calculation of e to Deterministic ECDSA
A.6 Fault Attacks with targets During the Calculation of r to EdDSA
References
More Accurate Geometric Analysis on the Impact of Successful Decryptions for IND-CCA Secure Ring/Mod-LWE/LWR Based Schemes
1 Introduction
2 Preliminaries
2.1 (R/M-)LWE/LWR-Based Public-Key Encryption Scheme
2.2 Spherical Cap
3 Compression Errors
4 The Information Inferred by Successful Decryptions
4.1 The Relationship Between Successful Decryptions and Caps
4.2 The Range of the Proportion of Excluded Key Candidates
5 The Overlaps Among Queries and the Effect of Successful Decryptions on the Failure Probability
5.1 The Overlap Between Two Spherical Caps
5.2 The Overlaps Among Queries
5.3 The Decryption Failure Probability
6 (R/M-)LWE-Based Public-Key Encryption Schemes
6.1 Saber
A The Proof of Theorem 1
B The Proof of Proposition 2
C The Proof of Theorem 2
D Some Results about the Overlaps among Different Caps of the Same Query
E (R/M-)LWE-Based Public-Key Encryption Schemes
E.1 Kyber
E.2 Newhope
E.3 Frodo
References
Integral Attacks on Pyjamask-96 and Round-Reduced Pyjamask-128
1 Introduction
2 Preliminaries
2.1 Pyjamask Block Cipher Family
2.2 Notations
2.3 Monomial Prediction
2.4 MILP Modeling for the Monomial Prediction
3 Automatic Search Model for Pyjamask and Integral Distinguishers
3.1 MILP Model for Pyjamask-96 and Pyjamask-128
3.2 Integral Distinguishers of Pyjamask-96 and Pyjamask-128
4 Key Recovery Attack on Pyjamask-96
4.1 Attack on 13-Round Pyjamask-96
4.2 Attack on Full-Round Pyjamask-96
5 Integral Attacks on Round-Reduced Pyjamask-128
6 Conclusion
References
Related-Tweakey Impossible Differential Attack on Reduced-Round SKINNY-AEAD M1/M3
1 Introduction
2 Preliminaries
2.1 Description of SKINNY-AEAD M1/M3
2.2 Specification of the Underlying Primitive of SKINNY-AEAD M1/M3
2.3 Properties of SKINNY
2.4 Notations
3 Related-Tweakey Impossible Differential Distinguisher
3.1 Constraints of Searching for Distinguishers in SKINNY-AEAD M1/M3
3.2 Searching for Related-Tweakey Impossible Differential Distinguisher with STP
3.3 14-Round Related-Tweakey Impossible Differential Distinguishers
4 Tweakey Recovery Attack on 20-Round SKINNY-AEAD M1/M3
5 Tweakey Recovery Attack on 18-Round SKINNY-AEAD M1/M3
6 Conclusion
A 18-Round Related-Tweakey Impossible Differential Attack for SKINNY-AEAD M1/M3
References
Side-Channeling the Kalyna Key Expansion
1 Introduction
1.1 Our Contribution
1.2 Paper Outline
2 Background
2.1 Kalyna
2.2 Cache Attacks
2.3 Related Work
3 Cryptanalysis Overview
4 Attacking Kalyna-128/128
4.1 Recover Even Bytes of A0
4.2 Recovering Odd Bytes of A0
4.3 Recovering K
4.4 Recovering K
5 Attacks on Other Kalyna Variants
5.1 Relationship of Ki
5.2 Large Constant Ci
5.3 Aligning Columns
6 The Practical Attack
6.1 Instantiating the Oracle
6.2 Recovering the First Round Key
6.3 Recover the Master Key K of Kalyna-128/128
References
Fake It Till You Make It: Data Augmentation Using Generative Adversarial Networks for All the Crypto You Need on Small Devices
1 Introduction
2 Preliminaries
2.1 Profiled Side-Channel Attacks
2.2 Generative Adversarial Networks (GANs)
2.3 Conditional Generative Adversarial Networks (cGANs)
2.4 Data Augmentation
2.5 Deep Learning Algorithms
2.6 Siamese Neural Network
2.7 Cryptographic Algorithms Under Evaluation
3 Related Works
4 Proposed Approach
4.1 Data Splitting
4.2 Siamese-cGAN Model for Data Augmentation
