Cryptology CRYPTO Research Articles

High Entropy Random Selection Protocols

We study the two party problem of randomly selecting a common string among all the strings of length n. We want the protocol to have the property that the output distribution has high Shannon entropy or high min entropy, even when one of the two parties is dishonest and deviates from the protocol. We develop protocols that achieve high, close to n, Shannon entropy and simultaneously min entropy close to n/2. In the literature the randomness guarantee is usually expressed in terms of “resilience”. The notion of Shannon entropy is not directly comparable to that of resilience, but we establish a connection between the two that allows us to compare our protocols with the existing ones. We construct an explicit protocol that yields Shannon entropy $$n - O(1)$$ and has $$O(\log ^* n)$$ rounds, improving over the protocol of Goldreich et al. (SIAM J Comput 27: 506–544, 1998) that also achieves this entropy but needs O(n) rounds. Both these protocols need $$O(n^2)$$ bits of communication. Next we reduce the number of rounds and the length of communication in our protocols. We show the existence, non-explicitly, of a protocol that has 6 rounds, O(n) bits of communication and yields Shannon entropy $$n- O(\log n)$$ and min entropy $$n/2 - O(\log n)$$ . Our protocol achieves the same Shannon entropy bound as, also non-explicit, protocol of Gradwohl et al. (in: Dwork (ed) Advances in Cryptology—CRYPTO ‘06, 409–426, Technical Report , 2006), however achieves much higher min entropy: $$n/2 - O(\log n)$$ versus $$O(\log n)$$ . Finally we exhibit a very simple 3-round explicit “geometric” protocol with communication length O(n). We connect the security parameter of this protocol with the well studied Kakeya problem motivated by Harmonic Analysis and Analytic Number Theory. We prove that this protocol has Shannon entropy $$n-o(n)$$ . Its relation to the Kakeya problem follows a new and different approach to the random selection problem than any of the previously known protocols.

New cube distinguishers on NFSR-based stream ciphers

In this paper, we revisit the work of Sarkar et al. (Des Codes Cryptogr 82(1–2):351–375, 2017) and Liu (Advances in cryptology—Crypto 2017, 2017) and show how both of their ideas can be tuned to find good cubes. Here we propose a new algorithm for cube generation which improves existing results on $${\texttt {Zero-Sum}}$$ distinguisher. We apply our new cube finding algorithm to three different nonlinear feedback shift register (NFSR) based stream ciphers $${\textsf {Trivium}}$$, $$\textsf {Kreyvium}$$ and $$\textsf {ACORN}$$. From the results, we can see a cube of size 39, which gives $${\texttt {Zero-Sum}}$$ for maximum 842 rounds and a significant non-randomness up to 850 rounds of $${\textsf {Trivium}}$$. We provide some small size good cubes for $${\textsf {Trivium}}$$, which outperform existing ones. We further investigate $$\textsf {Kreyvium}$$ and $$\textsf {ACORN}$$ by a similar technique and obtain cubes of size 56 and 92 which give $${\texttt {Zero-Sum}}$$ distinguisher till 875 and 738 initialization rounds of $$\textsf {Kreyvium}$$ and $$\textsf {ACORN}$$ respectively. To the best of our knowledge, these results are best results as compared to the existing results on distinguishing attacks of these ciphers. We also provide a table of good cubes of sizes varying from 10 to 40 for these three ciphers.

Practical $$\mathsf {MP} \text{- }\mathsf {LWE} $$-based encryption balancing security-risk versus efficiency

