Advances In Cryptology Research Articles

Automatic boomerang attacks search on Rijndael

Abstract Boomerang attacks were introduced in 1999 by Wagner (The boomerang attack. In: Knudsen LR, editor. FSE’99. vol. 1636 of LNCS. Heidelberg: Springer; 1999. p. 156–70) as a powerful tool in differential cryptanalysis of block ciphers, especially dedicated to ciphers with good short differentials. They have been generalized to the related-key case by Biham et al. (Related-key boomerang and rectangle attacks. In: Cramer R, editor. Advances in Cryptology - EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Aarhus, Denmark, May 22–26, 2005, Proceedings. vol. 3494 of Lecture Notes in Computer Science. Springer; 2005. p. 507–25. doi: 10.1007/11426639_30). In this article, we show how to adapt the model proposed in 2020 by Delaune et al. (Catching the fastest boomerangs application to SKINNY. IACR Trans Symm Cryptol. 2020;2020(4):104–29) for related-key boomerang attacks on the block cipher SKINNY to the Rijndael case. Rijndael is composed of 25 instances that could be seen as generalizations of the Advanced Encryption Standard. We detail our models and present the results we obtain concerning related-key boomerang attacks on Rijndael. Notably, we present a nine-round attack against Rijndael-128-160, which has 11 rounds and beats all previous cryptanalytic results against Rijdael-128-160.

A new distinguishing attack on reduced round ChaCha permutation

This work concentrates on differential-linear distinguishing attacks on the prominent ARX-based permutation ChaCha. Here, we significantly improve the 7-round differential-linear distinguisher for ChaCha permutation by introducing a new path of linear approximation. We first introduce a new single-bit differential distinguisher for the 3.5th round of the permutation that assists us in inventing a new path for the differential-linear distinguisher. We show that one can distinguish a 7-round ChaCha permutation with time complexity of 2^{207}. This improves the recent work of Coutinho et al. (in: Advances in Cryptology—ASIACRYPT 2022—28nd International Conference on the Theory and Application of Cryptology and Information Security, Taipei, Taiwan, December 5–9, 2012, Springer, 2022), which achieved time complexity 2^{214}. We also propose a distinguisher for the 7.25-round of ChaCha permutation and this is the first distinguishing attack for more than 7-round of ChaCha permutation. We provide theoretical proofs and the corresponding experimental results for the linear approximations that we use for differential-linear distinguisher. We point out that the existing multibit distinguishing attacks on the cipher ChaCha are invalid. These attacks are worked only for the ChaCha permutation.

Fast but approximate homomorphic k-means based on masking technique

Nowadays, computing on encrypted data seems to be more practical than a few years ago, thanks to the emergence of new Homomorphic Encryption schemes. In this paper, an algorithm based on Homomorphic Encryption for Arithmetic of Approximate Numbers (Cheon et al., in: Takagi, Peyrin (eds) Advances in cryptology—ASIACRYPT 2017, Springer, Cham, pp 409–437, 2017) (HEAAN, or also CKKS) scheme, that is able to perform a secure k-means algorithm which processes encrypted data, has been studied and presented. The performance of the classifier running on encrypted data has been evaluated using a standard k-means algorithm that works on plain data as a supervised structure, since the results are obtained by approximated computations. The main point of this paper is to take existent theoretical techniques (for example approximations of text {sgn}(x)), to use them and to observe if they are valid in practical applications. The output of the algorithm is a set of k encrypted masks that can be applied to the original dataset in order to obtain different clusters. The setting is a standard client–server one. The workload is heavily server-centric, as the client only has to execute a light masking algorithm at the end of each iteration, which, excluding the decryption, is faster than a plain k-means iteration; the main disadvantage concerns the accuracy of the results. Experiments show that the algorithm can be executed fairly quickly: the execution time of the training phase is on the order of seconds, while classification is on the order of tenths of a second.