4.3 cGAN Models for Discriminator and Generator
5 Experiments and Results
5.1 DL-SCA Evaluation Model Architectures
5.2 Experimental Setup
5.3 Analysis-1: Existing and Proposed GAN-based Approaches
5.4 Analysis-2: Analysis of the Proposed Siamese-CGAN for DL-SCA
5.5 Discussion
6 Conclusions and Future Work
A Appendix
A.1 Siamese-cGAN Model Architectures
References
A New Adaptive Attack on SIDH
1 Introduction
2 Preliminaries
2.1 Elliptic Curves and Isogenies
2.2 SIDH: Supersingular Isogeny Diffie-Hellman
2.3 GPST Adaptive Attack
3 Generalizing Torsion Points Attacks
3.1 Torsion Points Attacks on SIDH
3.2 Generalized Torsion Points Attacks
4 A New Adaptive Attack on SIDH
4.1 Overview
4.2 Explicit Description of the Active Phase
4.3 Computing the Integer N
4.4 Attack Summary
5 Relevance and Countermeasures
5.1 Attack Parameters for Some SIDH Primes
5.2 Countermeasures to the Attack
6 Conclusion
A A Simpler, But Detectable Variant of the Attack
References
On Fingerprinting Attacks and Length-Hiding Encryption
1 Introduction
2 A New Perspective on Length-Hiding Encryption
2.1 A New Syntactical Definition
2.2 New Security Model
2.3 Trivial Success Probability and Advantage
3 Analysis of Real-World Message Distributions
3.1 Simple Website Fingerprinting
3.2 Simple Wikipedia Fingerprinting
4 Implementation and Analysis
4.1 Validation of Pencil-and-Paper Analysis
5 Conclusions
References
CCA Secure A Posteriori Openable Encryption in the Standard Model
1 Introduction
2 Cryptographic Tools
3 Formal Definitions
4 Our Scheme: CHAPO
5 Applications
6 Conclusion
References
Dynamic Universal Accumulator with Batch Update over Bilinear Groups
1 Introduction
2 Notation
3 Preliminaries: A Dynamic Universal Accumulator for Bilinear Groups
4 Adding Support for Batch Operations
5 The Batch Witness Update Protocol
5.1 The Batch Witness Update Information
5.2 Batch Witness Update Among Epochs
6 Security Proofs for the Proposed Protocol
7 Accumulator Initialization
8 Zero-Knowledge Proof of Knowledge
8.1 Complexity Analysis
9 Implementation Results
10 Conclusions
A Collision Resistance of Au et al. Accumulator
References
Adaptively Secure Laconic Function Evaluation for NC1
1 Introduction
2 Background
2.1 Computational Hardness Assumptions
2.2 Garbling Schemes
2.3 Functional Encryption Scheme - Public-Key Setting
2.4 Laconic Oblivious Transfer
2.5 Laconic Function Evaluation
3 Background on the AR17 FE Scheme
3.1 The AR17 Construction for NC1
4 Laconic Function Evaluation for NC1 Circuits
4.1 LFE for NC1 Circuits
4.2 Efficiency Analysis
5 Further Compression for Digest
6 Concluding Remarks
References
FASTA - A Stream Cipher for Fast FHE Evaluation
1 Introduction
2 Preliminaries
2.1 FHE Hybrid Encryption: Combining Symmetric Ciphers with Fully Homomorphic Encryption
2.2 The Rasta Stream Cipher
2.3 The BGV Scheme
3 Linear Layers in Symmetric Ciphers for FHE Hybrid Encryption
3.1 Rotation-Based Linear Layers
3.2 The Structure in Rotation-Based Linear Layers
4 Specification of FASTA
4.1 High-Level Overview
4.2 The Non-linear Layer
4.3 The Affine Layer
4.4 Comparing FASTA with Other Ciphers for Hybrid Encryption
5 Security Analysis
5.1 On the Structure of FASTA's Linear Transformation
5.2 Algebraic Attacks
5.3 Attacks Based on Linear Approximations
5.4 Other Classical Attacks
6 Homomorphic Implementation of FASTA
6.1 Timings of Implementations
7 Conclusions