Middle-product learning with errors ( $$\mathsf {MP} \text{- }\mathsf {LWE} $$ ) is a variant of the $$\mathsf {LWE}$$ problem introduced at CRYPTO 2017 by Rosca et al. (Advances in cryptology—CRYPTO, Springer, Berlin, 2017). Asymptotically, the theoretical results of Rosca et al. (2017) suggest that $$\mathsf {MP} \text{- }\mathsf {LWE} $$ gives lattice-based public-key cryptosystems offering a ‘security-risk vs. efficiency’ trade-off: higher performance than cryptosystems based on unstructured lattices ( $$\mathsf {LWE}$$ problem) and lower risk than cryptosystems based on structured lattices (Polynomial/Ring $$\mathsf {LWE}$$ problem). However, although promising in theory, Rosca et al. (2017) left the practical implications of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ for lattice-based cryptography unclear. In this paper, we show how to build practical public-key cryptosystems with strong security guarantees based on $$\mathsf {MP} \text{- }\mathsf {LWE} $$ . On the implementation side, we present optimised fast algorithms for computing the middle-product operation over polynomial rings $${\mathbb {Z}}_q[x]$$ , the dominant computation for $$\mathsf {MP} \text{- }\mathsf {LWE} $$ -based cryptosystems. On the security side, we show how to obtain a nearly tight security proof for $$\mathsf {MP} \text{- }\mathsf {LWE} $$ from the hardest Polynomial LWE problem over a large family of rings, improving on the loose reduction of Rosca et al. (2017). We also show and analyze an optimised cryptanalysis of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ that narrows the complexity gap between best known attacks on $$\mathsf {MP} \text{- }\mathsf {LWE} $$ and Polynomial $$\mathsf {LWE}$$ . To evaluate the practicality of $$\mathsf {MP} \text{- }\mathsf {LWE} $$ , we apply our results to construct, implement and optimise parameters for a practical $$\mathsf {MP} \text{- }\mathsf {LWE} $$ -based public-key cryptosystem, $$\mathsf {Titanium} $$ , and compare its benchmarks to other lattice-based systems. Our results show that $$\mathsf {MP} \text{- }\mathsf {LWE} $$ offers a new ‘security-risk vs. efficiency’ trade-off in lattice-based cryptography in practice, not only asymptotically in theory.

Polynomial multiplication over binary finite fields: new upper bounds

When implementing a cryptographic algorithm, efficient operations have high relevance both in hardware and in software. Since a number of operations can be performed via polynomial multiplication, the arithmetic of polynomials over finite fields plays a key role in real-life implementations—e.g., accelerating cryptographic and cryptanalytic software (pre- and post-quantum) (Chou in Accelerating pre-and post-quantum cryptography. Ph.D. thesis, Technische Universiteit Eindhoven, 2016). One of the most interesting papers that addressed the problem has been published in 2009. In Bernstein (in: Halevi (ed) Advances in Cryptology—CRYPTO 2009: 29th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 16–20, 2009. Proceedings, pp 317–336. Springer Berlin Heidelberg, Berlin, Heidelberg, 2009), Bernstein suggests to split polynomials into parts and presents a new recursive multiplication technique which is faster than those commonly used. In order to further reduce the number of bit operations (Bernstein in High-speed cryptography in characteristic 2: minimum number of bit operations for multiplication, 2009. http://binary.cr.yp.to/m.html ) required to multiply n-bit polynomials, researchers adopt different approaches. In CMT: Circuit minimization work. http://www.cs.yale.edu/homes/peralta/CircuitStuff/CMT.html a greedy heuristic has been applied to linear straight-line sequences listed in Bernstein (High-speed cryptography in characteristic 2: minimum number of bit operations for multiplication, 2009. http://binary.cr.yp.to/m.html ). In 2013, D’angella et al. (Applied computing conference, 2013. ACC’13. WEAS. pp. 31–37. WEAS, 2013) skip some redundant operations of the multiplication algorithms described in Bernstein (in: Halevi (ed) Advances in Cryptology—CRYPTO 2009: 29th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 16–20, 2009. Proceedings, pp 317–336. Springer Berlin Heidelberg, Berlin, Heidelberg, 2009). In 2015, Cenk et al. (J Cryptogr Eng 5(4):289–303, 2015) suggest new multiplication algorithms. In this paper, (a) we present a “k-1”-level recursion algorithm that can be used to reduce the effective number of bit operations required to multiply n-bit polynomials, and (b) we use algebraic extensions of $$\mathbb {F}_2$$ combined with Lagrange interpolation to improve the asymptotic complexity.

Analysis of the single-permutation encrypted Davies–Meyer construction

We consider the so-called Encrypted Davies–Meyer (EDM) construction, which turns a permutation P on $$\{0,1\}^n$$ into a function from $$\{0,1\}^n$$ to $$\{0,1\}^n$$ defined as $$P(P(x)\oplus x)$$ . A similar construction using two independent permutations, namely $$P'(P(x)\oplus x)$$ , was previously analyzed by Cogliati and Seurin (Advances in cryptology—CRYPTO 2016 (Proceedings, Part I). LNCS, vol 9814, pp. 121–149, 2016) who showed that when P and $$P'$$ are secret and random, then any black-box adversary needs at least roughly $$2^{2n/3}$$ queries to distinguish the construction from a uniformly random function from $$\{0,1\}^n$$ to $$\{0,1\}^n$$ . In this paper, we focus on the single-permutation variant of the construction. Our main result is that the PRF-security of the single-permutation EDM construction is also (at least) roughly $$2^{2n/3}$$ , in the sense that any black-box adversary needs at least this number of queries to distinguish the construction from a uniformly random function. This yields the first PRP-to-PRF conversion method which uses a single permutation, does not shrink the original domain nor range of the permutation, and provides security beyond the birthday bound.