Number of rational points of elliptic curves

In the modern theory of elliptic curves, one of the important problems is the determination of the number of rational points on an elliptic curve. The Mordel–Weil theorem [T. Shioda, On the Mordell–Weil lattices, Comment. Math. University St. Paul. 39(2) (1990) 211–240] points out that the elliptic curve defined above the rational points is generated by a finite group. Despite the knowledge that an elliptic curve has a final number of rational points, it is still difficult to determine their number and the way how to determine them. The greatest progress was achieved by Birch and Swinnerton–Dyer conjecture, which was included in the Millennium Prize Problems [A. Wiles, The Birch and Swinnerton–Dyer conjecture, The Millennium Prize Problems (American Mathematical Society, 2006), pp. 31–44]. This conjecture uses methods of the analytical theory of numbers, while the current knowledge corresponds to the assumptions of the conjecture but has not been proven to date. In this paper, we focus on using a tangent line and the osculating circle for characterizing the rational points of the elliptical curve, which is the greatest benefit of the contribution. We use a different view of elliptic curves by using Minkowki’s theory of number geometry [H. F. Blichfeldt, A new principle in the geometry of numbers, with some applications, Trans. Amer. Math. Soc. 15(3) (1914) 227–235; V. S. Miller, Use of elliptic curves in cryptography, in Proc. Advances in Cryptology — CRYPTO ’85, Lecture Notes in Computer Science, Vol. 218 (Springer, Berlin, Heidelberg, 1985), pp. 417–426; E. Bombieri and W. Gubler, Heights in Diophantine Geometry, Vol. 670, 1st edn. (Cambridge University Press, 2007)].

Building an Elliptic Curve Cryptography to Encode and Decode Vietnamese Texts

This article presents building an Elliptic curve cryptography and using it to encode and decode Vietnamese text. Here we have illustrated the prime number p = 151 in the future, which will use a large prime number. We consider an elliptic curve with a total score of 172 points. Encode and decode with standard Vietnamese text and combine with the special characters in ASCII code. The program is designed and installed and on the C# environment to give the correct result of the encryption algorithm.
 KeywordsData sequence, Decryption, Discrete logarithm, Elliptic curve, Elliptic curve cryptosystem, Encryption, Public key
 References[1] Koblitz, “Elliptic curve cryptosystems”, Mathematics of Computation”, 203 - 209, 1987.[2] Miller, “Uses of elliptic curves in cryptography, Advances in Cryptology - Crypto”, Lecture Notes in Computer Science, SpringerVerlag, 1986, pp. 417-426.[3] Sugantha Priya, Dr.M. Mohanraj, “A Review on Secure Elliptic Curve Cryptography (ECC) and Dynamic Secure Routing Link Path Detection Algorithm (DSRLP) Under Jamming Attack”, ISSN 68(30) (2020) 0474-9030.[4] Negin Dinarvand, Hamid Barati, “An efficient and secure RFID authentication protocol using ellipticcurvecryptography”,SpringerfScience+Business Media, LLC, 2017[5] Utku Gulen, Selcuk Baktir, “Elliptic Curve Cryptography for Wireless Sensor Networks Using the Number Theoretic Transform”, journal-sensors, Published: 9 March, 2020.[6] Sravana Kumar, C.H. Suneetha, A.R. Chandrasekh, “Encryption of Data Using Elliptic Curve Over Finite Fields”, International Journal of Distributed and Parallel Systems (IJDPS). 3(1) (2012) 301-308.[7] Amounas, E.H. El Kinani, ECC Encryption and Decryption with a Data Sequence, Applied Mathematical Sciences 6(101) (2012) 5039-5047.[8] Vu Thi Hai Ha, Dinh Thi Hang, Bui Dang Binh, “The influence of volume on the formant of vowels and the identification of Vietnamese speakers”, Vietnam Institute of Linguistics, 2015.[9] Enge, “Elliptic curves and their applications to cryptography”, Norwell, MA: Kulwer Academic publishers, 1999.[10] Neil Koblitz, “An Elliptic Curve implementation of the finite field digital signature algorithm”, in Advances in cryptology,(CRYPTO 1998), SpringerLecture Notes in computer science, 1462 (1998) 327-337.[11] S. Sandeep, Kumar, “Elliptic curve cryptography for constrained devices”, PhD thesis, Ruhr-University Bochum, June, 2006.