A Matrix Structure of Rotation-Based Linear Transformations
B Mapping j to Rotation Values and Round Constants
C Standard Linearization-Based Attack Against FASTA
References
New Attacks from Old Distinguishers Improved Attacks on Serpent
1 Introduction
2 Preliminaries
2.1 Description of the Serpent Cipher
2.2 Differential-Linear Cryptanalysis
3 First Version of the Attack
3.1 Differential-Linear Distinguisher
3.2 Improving the First Rounds
3.3 Last Rounds
3.4 Complexity Analysis
4 Sbox Conditions
4.1 Conditions on the Serpent Sboxes
4.2 Conditions on General 4-Bit Sboxes
4.3 A Conditional Linear Property of S2
5 Improved 12-Round Attack Using Sbox Properties
5.1 Improving the Differential Key Recovery
5.2 Conditional Linear Cryptanalysis
5.3 Complexity and Trade-Offs
6 Conclusion
A Connection to the Tree-Based Key-Recovery of ch20asiacryptPaper and Conditions used in Sect.5
References
Pholkos - Efficient Large-State Tweakable Block Ciphers from the AES Round Function
1 Introduction
2 Preliminaries
3 Specification
3.1 Encryption
3.2 The Tweakey Schedule
4 Design Rationale
4.1 Versions
4.2 Step Function
4.3 AVX2 Instructions for Efficient Implementations
4.4 Mixing-Layer Approaches
4.5 The Permutations
4.6 Tweakey Schedule
5 Software Implementation
6 Security Analysis
7 Conclusion
References
Robust Subgroup Multi-signatures for Consensus
1 Introduction
2 Preliminaries
2.1 Bilinear Groups
2.2 Computational Assumptions
2.3 Equality of Discrete Logarithms
2.4 Generalized Forking Lemma
3 Definitions of Robust Subgroup Multi-signatures
4 Our Pairing-Based Robust-Subgroup Multi-signature Scheme
4.1 Construction of RSMSP
4.2 Optimising RSMSP with NIZKs
4.3 Construction of RSMS-pop from Proof-of-possession
4.4 Optimising RSMS-pop with NIZKs
5 Extensions
5.1 Compressing Two Multi-signatures on the Same Message
5.2 Aggregating Multi-signatures on Different Messages
6 Performance Evaluation
References
Subversion-Resilient Enhanced Privacy ID
1 Introduction
1.1 Our Contribution
1.2 Related Work
2 Subversion-Resilient Enhanced Privacy ID
2.1 Subversion-Resilient EPID
2.2 Subversion-Resilient Security
3 Building Blocks
4 Our SR-EPID Construction
References
PriBank: Confidential Blockchain Scaling Using Short Commit-and-Proof NIZK Argument
1 Introduction
1.1 Overview of PriBank
1.2 Related Work
2 Preliminaries
2.1 Commitment Schemes
2.2 Quadratic Arithmetic Program
2.3 Commit-and-Prove Zero-Knowledge Argument
3 Commit-and-Prove Short NIZK Argument for Quadratic Arithmetic Program
3.1 Zero-Knowledge Argument of Knowledge for Product of Pedersen Commitments
3.2 Zero-Knowledge Argument for Inner Product of Pedersen Commitments and a Public Vector
3.3 Zero-Knowledge Argument of Knowledge for Inner Product of Vector Pedersen Commitment and Public Vector
3.4 Commit-and-Prove Zero-Knowledge Argument for QAP
4 Blockchain-Based Bank Protocol
4.1 Security Definition
4.2 Transaction Indistinguishability
4.3 Overdraft Safety
5 PriBank: Privacy-Preserving Scaling Construction
6 Security Proof
6.1 Proof for Transaction Indistinguishability
6.2 Proof for Overdraft Safety
7 Implementation and Evaluation
8 Conclusion
A Commit-Prove Zero-Knowledge Proof Construction
B Proof of Protocol 3.1
C Proof of Protocol 3.2
D Proof of Protocol 3.3
E Proof of Protocol 3.4
F Definitions for Commit-and-Prove Zero-Knowledge Proof
G Notations
References
Author Index

Systemvoraussetzungen

Als PDF speichern Als Link merken