Arbitrary Message Research Articles

FedComm: Federated Learning as a Medium for Covert Communication

Proposed as a solution to mitigate the privacy implications related to the adoption of deep learning, Federated Learning (FL) enables large numbers of participants to successfully train deep neural networks without revealing the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">actual</i> private training data. To date, a substantial amount of research has investigated the security and privacy properties of FL, resulting in a plethora of innovative attack and defense strategies. This paper thoroughly investigates the communication capabilities of an FL scheme. In particular, we show that a party involved in the FL learning process can use FL as a covert communication medium to send an arbitrary message. We introduce FedComm, a novel covert-communication technique that enables robust sharing and transfer of targeted payloads within the FL framework. Our extensive theoretical and empirical evaluations show that FedComm provides a stealthy communication channel, with minimal disruptions to the training process. Our experiments show that FedComm successfully delivers 100% of a payload in the order of kilobits before the FL procedure converges. Our evaluation also shows that FedComm is independent of the application domain and the neural network architecture used by the underlying FL scheme.

Þistil, mistil, kistil: Plants of Death, Rebirth, and Magic in Medieval Scandinavian Runic Inscriptions

<i>Þistil, mistil, kistil</i>: Plants of Death, Rebirth, and Magic in Medieval Scandinavian Runic Inscriptions

FALCON signature vulnerability to special attacks and its protection

It is well known that quantum algorithms offer exponential speedup in solving the integer factorization and discrete logarithm problems that existing public-key systems rely on. Thus, post-quantum cryptography seeks alternative classical algorithms that can withstand quantum cryptanalysis. Growing concern about the quantum threat has prompted the National Institute of Standards and Technology (NIST) to invite and evaluate applications for a post-quantum cryptography standard, an ongoing process scheduled to be completed by 2023.&#x0D; Falcon is an electronic signature algorithm based on the mathematics of algebraic lattices. The disadvantage of this algorithm is the small number of studies of resistance against special attacks, as well as attacks through side channels.&#x0D; This material examines existing attacks on the implementation, and also analyzes the speed with applying countermeasures that would prevent such attacks. Although the Falcon scheme sampler, as well as certain mathematical transformations, are still vulnerable to attacks (which in turn allow the private key to be obtained), the efficiency of the components and mathematics of this signature algorithm make it competitive with other schemes, even with countermeasures against these attacks.&#x0D; The work will also consider the attack by side channels on the Falcon. Such an attack is a known-plaintext attack that uses the device's electromagnetic radiation to derive secret signature keys, which can then be used to forge signatures in arbitrary messages. The obtained results show that Falcon is quite vulnerable to side-channel attacks and does not yet have protection against such attacks in the proposed implementation. Because of this, standardization or implementation should consider the possibility of physical attacks, as well as options for countering such attacks.

Stochastic alternating direction method of multipliers for Byzantine-robust distributed learning

This paper aims to solve a distributed learning problem under Byzantine attacks. In the underlying distributed master-worker architecture, there exist a number of unknown but malicious workers that can send arbitrary messages to the master to deviate the learning process, called Byzantine workers. In the literature, a total variation (TV) norm-penalized approximation formulation has been investigated to alleviate the effect of Byzantine attacks. To be specific, the TV norm penalty not only forces the local variables at the regular workers to be close, but is robust to the outliers sent by the Byzantine workers as well. For handling the separable TV norm-penalized approximation formulation, we propose a Byzantine-robust stochastic alternating direction method of multipliers (ADMM). Theoretically, we prove that the proposed method converges to a bounded neighborhood of the optimal solution at a rate of O(1/k) under mild assumptions, where k is the number of iterations and the size of neighborhood is determined by the number of Byzantine workers. Numerical experiments on the MNIST and COVERTYPE datasets further demonstrate the effectiveness of the proposed method to various Byzantine attacks.