Reusable Fuzzy Extractors for Low-Entropy Distributions

Fuzzy extractors (Dodis et al., in Advances in cryptology—EUROCRYPT 2014, Springer, Berlin, 2014, pp 93–110) convert repeated noisy readings of a secret into the same uniformly distributed key. To eliminate noise, they require an initial enrollment phase that takes the first noisy reading of the secret and produces a nonsecret helper string to be used in subsequent readings. Reusable fuzzy extractors (Boyen, in Proceedings of the 11th ACM conference on computer and communications security, CCS, ACM, New York, 2004, pp 82–91) remain secure even when this initial enrollment phase is repeated multiple times with noisy versions of the same secret, producing multiple helper strings (for example, when a single person’s biometric is enrolled with multiple unrelated organizations). We construct the first reusable fuzzy extractor that makes no assumptions about how multiple readings of the source are correlated. The extractor works for binary strings with Hamming noise; it achieves computational security under the existence of digital lockers (Canetti and Dakdouk, in Advances in cryptology—EUROCRYPT 2008, Springer, Berlin, 2008, pp 489–508). It is simple and tolerates near-linear error rates. Our reusable extractor is secure for source distributions of linear min-entropy rate. The construction is also secure for sources with much lower entropy rates—lower than those supported by prior (nonreusable) constructions—assuming that the distribution has some additional structure, namely, that random subsequences of the source have sufficient minentropy. Structure beyond entropy is necessary to support distributions with low entropy rates. We then explore further how different structural properties of a noisy source can be used to construct fuzzy extractors when the error rates are high, building a computationally secure and an information-theoretically secure construction for large-alphabet sources.

High Entropy Random Selection Protocols

We study the two party problem of randomly selecting a common string among all the strings of length n. We want the protocol to have the property that the output distribution has high Shannon entropy or high min entropy, even when one of the two parties is dishonest and deviates from the protocol. We develop protocols that achieve high, close to n, Shannon entropy and simultaneously min entropy close to n/2. In the literature the randomness guarantee is usually expressed in terms of “resilience”. The notion of Shannon entropy is not directly comparable to that of resilience, but we establish a connection between the two that allows us to compare our protocols with the existing ones. We construct an explicit protocol that yields Shannon entropy $$n - O(1)$$ and has $$O(\log ^* n)$$ rounds, improving over the protocol of Goldreich et al. (SIAM J Comput 27: 506–544, 1998) that also achieves this entropy but needs O(n) rounds. Both these protocols need $$O(n^2)$$ bits of communication. Next we reduce the number of rounds and the length of communication in our protocols. We show the existence, non-explicitly, of a protocol that has 6 rounds, O(n) bits of communication and yields Shannon entropy $$n- O(\log n)$$ and min entropy $$n/2 - O(\log n)$$ . Our protocol achieves the same Shannon entropy bound as, also non-explicit, protocol of Gradwohl et al. (in: Dwork (ed) Advances in Cryptology—CRYPTO ‘06, 409–426, Technical Report , 2006), however achieves much higher min entropy: $$n/2 - O(\log n)$$ versus $$O(\log n)$$ . Finally we exhibit a very simple 3-round explicit “geometric” protocol with communication length O(n). We connect the security parameter of this protocol with the well studied Kakeya problem motivated by Harmonic Analysis and Analytic Number Theory. We prove that this protocol has Shannon entropy $$n-o(n)$$ . Its relation to the Kakeya problem follows a new and different approach to the random selection problem than any of the previously known protocols.