Multi-input Functional Encryption in the Private-Key Setting: Stronger Security from Weaker Assumptions

We construct a general-purpose multi-input functional encryption scheme in the private-key setting. Namely, we construct a scheme where a functional key corresponding to a function f enables a user holding encryptions of $$x_1, \ldots , x_t$$ to compute $$f(x_1, \ldots , x_t)$$ but nothing else. This is achieved starting from any general-purpose private-key single-input scheme (without any additional assumptions) and is proven to be adaptively secure for any constant number of inputs t. Moreover, it can be extended to a super-constant number of inputs assuming that the underlying single-input scheme is sub-exponentially secure. Instantiating our construction with existing single-input schemes, we obtain multi-input schemes that are based on a variety of assumptions (such as indistinguishability obfuscation, multilinear maps, learning with errors, and even one-way functions), offering various trade-offs between security assumptions and functionality. Previous and concurrent constructions of multi-input functional encryption schemes either rely on stronger assumptions and provided weaker security guarantees (Goldwasser et al. in Advances in cryptology—EUROCRYPT, 2014; Ananth and Jain in Advances in cryptology—CRYPTO, 2015), or relied on multilinear maps and could be proven secure only in an idealized generic model (Boneh et al. in Advances in cryptology—EUROCRYPT, 2015). In comparison, we present a general transformation that simultaneously relies on weaker assumptions and guarantees stronger security.

Self-updatable encryption with short public parameters and its extensions

Cloud storage is very popular since it has many advantages, but there is a new threat to cloud storage that was not considered before. Self-updatable encryption that updates a past ciphertext to a future ciphertext by using a public key is a new cryptographic primitive introduced by Lee et al. (in: Sako K, Sarkar P (eds) Advances in cryptology—ASIACRYPT 2013, 2013) to defeat this threat, in which an adversary who obtained a past private key can still decrypt a (previously unread) past ciphertext stored in cloud storage. Additionally, an SUE scheme can be combined with an attribute-based encryption (ABE) scheme to construct a powerful revocable-storage ABE (RS-ABE) scheme introduced by Sahai et al. (in: Safavi-Naini R, Canetti R (eds) Advances in cryptology—CRYPTO 2012, 2012) that provides the key revocation and ciphertext updating functionality for cloud storage. In this paper, we propose an efficient SUE scheme and its extended schemes. First, we propose an SUE scheme with short public parameters in prime-order bilinear groups and prove its security under a $$q$$ -type assumption. Next, we extend our SUE scheme to a time-interval SUE (TI-SUE) scheme that supports a time interval in ciphertexts. Our TI-SUE scheme has short public parameters and it is also secure under the $$q$$ -type assumption. Finally, we propose the first large universe RS-ABE scheme with short public parameters in prime-order bilinear groups and prove its security in the selective revocation list model under a $$q$$ -type assumption.

Securely Obfuscating Re-Encryption

We present a positive obfuscation result for a traditional cryptographic functionality. This positive result stands in contrast to well-known impossibility results (Barak et al. in Advances in Cryptology—CRYPTO’01, 2002), for general obfuscation and recent impossibility and implausibility (Goldwasser and Kalai in 46th IEEE Symposium on Foundations of Computer Science (FOCS), pp. 553–562, 2005) results for obfuscation of many cryptographic functionalities.Whereas other positive obfuscation results in the standard model apply to very simple point functions (Canetti in Advances in Cryptology—CRYPTO’97, 1997; Wee in 37th ACM Symposium on Theory of Computing (STOC), pp. 523–532, 2005), our obfuscation result applies to the significantly more complex and widely-used re-encryption functionality. This functionality takes a ciphertext for message m encrypted under Alice’s public key and transforms it into a ciphertext for the same message m under Bob’s public key.To overcome impossibility results and to make our results meaningful for cryptographic functionalities, our scheme satisfies a definition of obfuscation which incorporates more security-aware provisions.