Development of a hash algorithm based on cellular automata and chaos theory

Information security, reliability of data transfer are today an important component of the globalization of information technology. Therefore, the proposed work is devoted to highlighting the results of the design and development of a hacking-resistant algorithm to ensure the integrity of information transfer via digital technology and computer engineering. To solve such problems, cryptographic hashing functions are used. In particular, elements of deterministic Chaos were introduced into the developed cyclic hashing algorithm. The investigation analyzes in detail the strengths and weaknesses of known hashing algorithms. They are shown to have disadvantages. The main ones are a large number of matches (Hamming (x, y) and the presence of a weak avalanche effect, which lead to a significant decrease in the reliability of the algorithm for hacking. The designed hashing algorithm uses an iterative Merkley-Damgard structure, augmented by the input message to a length multiple of 512 bits. Processing in blocks of 128-bit uses cellular automata with mixed rules of 30, 105 and 90, 150 and takes into account the dependence of the generation of the initial vector on the incoming message. This allows half of the 10,000 pairs of arbitrary messages to have an inverse Hamming distance of 0 to 2. The proposed algorithm is four times slower than the well-known family of "secure hash algorithms." However, computation speed is not a critical requirement for a hash function. Decreasing the sensitivity to the avalanche effect allows the generation time to be approximately halved. Optimization of the algorithm, as well as its testing was carried out using new technologies of the Java programming language (version 15). Suggestions and recommendations for improving this approach to data hashing are given also

An algorithm for embedding information in digital images based on discrete wavelet transform and learning automata

The paper presents a new algorithm for embedding information in the frequency domain of the discrete wavelet-transform (DWT) of digital images. A block version of quantization index modulation (QIM) is used as a basic embedding operation. A distinctive feature of the algorithm consists in the adaptive selection of the data block size depending on the local properties of the cover image. It has been shown experimentally that for image areas containing a larger number of edge pixels, it is necessary to select blocks of greater length in the corresponding frequency domains. In addition, the problem of optimization the distortions in the blocks of DWT coefficients is substantiated and solved in order to improve the quality of embedding. A computing model of learning automata is used to solve this problem. The advantage of the obtained algorithm is that the receiver of the stego-image does not need additional information to extract the embedded message. The algorithm is highly efficient in terms of the main criteria of embedding quality and can be used both for embedding digital watermarks and arbitrary messages.

A Practical Forgery Attack on Lilliput-AE

Lilliput-AE is a tweakable block cipher submitted as a candidate to the NIST lightweight cryptography standardization process. It is based upon the lightweight block cipher Lilliput, whose cryptanalysis so far suggests that it has a large security margin. In this note, we present an extremely efficient forgery attack on Lilliput-AE: Given a single arbitrary message of length about $$2^{36}$$ bytes, we can instantly produce another valid message that leads to the same tag, along with the corresponding ciphertext. The attack uses a weakness in the tweakey schedule of Lilliput-AE which leads to the existence of a related-tweak differential characteristic with probability 1 in the underlying block cipher. The weakness we exploit, which does not exist in Lilliput, demonstrates the potential security risk in using a very simple tweakey schedule in which the same part of the key/tweak is reused in every round, even when round constants are employed to prevent slide attacks. Following this attack, the Lilliput-AE submission to NIST was tweaked.

On the Security of LWE Cryptosystem against Subversion Attacks

Abstract Subversion of cryptography has received wide attentions especially after the Snowden Revelations in 2013. Most of the currently proposed subversion attacks essentially rely on the freedom of randomness choosing in the cryptographic protocol to hide backdoors embedded in the cryptosystems. Despite the fact that significant progresses in this line of research have been made, most of them mainly considered the classical setting, while the research gap regarding subversion attacks against post-quantum cryptography remains tremendous. Inspired by this observation, we investigate a subversion attack against existing protocol that is proved post-quantum secure. Particularly, we show an efficient way to undetectably subvert the well-known lattice-based encryption scheme proposed by Regev (STOC 2005). Our subversion enables the subverted algorithm to stealthily leak arbitrary messages to the outsider who knows the backdoor. Through theoretical analysis and experimental observations, we demonstrate that the subversion attack against the LWE encryption scheme is feasible and practical.