Studying lattice reduction algorithms improved by quick reordering technique

Under the threat of quantum computers’ expected powerful computational capacity, the study on post-quantum cryptography is becoming urgent nowadays. Lattice-based cryptography is one of the most promising candidates of post-quantum cryptography. To give a secure instantiation for practical applications, it is necessary to understand the complexity of the best-known attacks. Most of the attacks to lattice-based cryptography use basis reduction algorithms. For instance, the most commonly used practical basis reduction algorithms are variants of the block Korkin–Zolotarev (BKZ) algorithm. In this paper, we study the effect of applying the quick reordering technique (QRT) to lattice algorithms, mainly the enumeration algorithm and the BKZ algorithm. We show that QRT is a simple method to improve these two algorithms with respect to cutting down the number of search nodes and thus reducing the total runtime. For improving on the LLL algorithm with dimensions smaller than 30, the success rate is larger than 10%, and for the BKZ algorithm with blocksize smaller than 30, the success rate is larger than 40%. At first, we observe that reordering the LLL-reduced basis vectors by increasing norm orders will change the distribution of search nodes in the enumeration tree, which gives a chance to reduce the enumeration search nodes with a certain probability. The experimental results show that the runtime of the enumeration algorithm can be accelerated approximately by a factor of two. We further explain this phenomenon from a theoretical point of view, which follows Gama–Nguyen–Regev’s analysis (Gama et al., in: Advances in cryptology—EUROCRYPT 2010, proceedings of 29th annual international conference on the theory and applications of cryptographic techniques, pp 257–278, 2010). Then we apply this reordering technique to the implementation of the BKZ algorithm in the open-source library NTL. Our experimental results in dimensions 100–120 with blocksize 15–30 show that on the LLL-reduced bases, our modified NTL-BKZ outputs a vector shorter than the original NTL-BKZ with rate 40.91%-45.73% by setting the LLL approximation factor by $$\delta _{LLL}=0.99$$ . Furthermore, in the instances where the improved BKZ found one same or shorter vector, the runtime is up to 2.02 times faster than the original NTL-BKZ when setting the blocksize $$\beta =25$$ with $$\delta _{LLL}=0.99$$ .

A new algorithm on the minimal rational fraction representation of feedback with carry shift registers

In 1994, Klapper and Goresky (Proceedings of the 1993 Cambridge Security Workshop, Lecture Notes in Computer Science, vol 809, Cambridge, pp 174–178, 1994) proposed a new device called feedback with carry shift register to generate pseudo-random sequences instead of using the traditional device linear feedback shift register. They raised an algorithm called as rational approximation algorithm to recover the device for a given sequence (Klapper and Goresky, Advances in Cryptology, Crypto’95, Lecture Notes in Computer Science, vol 963, Springer, Berlin, pp 262–274, 1995). In this paper, we propose a new algorithm by introducing a new parameter and get the best rational approximation of the sequence much more quickly, especially when the size of the sequence increases dramatically. Unlike most of known algorithms, we can solve the minimal lattice basis instead of one shortest vector. Besides, we can prove that the solution of each step is optimal regardless of the length of the input sequence theoretically.

New cube distinguishers on NFSR-based stream ciphers

In this paper, we revisit the work of Sarkar et al. (Des Codes Cryptogr 82(1–2):351–375, 2017) and Liu (Advances in cryptology—Crypto 2017, 2017) and show how both of their ideas can be tuned to find good cubes. Here we propose a new algorithm for cube generation which improves existing results on $${\texttt {Zero-Sum}}$$ distinguisher. We apply our new cube finding algorithm to three different nonlinear feedback shift register (NFSR) based stream ciphers $${\textsf {Trivium}}$$, $$\textsf {Kreyvium}$$ and $$\textsf {ACORN}$$. From the results, we can see a cube of size 39, which gives $${\texttt {Zero-Sum}}$$ for maximum 842 rounds and a significant non-randomness up to 850 rounds of $${\textsf {Trivium}}$$. We provide some small size good cubes for $${\textsf {Trivium}}$$, which outperform existing ones. We further investigate $$\textsf {Kreyvium}$$ and $$\textsf {ACORN}$$ by a similar technique and obtain cubes of size 56 and 92 which give $${\texttt {Zero-Sum}}$$ distinguisher till 875 and 738 initialization rounds of $$\textsf {Kreyvium}$$ and $$\textsf {ACORN}$$ respectively. To the best of our knowledge, these results are best results as compared to the existing results on distinguishing attacks of these ciphers. We also provide a table of good cubes of sizes varying from 10 to 40 for these three ciphers.

Strong Stationary Times and its use in Cryptography

This paper presents applicability of Strong Stationary Times (SST) techniques in the area of cryptography. The applicability is in three areas: *) Propositions of a new class of cryptographic algorithms (pseudo-random permutation generators) which do not run for the predefined number of steps. Instead, these algorithms stop according to a stopping rule defined as SST, for which one can obtain provable properties: *** results are perfect samples from uniform distribution, *** immunity to timing attacks (no information about the resulting permutation leaks through the information about the number of steps SST algorithm *) We show how one can leverage properties of SST-based algorithms to construct an implementation (of a symmetric encryption scheme) which is immune to the timing-attack by reusing implementations which are not secure against timing-attacks. In symmetric key cryptography researchers mainly focus on constant time (re)implementations. Our approach goes in a different direction and explores ideas of input masking. *) Analysis of idealized (mathematical) models of existing cryptographic schemes -- i.e., we improve a result by Mironov ((Not So) Random Shuffles of RC4; Advances in Cryptology -- CRYPTO 2002)