Elliptic Curve Cryptosystems in the Presence of Permanent and Transient Faults

Elliptic curve cryptosystems in the presence of faults were studied by Biehl et al., Advances in Cryptology CRYPTO 2000, Springer Verlag (2000) pp. 131--146. The first fault model they consider requires that the input point P in the computation of dP is chosen by the adversary. Their second and third fault models only require the knowledge of P. But these two latter models are less `practical' in the sense that they assume that only a few bits of error are inserted (typically exactly one bit is supposed to be disturbed) either into P just prior to the point multiplication or during the course of the computation in a chosen location. This paper relaxes these assumptions and shows how random (and thus unknown) errors in either coordinates of point P, in the elliptic curve parameters or in the field representation enable the (partial) recovery of multiplier d. Then, from multiple point multiplications, we explain how this can be turned into a total key recovery. Simple precautions to prevent the leakage of secrets are also discussed.

Threshold circuit lower bounds on cryptographic functions

In this work, we are interested in non-trivial upper bounds on the spectral norm of binary matrices M from { - 1 , 1 } N × N . It is known that the distributed Boolean function represented by M is hard to compute in various restricted models of computation if the spectral norm is bounded from above by N 1 - ɛ , where ɛ > 0 denotes a fixed constant. For instance, the size of a two-layer threshold circuit (with polynomially bounded weights for the gates in the hidden layer, but unbounded weights for the output gate) grows exponentially fast with n ≔ log N . We prove sufficient conditions on M that imply small spectral norms (and thus high computational complexity in restricted models). Our general results cover specific cases, where the matrix M represents a bit (the least significant bit or other fixed bits) of fundamental functions. Functions like the discrete multiplication and division, as well as cryptographic functions such as the Diffie–Hellman function (IEEE Trans. Inform. Theory 22(6) (1976) 644–654) and the decryption functions of the Pointcheval (Advances in Cryptology—Proceedings of EUROCRYPT ’99, Lecture Notes in Computer Science, Springer, Berlin, 1999, pp. 239–254) and the El Gamal (Advances in Cryptology—CRYPTO ’84, 1984, pp. 10–18) cryptosystems can be addressed by our technique. In order to obtain our results, we make a detour on exponential sums and on spectral norms of matrices with complex entries. This method might be considered interesting in its own right.

Efficient on-line electronic checks

Chaum proposed two electronic check schemes in 1988 and 1989, respectively [Chaum et al., Advances in Cryptology––CRYPTO'88, 1990, pp. 319–327; Efficient Offline Electronic Check, 1989, pp. 294–301]. Both of the two schemes are not efficient. Besides, the face value and payee's identification information of an electronic check has to be decided before the bank issued electronic check. In this paper, an efficient and practical electronic check scheme is proposed to make it possible for a payer to attach the desired face value and payee's identification information to his electronic check when paying. The proposed scheme not only keeps the attached information from being forged but also avoids two or more different face value being attached to the same electronic check. Furthermore, the extra computation required for information attachment is just hashing, without any time-consuming computation such as modular exponentiation or inverse computation. Since the cost of hashing computation is cheap, the proposed scheme is very efficient.

Efficient identity-based authenticated key agreement protocol from pairings

Since Boneh and Franklin [Advances in cryptology––CRYPTO LNCS 2139 (2001) 213] gave the first feasible solutions for identity-based encryption using Weil pairing on elliptic curves, many identity-based key agreement protocols and signature schemes using bilinear pairing have been suggested. As argued in [Designs, Codes and Cryptography 28 (2003) 119], secure and efficient key agreement protocols should provide certain security attributes and low communication overhead. The communication overhead depends on the number of key components transmitted by each entity. Until now, there is no secure two-pass ID-based authenticated key agreement protocol, which provides perfect secrecy and transmits only one key component. Here, we propose a few ID-based authenticated key agreement protocols based on a bilinear pairing. Our final protocol is a two-pass authenticated key agreement protocol with required security attributes and minimal communication overhead.

A faster single-term divisible electronic cash: ZCash

This paper presented a new unlinkable, single-term divisible electronic cash scheme, whose name is ZCash. This scheme overcomes the problems of previous schemes through its greater efficiency and the unlinkability of every cash it generates. Compared with Okamoto’s scheme [Advances in Cryptology—Crypto ’95, Springer, New York, 1995: 438–451] and Chan’s scheme [Advances in Cryptology—Eurocrypt ’98, Springer, New York, 1998: 561–575] (the two best known E-cash schemes), ZCash achieve higher efficiency by not using range-bounded commitment schemes. In addition, to prove the correctness of the blind candidate, we use some simple zero-knowledge protocols instead of the Account Opening protocol and Electronic License. By using the indirect disclosure proof in the payment protocol, ZCash realizes revocable anonymity, which allows a trustee to trace the owner of the E-cash according to its payment transcript. ZCash is the first E-cash scheme which realizes both divisibility and revocable anonymity.