Strong continuous non-malleable encoding schemes with tamper-detection

A non-malleable encoding scheme is a keyless encoding scheme which is resilient to tampering attacks. Such a scheme is said to be continuously secure if the scheme is resilient to attacks containing more than one tampering procedure. Moreover, such a scheme is said to have the T-tamper-detection property if any kind of tampering attack by an adversary chosen from a predetermined class of algorithms T is detected. Faust et al. have introduced a continuous non-malleable encoding scheme based on non-interactive zero-knowledge (NIZK) which is secure in a strong model for which the adversary receives the tampered codeword as a response to its tampering query if the tampered codeword is not identical to the original codeword but is decodable, while it receives a failure signal ⊥ after sending the first undecodable tampered codeword.In this article, on the one hand, we propose a unified framework for security models related to tamper-detection and leakage-resilience, and on the other hand, we introduce a new strongly secure continuous non-malleable encoding scheme having tamper-detection property with respect to all polynomial-time adversaries, satisfying a better leakage bound whose security is based on the existence of secure MAC’s. Also, as a byproduct, we introduce and justify the importance of an intermediate security model called semistrong continuous non-malleability, while we discuss different variants of these security models and provide a secure semistrong continuous non-malleable encoding scheme whose security is based on the existence of CCA-secure public-key encryption. We provide concrete proofs indicating that there is a trade-off between tamper-detection for all efficient Turing machines and being plain-CRS (i.e. the property that any user including adversaries can encode arbitrary messages), and we deduce that any tamper-detection encoding scheme for all efficient Turing machines cannot be re-encodable.Considering applications, it is instructive to note that our proposed schemes can be used to implement an algorithmic tamper-detection at a software level while satisfying the necessary security conditions.

Optimal Download Cost of Private Information Retrieval for Arbitrary Message Length

A private information retrieval scheme is a mechanism that allows a user to retrieve any one out of $K$ messages from $N$ non-communicating replicated databases, each of which stores all $K$ messages, without revealing anything about the identity of the desired message index to any individual database. If the size of each message is $L$ bits and the total download required by a PIR scheme from all $N$ databases is $D$ bits, then $D$ is called the download cost and the ratio $L/D$ is called an achievable rate. For fixed $K,N\in\mathbb{N}$, the capacity of PIR, denoted by $C$, is the supremum of achievable rates over all PIR schemes and over all message sizes, and was recently shown to be $C=(1+1/N+1/N^2+\cdots+1/N^{K-1})^{-1}$. In this work, for arbitrary $K, N$, we explore the minimum download cost $D_L$ across all PIR schemes (not restricted to linear schemes) for arbitrary message lengths $L$ under arbitrary choices of alphabet (not restricted to finite fields) for the message and download symbols. If the same $M$-ary alphabet is used for the message and download symbols, then we show that the optimal download cost in $M$-ary symbols is $D_L=\lceil\frac{L}{C}\rceil$. If the message symbols are in $M$-ary alphabet and the downloaded symbols are in $M'$-ary alphabet, then we show that the optimal download cost in $M'$-ary symbols, $D_L\in\left\{\left\lceil \frac{L'}{C}\right\rceil,\left\lceil \frac{L'}{C}\right\rceil-1,\left\lceil \frac{L'}{C}\right\rceil-2\right\}$, where $L'= \lceil L \log_{M'} M\rceil$.

Identity-based blind signature from lattices

Blind signature allows a user to get a signature of a signer on an arbitrary message, and the verifier can convince that the signature is indeed signed by the signer without leaking any information about the message. This property is necessary when the user’s privacy needs protection, such as a bank bill, a trade secret, etc. As an alternative of public key infrastructure, the identity-based system can simplify the key management procedures in certificate-based public key systems. Inspired by the requirement of identity-based blind signature in the post quantum world, we research on identity-based blind signature based on hard lattice problems under the random Oracle model. We propose a construction built upon the blind signature by Ruckert, and it is proved to be one-more unforgeable against selective identity and chosen message attacks (sID-CMA) and unconditionally blind. The proposed scheme has 2 moves, and its security can be reduced to the small integer solution (SIS) problem.

Does communication help people coordinate?

Theoretical and experimental investigations have consistently demonstrated that collective performance in a variety of tasks can be significantly improved by allowing communication. We present the results of the first experiment systematically investigating the value of communication in networked consensus. The goal of all tasks in our experiments is for subjects to reach global consensus, even though nodes can only observe choices of their immediate neighbors. Unlike previous networked consensus tasks, our experiments allow subjects to communicate either with their immediate neighbors (locally) or with the entire network (globally). Moreover, we consider treatments in which essentially arbitrary messages can be sent, as well as those in which only one type of message is allowed, informing others about a node’s local state. We find that local communication adds minimal value: fraction of games solved is essentially identical to treatments with no communication. Ability to communicate globally, in contrast, offers a significant performance improvement. In addition, we find that constraining people to only exchange messages about local state is significantly better than unconstrained communication. We observe that individual behavior is qualitatively consistent across settings: people clearly react to messages they receive in all communication settings. However, we find that messages received in local communication treatments are relatively uninformative, whereas global communication offers substantial information advantage. Exploring mixed communication settings, in which only a subset of agents are global communicators, we find that a significant number of global communicators is needed for performance to approach success when everyone communicates globally. However, global communicators have a significant advantage: a small tightly connected minority of globally communicating nodes can successfully steer outcomes towards their preferences, although this can be significantly mitigated when all other nodes have the ability to communicate locally with their neighbors.