On the quantum attacks against schemes relying on the hardness of finding a short generator of an ideal in ℚ(𝜁2𝑠 )

Abstract A family of ring-based cryptosystems, including the multilinear maps of Garg, Gentry and Halevi [Candidate multilinear maps from ideal lattices, Advances in Cryptology—EUROCRYPT 2013, Lecture Notes in Comput. Sci. 7881, Springer, Heidelberg 2013, 1–17] and the fully homomorphic encryption scheme of Smart and Vercauteren [Fully homomorphic encryption with relatively small key and ciphertext sizes, Public Key Cryptography—PKC 2010, Lecture Notes in Comput. Sci. 6056, Springer, Berlin 2010, 420–443], are based on the hardness of finding a short generator of a principal ideal (short-PIP) in a number field typically in ℚ ⁢ ( ζ 2 s ) {\mathbb{Q}(\zeta_{2^{s}})} . In this paper, we present a polynomial-time quantum algorithm for recovering a generator of a principal ideal in ℚ ⁢ ( ζ 2 s ) {\mathbb{Q}(\zeta_{2^{s}})} , and we recall how this can be used to attack the schemes relying on the short-PIP in ℚ ⁢ ( ζ 2 s ) {\mathbb{Q}(\zeta_{2^{s}})} by using the work of Cramer et al. [R. Cramer, L. Ducas, C. Peikert and O. Regev, Recovering short generators of principal ideals in cyclotomic rings, IACR Cryptology ePrint Archive 2015, https://eprint.iacr.org/2015/313], which is derived from observations of Campbell, Groves and Shepherd [SOLILOQUY, a cautionary tale]. We put this attack into perspective by reviewing earlier attempts at providing an efficient quantum algorithm for solving the PIP in ℚ ⁢ ( ζ 2 s ) {\mathbb{Q}(\zeta_{2^{s}})} . The assumption that short-PIP is hard was challenged by Campbell, Groves and Shepherd. They proposed an approach for solving short-PIP that proceeds in two steps: first they sketched a quantum algorithm for finding an arbitrary generator (not necessarily short) of the input principal ideal. Then they suggested that it is feasible to compute a short generator efficiently from the generator in step 1. Cramer et al. validated step 2 of the approach by giving a detailed analysis. In this paper, we focus on step 1, and we show that step 1 can run in quantum polynomial time if we use an algorithm for the continuous hidden subgroup problem (HSP) due to Eisenträger et al. [K. Eisenträger, S. Hallgren, A. Kitaev and F. Song, A quantum algorithm for computing the unit group of an arbitrary degree number field, Proceedings of the 2014 ACM Symposium on Theory of Computing—STOC’14, ACM, New York 2014, 293–302].

A survey on zero knowledge range proofs and applications

In last years, there has been an increasing effort to leverage distributed ledger technology (DLT), including blockchain. One of the main topics of interest, given its importance, is the research and development of privacy mechanisms, as for example is the case of zero knowledge proofs (ZKP). ZKP is a cryptographic technique that can be used to hide information that is put into the ledger, while still allowing to perform validation of this data. In this work we describe different strategies to construct zero knowledge range proofs (ZKRP), as for example the scheme proposed by Boudot (in: Bart (ed) Advances in cryptology—EUROCRYPT 2000, Springer, Berlin, 2000) in 2001; the one proposed by Camenisch et al. (in: Josef (ed) Advances in cryptology—ASIACRYPT 2008, Springer, Berlin, 2008), and bulletproofs (Bunz et al., in: 2018 IEEE symposium on security and privacy (SP), 2018), proposed in 2017. We also compare these strategies and discuss possible use cases. Since bulletproofs (Bunz et al. 2018) is the most efficient construction, we will give a detailed description of its algorithms and optimizations. Bulletproofs is not only more efficient than previous schemes, but also avoids the trusted setup, which is a requirement that is not desirable in the context of DLT and blockchain. In case of cryptocurrencies, if the setup phase is compromised, it would be possible to generate money out of thin air. Interestingly, bulletproofs can also be used to construct generic ZKP, in the sense that it can be used to prove generic statements, and thus it is not only restricted to ZKRP, but it can be used for any kind of proof of knowledge. Hence Bulletproofs leads to a more powerful tool to provide privacy for DLT. Here we describe in detail the algorithms involved in Bulletproofs protocol for ZKRP. Also, we present our implementation, which was open sourced (Morais et al., in: Zero knowledge range proof implementation, 2018. https://github.com/ing-bank/zkrangeproof ).

Practical $$\mathsf {MP} \text{- }\mathsf {LWE} $$-based encryption balancing security-risk versus efficiency

Middle-product learning with errors ( $$\mathsf {MP} \text{- }\mathsf {LWE} $$ ) is a variant of the $$\mathsf {LWE}$$ problem introduced at CRYPTO 2017 by Rosca et al. (Advances in cryptology—CRYPTO, Springer, Berlin, 2017). Asymptotically, the theoretical results of Rosca et al. (2017) suggest that $$\mathsf {MP} \text{- }\mathsf {LWE} $$ gives lattice-based public-key cryptosystems offering a ‘security-risk vs. efficiency’ trade-off: higher performance than cryptosystems based on unstructured lattices ( $$\mathsf {LWE}$$ problem) and lower risk than cryptosystems based on structured lattices (Polynomial/Ring $$\mathsf {LWE}$$ problem). However, although promising in theory, Rosca et al. (2017) left the practical implications of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ for lattice-based cryptography unclear. In this paper, we show how to build practical public-key cryptosystems with strong security guarantees based on $$\mathsf {MP} \text{- }\mathsf {LWE} $$ . On the implementation side, we present optimised fast algorithms for computing the middle-product operation over polynomial rings $${\mathbb {Z}}_q[x]$$ , the dominant computation for $$\mathsf {MP} \text{- }\mathsf {LWE} $$ -based cryptosystems. On the security side, we show how to obtain a nearly tight security proof for $$\mathsf {MP} \text{- }\mathsf {LWE} $$ from the hardest Polynomial LWE problem over a large family of rings, improving on the loose reduction of Rosca et al. (2017). We also show and analyze an optimised cryptanalysis of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ that narrows the complexity gap between best known attacks on $$\mathsf {MP} \text{- }\mathsf {LWE} $$ and Polynomial $$\mathsf {LWE}$$ . To evaluate the practicality of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ , we apply our results to construct, implement and optimise parameters for a practical $$\mathsf {MP} \text{- }\mathsf {LWE} $$ -based public-key cryptosystem, $$\mathsf {Titanium} $$ , and compare its benchmarks to other lattice-based systems. Our results show that $$\mathsf {MP} \text{- }\mathsf {LWE} $$ offers a new ‘security-risk vs. efficiency’ trade-off in lattice-based cryptography in practice, not only asymptotically in theory.

Polynomial multiplication over binary finite fields: new upper bounds

When implementing a cryptographic algorithm, efficient operations have high relevance both in hardware and in software. Since a number of operations can be performed via polynomial multiplication, the arithmetic of polynomials over finite fields plays a key role in real-life implementations—e.g., accelerating cryptographic and cryptanalytic software (pre- and post-quantum) (Chou in Accelerating pre-and post-quantum cryptography. Ph.D. thesis, Technische Universiteit Eindhoven, 2016). One of the most interesting papers that addressed the problem has been published in 2009. In Bernstein (in: Halevi (ed) Advances in Cryptology—CRYPTO 2009: 29th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 16–20, 2009. Proceedings, pp 317–336. Springer Berlin Heidelberg, Berlin, Heidelberg, 2009), Bernstein suggests to split polynomials into parts and presents a new recursive multiplication technique which is faster than those commonly used. In order to further reduce the number of bit operations (Bernstein in High-speed cryptography in characteristic 2: minimum number of bit operations for multiplication, 2009. http://binary.cr.yp.to/m.html ) required to multiply n-bit polynomials, researchers adopt different approaches. In CMT: Circuit minimization work. http://www.cs.yale.edu/homes/peralta/CircuitStuff/CMT.html a greedy heuristic has been applied to linear straight-line sequences listed in Bernstein (High-speed cryptography in characteristic 2: minimum number of bit operations for multiplication, 2009. http://binary.cr.yp.to/m.html ). In 2013, D’angella et al. (Applied computing conference, 2013. ACC’13. WEAS. pp. 31–37. WEAS, 2013) skip some redundant operations of the multiplication algorithms described in Bernstein (in: Halevi (ed) Advances in Cryptology—CRYPTO 2009: 29th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 16–20, 2009. Proceedings, pp 317–336. Springer Berlin Heidelberg, Berlin, Heidelberg, 2009). In 2015, Cenk et al. (J Cryptogr Eng 5(4):289–303, 2015) suggest new multiplication algorithms. In this paper, (a) we present a “k-1”-level recursion algorithm that can be used to reduce the effective number of bit operations required to multiply n-bit polynomials, and (b) we use algebraic extensions of $$\mathbb {F}_2$$ combined with Lagrange interpolation to improve the asymptotic complexity.