Sponge-based CCA2 secure asymmetric encryption for arbitrary length message (extended version)

OAEP and other similar schemes, proven secure in random-oracle model, require one or more hash functions with an output size larger than those of the standard hash functions. In this paper, we show that by using the popular Sponge construction in the OAEP framework, we can eliminate the need for such a hash function. We provide a new scheme in the OAEP framework and call our scheme Sponge-based asymmetric encryption padding (SpAEP). The scheme SpAEP is based on two functions: Sponge and SpongeWrap, and requires only standard output sizes proposed and standardised for Sponge functions. Our scheme is CCA2 secure for any trapdoor one-way permutation in the ideal permutation model for arbitrary length messages. Our scheme utilises the versatile Sponge function to enhance the capability and efficiency of the OAEP framework. Prior to this work, the only scheme proven secure in the ideal permutation model was OAEP-3R. However this scheme is not efficient in practice as it utilises a full domain permutation which is hard to find and construct efficiently in practice. Therefore, the author of OAEP-3R provided another version of OAEP-3R but in random oracle model. Our scheme SpAEP utilises the ideal permutation model in a novel manner which makes SpAEP efficient and practical to construct a public key encryption. We also propose a key encapsulation mechanism for hybrid encryption using SpAEP with any trapdoor one-way permutation.

On the Message Dimensions of Vector Linearly Solvable Networks

It is known that there exists a network which does not have a scalar linear solution over any finite field but has a vector linear solution when message dimension is 2. It is not known whether this result can be generalized for an arbitrary message dimension. In this letter, we show that there exists a network that admits an $m$ dimensional vector linear solution, where $m$ is a positive integer greater than or equal to 2, but does not have a vector linear solution over any finite field when the message dimension is less than $m$ .

Delay-Energy Tradeoff in Multicast Scheduling for Green Cellular Systems

Multicast transmission based on real-time network state information is a resource-friendly technique to improve the energy efficiency and reduce the traffic burden for cellular systems. This paper evaluates the effectiveness of this technique for downlink transmissions. In particular, a scenario is considered in which multiple mobile users (MUs) asynchronously request to download one common message locally cached at a base station (BS). Due to the randomness of both the channel conditions and the request arrivals from the MUs, the BS may choose to intelligently hold the arrived requests, especially when the channel conditions are bad or the number of requests is small, and then serve them in one shot later via multicasting. Clearly it is of great interest to balance the delay (incurred by holding the requests) and the energy efficiency (EE, defined as the energy cost per request), and this motivates us to quantify the fundamental tradeoff for the proposed “hold-then-serve” scheme. For the scenario with single channel and unit message sizes, it is shown that for a fixed channel bandwidth, the delay-EE tradeoff reduces to judiciously choosing the optimal stopping rule for when to serve all the arrived requests, where the effect of the bandwidth on the achievable delay-EE region is discussed further. By using optimal stopping theory, it is shown that the optimal stopping rule exists for general Markov channel models and request arrival processes. Particularly, for the hard deadline and proportional delay penalty cases, it is shown that the optimal stopping rule exhibits a threshold structure, and the corresponding threshold in the former case is time varying while in the latter case it is a constant. Finally, for the more general scenario with multiple channels and arbitrary message sizes, the optimal scheduling is formulated as a Markov decision process problem, where some efficient suboptimal scheduling algorithms are proposed.