Design and implementation of low-depth pairing-based homomorphic encryption scheme

Homomorphic encryption allows to carry out operations on encrypted data. In this paper, we focus on the design of a scheme based on pairings and elliptic curves, that is able to handle applications where the number of multiplication is not too high, with interesting practical efficiency when compared to lattice-based solutions. The starting point is the Boneh–Goh–Nissim (BGN for short) encryption scheme (Boneh et al. in Kilian J (ed) Theory of cryptography, second theory of cryptography conference, TCC 2005, Cambridge, MA, USA, February 10–12, 2005), which enables the homomorphic evaluation of polynomials of degree at most 2 on ciphertexts. In our scheme, we use constructions coming from Freeman (Gilbert H (ed) Advances in cryptology—EUROCRYPT 2010, 29th annual international conference on the theory and applications of cryptographic techniques, French Riviera, May 30–June 3, 2010) and Catalano and Fiore (Ray I, Li N, Kruegel C (eds) Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, Denver, CO, USA, October 12–16, 2015), to propose a variant of the $${\text {BGN}}$$ scheme that can handle the homomorphic evaluation of polynomials of degree at most 4. We discuss both the mathematical structure of the scheme and its implementation. We provide simulation results, showing the relevance of this solution for applications requiring a low multiplicative depth, and give relative comparison with respect to lattice-based homomorphic encryption schemes.

Analysis of the single-permutation encrypted Davies–Meyer construction

We consider the so-called Encrypted Davies–Meyer (EDM) construction, which turns a permutation P on $$\{0,1\}^n$$ into a function from $$\{0,1\}^n$$ to $$\{0,1\}^n$$ defined as $$P(P(x)\oplus x)$$ . A similar construction using two independent permutations, namely $$P'(P(x)\oplus x)$$ , was previously analyzed by Cogliati and Seurin (Advances in cryptology—CRYPTO 2016 (Proceedings, Part I). LNCS, vol 9814, pp. 121–149, 2016) who showed that when P and $$P'$$ are secret and random, then any black-box adversary needs at least roughly $$2^{2n/3}$$ queries to distinguish the construction from a uniformly random function from $$\{0,1\}^n$$ to $$\{0,1\}^n$$ . In this paper, we focus on the single-permutation variant of the construction. Our main result is that the PRF-security of the single-permutation EDM construction is also (at least) roughly $$2^{2n/3}$$ , in the sense that any black-box adversary needs at least this number of queries to distinguish the construction from a uniformly random function. This yields the first PRP-to-PRF conversion method which uses a single permutation, does not shrink the original domain nor range of the permutation, and provides security beyond the birthday bound.

Multi-input Functional Encryption in the Private-Key Setting: Stronger Security from Weaker Assumptions

We construct a general-purpose multi-input functional encryption scheme in the private-key setting. Namely, we construct a scheme where a functional key corresponding to a function f enables a user holding encryptions of $$x_1, \ldots , x_t$$ to compute $$f(x_1, \ldots , x_t)$$ but nothing else. This is achieved starting from any general-purpose private-key single-input scheme (without any additional assumptions) and is proven to be adaptively secure for any constant number of inputs t. Moreover, it can be extended to a super-constant number of inputs assuming that the underlying single-input scheme is sub-exponentially secure. Instantiating our construction with existing single-input schemes, we obtain multi-input schemes that are based on a variety of assumptions (such as indistinguishability obfuscation, multilinear maps, learning with errors, and even one-way functions), offering various trade-offs between security assumptions and functionality. Previous and concurrent constructions of multi-input functional encryption schemes either rely on stronger assumptions and provided weaker security guarantees (Goldwasser et al. in Advances in cryptology—EUROCRYPT, 2014; Ananth and Jain in Advances in cryptology—CRYPTO, 2015), or relied on multilinear maps and could be proven secure only in an idealized generic model (Boneh et al. in Advances in cryptology—EUROCRYPT, 2015). In comparison, we present a general transformation that simultaneously relies on weaker assumptions and guarantees stronger security.

Optimal Security Proofs for Full Domain Hash, Revisited

RSA Full Domain Hash (RSA-FDH) is a digital signature scheme, secure against chosen message attacks in the random oracle model. The best known security reduction from the RSA assumption is non-tight, i.e., it loses a factor of $$q_s$$ , where $$q_s$$ is the number of signature queries made by the adversary. It was furthermore proven by Coron (Advances in cryptology—EUROCRYPT 2002, Lecture notes in computer science, vol 2332. Springer, Berlin, pp 272–287, 2002) that a security loss of $$q_s$$ is optimal and cannot possibly be improved. In this work, we uncover a subtle flaw in Coron’s impossibility result. Concretely, we show that it only holds if the underlying trapdoor permutation is certified. Since it is well known that the RSA trapdoor permutation is (for all practical parameters) not certified, this renders Coron’s impossibility result moot for RSA-FDH. Motivated by this, we revisit the question whether there is a tight security proof for RSA-FDH. Concretely, we give a new tight security reduction from a stronger assumption, the Phi-Hiding assumption introduced by Cachin et al. (Advances in Cryptology—EUROCRYPT’99. Lecture notes in computer science, vol 1592. Springer, Berlin, pp 402–414, 1999). This justifies the choice of smaller parameters in RSA-FDH, as it is commonly used in practice. All of our results (positive and negative) extend to the probabilistic signature scheme PSS (with message recovery).

A code-based group signature scheme

This work is the extended version of Alamélou et al. (in: Tillich et al. (eds.) The 9th International workshop on coding and cryptography 2015 (WCC2015), 2015) which proposed the first code-based group signature. The new group signature scheme we present here has numerous advantages over all existing post-quantum constructions and even competes (in terms of properties) with pairing based constructions: it allows to add new members during the lifetime of the group (dynamic). Plus, it appears that our scheme might be extended into a traceable signature according to the definition of Kiayias et al. (in: Cachin and Camenisch (eds.) Advances in cryptology—EUROCRYPT 2004, 2004) (KTY model) while handling membership revocation. Our security is based on a relaxation of the model of Bellare et al. (in: Topics in cryptology—CT-RSA 2005, 2005) (BSZ model) verifying the properties of anonymity, traceability and non-frameability. The main idea of our scheme consists in building an offset collision of two syndromes associated to two different matrices: a random one which enables to build a random syndrome from a chosen small weight vector; and a trapdoor matrix for the syndrome decoding problem, which permits to find a small weight preimage of the previous random syndrome to which a fixed syndrome is added. These two small weight vectors will constitute the group member’s secret signing key whose knowledge will be proved thanks to a variation of Stern’s authentication protocol. For applications, we consider the case of the code-based CFS signature scheme (Nicolas in Advances in cryptology—ASIACRYPT 2001, 2001) of Courtois, Finiasz and Sendrier. If one denotes by N the number of group members, CFS leads to signatures and public keys sizes in $$N^{1/\sqrt{{\log }(N)}}$$ . Along with this work, we also introduce a new kind of proof of knowledge, Testable weak Zero Knowledge (TwZK), implicitly covered in the short version of this paper (Alamélou et al. in: Tillich et al. (eds.) The 9th international workshop on coding and cryptography 2015 (WCC2015), 2015). TwZK proofs appear particularly well fitted in the context of group signature schemes: it allows a verifier to test whether a specific witness is used without learning anything more from the proof. Under the random oracle model (ROM), we ensure the security of our scheme by defining the One More Syndrome Decoding problem, a new code-based problem related to the syndrome decoding problem (Berlekamp et al. in IEEE Trans Inf Theory 24(3):384–386, 1978).