Topology recognition and leader election in colored networks

Topology recognition and leader election are fundamental tasks in distributed computing in networks. The first of them requires each node to find a labeled isomorphic copy of the network, while the result of the second one consists in a single node adopting the label 1 (leader), with all other nodes adopting the label 0 and learning a path to the leader. We consider both these problems in networks whose nodes are equipped with not necessarily distinct labels called colors, and ports at each node of degree d are arbitrarily numbered 0,1,…,d−1. Colored networks are generalizations both of labeled networks, in which nodes have distinct labels, and of anonymous networks, in which nodes do not have labels (all nodes have the same color).In colored networks, topology recognition and leader election are not always feasible. Hence we study two more general problems. Consider a colored network and an input I given to its nodes. The aim of the problem TOP, for this colored network and for I, is to solve topology recognition in this network, if this is possible under input I, and to have all nodes answer “unsolvable” otherwise. Likewise, the aim of the problem LE is to solve leader election in this network, if this is possible under input I, and to have all nodes answer “unsolvable” otherwise.We show that nodes of a network can solve problems TOP and LE, if they are given, as input I, an upper bound k on the number of nodes of a given color, called the size of this color. On the other hand we show that, if the nodes are given an input that does not bound the size of any color, then the answer to TOP and LE must be “unsolvable”, even for the class of rings.Under the assumption that nodes are given an upper bound k on the size of a given color, we study the time of solving problems TOP and LE in the LOCAL model in which, during each round, each node can exchange arbitrary messages with all its neighbors and perform arbitrary local computations. We give an algorithm to solve each of these problems in arbitrary networks in time O(kD+Dlog⁡(n/D)), where D is the diameter of the network and n is its size. We also show that this time is optimal, by exhibiting classes of networks in which every algorithm solving problems TOP or LE must use time Ω(kD+Dlog⁡(n/D)).

Topology recognition with advice

In topology recognition, each node of an anonymous network has to deterministically produce an isomorphic copy of the underlying graph, with all ports correctly marked. This task is usually unfeasible without any a priori information. Such information can be provided to nodes as advice. An oracle knowing the network can give a (possibly different) string of bits to each node, and all nodes must reconstruct the network using this advice, after a given number of rounds of communication. During each round each node can exchange arbitrary messages with all its neighbors and perform arbitrary local computations. The time of completing topology recognition is the number of rounds it takes, and the size of advice is the maximum length of a string given to nodes.We investigate tradeoffs between the time in which topology recognition is accomplished and the minimum size of advice that has to be given to nodes. We provide upper and lower bounds on the minimum size of advice that is sufficient to perform topology recognition in a given time, in the class of all graphs of size n and diameter D≤αn, for any constant α<1. In most cases, our bounds are asymptotically tight.

Attack on Chen et al.'s certificateless aggregate signature scheme

AbstractCertificateless aggregate signature can provide an efficient way to verify a large amount of signatures from different users. This feature makes it very useful in the environments with low bandwidth communication, low storage, and low computability. Recently, Chen et al. proposed a new certificateless aggregate signature scheme. They claim that their scheme is provably secure under the computational Diffie–Hellman problem. Unfortunately, this paper shows that Chen et al.'s scheme is insecure, it cannot resist Type I and Type II adversaries, and the corresponding attacks are given. Furthermore, we also show their scheme exists a more powerful attack, namely, anyone can forge a certificateless signature on an arbitrary message in this attack. Finally, we discuss the reason to produce such attacks and give the corresponding suggestions to resist such attacks. Copyright © 2015 John Wiley &amp; Sons, Ltd.

A New Efficient Identity-based Strong Designated Verifier Signature Scheme with Message Recovery

Designated verifier signature (DVS) allows the signer to convince a verifier the validity of a statement but prevent the verifier from transferring the conviction. Strong designated verifier signature (SDVS) is a variant of DVS, which could make it possible for a signer to convince only the designated verifier that the signature is made by the signer. Recently, many strong designated verifier signature schemes have been presented in identity based setting. Unfortunately, most of them can not satisfy the strongness and non-delegatability properties, and cannot be rigorously proved secure. Moreover, for some special applications, these schemes suffer from larger data size of communication. In this paper, we present an efficient identity-based strong designated verifier signature scheme with message recovery, and then rigorously analyze its security properties in the random oracle model. As far as we know, it is the first provably secure identity-based strong designated verifier signature scheme with message recovery, which can be used to sign an arbitrary long message, and can satisfy all the security properties including the existential unforgeability, strongness property, non-transferability and non-delegatability, etc.

Resistance to Statistical Attacks of Parastrophic Quasigroup Transformation

The resistance to statistical kind of attacks of encrypted messages is a very important property for designing cryptographic primitives. In this paper, the parastrophic quasigroup PE-transformation, proposed elsewhere, is considered and the proof that it has this cryptographic property is given. Namely, it is proven that if PE-transformation is used for design of an encryption function then after n applications of it on arbitrary message the distribution of m-tuples (m = 1; 2; : : : ; n) is uniform. These uniform distributions imply the resistance to statistical attack of the encrypted messages. For illustration of theoretical results, some experimental results are presented as well.