Trapdoor Functions Research Articles

Asymmetric information hiding and noise-free recovery based on rotating analyzer ellipsometry and quick-response code.

We report an asymmetric optical information hiding method based on a rotating analyzer ellipsometry technique. This asymmetric hiding architecture not only avoids the interception of keys during transmission or distribution but also makes the cyphertext more inconspicuous for attackers. A new kind of one-way optical trapdoor function is constructed based on the fact that the state of polarization (SOP) of elliptical polarized light cannot be recovered with only the knowledge of intensity captured after passing through a linear polarizer. Meanwhile, the SOP of a polarization ellipse could be calculated by rotating the polarizer to record two scenes of intensity after it. Introduction of a quick response code as a container leads to noise-free recovery for original information and enhances practicality of the proposed cryptosystem with versatile key sensitivity and fault tolerance capability. Numerical simulation results that support theoretical analysis are presented. Analysis on the relationship between hiding effect or quality of decryption and parameters of the algorithm also is provided.

Sequential aggregate signatures with lazy verification from trapdoor permutations

Sequential aggregate signature schemes allow n signers, in order, to sign a message each, at a lower total cost than the cost of n individual signatures. We present a sequential aggregate signature scheme based on trapdoor permutations (e.g., RSA). Unlike prior such proposals, our scheme does not require a signer to retrieve the keys of other signers and verify the aggregate-so-far before adding its own signature. Indeed, we do not even require a signer to know the public keys of other signers!Moreover, for applications that require signers to verify the aggregate anyway, our schemes support lazy verification: a signer can add its own signature to an unverified aggregate and forward it along immediately, postponing verification until load permits or the necessary public keys are obtained. This is especially important for applications where signers must access a large, secure, and current cache of public keys in order to verify messages. The price we pay is that our signature grows slightly with the number of signers.We report a technical analysis of our scheme (which is provably secure in the random oracle model), a detailed implementation-level specification, and implementation results based on RSA and OpenSSL. To evaluate the performance of our scheme, we focus on the target application of BGPsec (formerly known as Secure BGP), a protocol designed for securing the global Internet routing system. There is a particular need for lazy verification with BGPsec, since it is run on routers that must process signatures extremely quickly, while being able to access tens of thousands of public keys. We compare our scheme to the algorithms currently proposed for use in BGPsec, and find that our signatures are considerably shorter than nonaggregate RSA (with the same sign and verify times) and have an order of magnitude faster verification than nonaggregate ECDSA, although ECDSA has shorter signatures when the number of signers is small.

Secure Multi-party Computation based on m-out-n OT

Secure multi-party computation protocol can be realized in many ways, which based on OT construct is a useful realization. We use all but many lossy trapdoor function to design noninteractive chosen m out of n OT. Then, we design multi-party computation protocl based on the new OT. Any two participators of the participants need not execute one out of four OT. We introduce the trust (semi-honest) authority (cloud server), then design noninteractive chosen n − i out of 4(n − i) OT between participants to realize multi-party computation protocl.

N -Evasive all-but-many lossy trapdoor function and its constructions

In this paper, we propose the notion of n-evasive all-but-many lossy trapdoor functions ABM-LTFs, which is an extended abstraction of all-but-n lossy trapdoor functions ABN-LTFs proposed by Hemenway et al. in Asiacrypt 2011 and, at the same time, is a special case of ABM-LTFs proposed by Hofheinz in Eurocrypt 2012. We show two constructions of n-evasive ABM-LTFs. The first one is based on the decisional composite residuosity DCR assumption, and the second one is from chameleon hash functions and ABN-LTFs. Both of the constructions are based on reasonable assumptions with tight security reductions. Similar to ABN-LTFs and ABM-LTFs, n-evasive ABM-LTFs can be employed to construct indistinguishability-based selective opening chosen-ciphertext secure public-key encryption PKE schemes and may have other applications in cryptography. The instantiation of n-evasive ABM-LTFs can be based on the well-known assumption, for example, DCR, and the security reduction is much tighter than that of ABM-LTFs. On the other hand, the black-box PKE construction from n-evasive ABM-LTFs is more general than that from ABN-LTFs. Copyright © 2014 John Wiley & Sons, Ltd.

General Construction of Chameleon All-But-One Trapdoor Functions and Their Applications

Chameleon all-but-one trapdoor function (ABO- TDF) is an important and useful primitive which was introduced in (9). With the help of it, a more efficient black- box construction of public key encryption (PKE) scheme, which is secure against chosen-ciphertext attack (CCA), can be given. In this paper, we formally generalize the construction of chameleon ABO-TDFs. As a special case of our generalization, a concrete construction of ABO-TDFs, which was first introduced by Peikert and Waters (1), is presented. Although the existence of lossy trapdoor functions is equivalent to that of ABO-TDFs by using the conversion in (1), as Peikert et al. said, the conversion involves some degradation in lossiness (i.e. additional leakage). Therefore, in this sense, our result is different from those in (21) where Hemenway et al. proved that homomorphic encryption with some additional properties implies lossy trapdoor functions.

Generating signatures with optimal overhead: practical paddings for signature schemes

ABSTRACTOptimal signatures (generating signatures as short as possible), which achieve the optimal bandwidth for communication, are extremely useful in bandwidth‐critical networks. Previous approaches use the random permutations with large block size as building blocks, which incurs less efficient implementations in the real world. Meanwhile, all the practical signature schemes are not optimal in bandwidth including PSS‐R (probabilistic signature scheme with message recovery ), FDH ( Full Domain Hash), and DSA (Digital Signature Algorithm). This paper presents three constructions for optimal signature schemes. All the proposals use both the random oracles and the ideal ciphers with smaller block sizes as building blocks to obtain optimal paddings for signature schemes. The ideal ciphers in our schemes can be implemented by real block ciphers (e.g., AES (Advanced Encryption Standard)‐256). Concrete implementations of these signature schemes can utilize the trapdoor permutations of Rabin and RSA, respectively. Surprisingly, RSA and Rabin (trapdoor permutations) lead to not only optimality in bandwidth but also a tight security. Therefore, besides yielding secure signatures with high efficiency, our proposals can also be flexibly applied to the bandwidth‐limited networks that reduces the communication cost as less as possible. Copyright © 2014 John Wiley & Sons, Ltd.

Preimage Selective Trapdoor Function: How to Repair an Easy Problem

Public key cryptosystems are constructed by embedding a trapdoor into a one-way function. So, the one-wayness and the trapdoorness are vital to public key cryptography. In this paper, we propose a novel public key cryptographic primitive called preimage selective trapdoor function. This scenario allows to use exponentially many preimage to hide a plaintext even if the underlying function is not one-way. The compact knapsack problem is used to construct a probabilistic public key cryptosystem, the underlying encryption function of which is proven to be preimage selective trapdoor one-way functions under some linearization attack models. The constructive method can guarantee the noninjectivity of the underlying encryption function and the unique decipherability for ciphertexts simultaneously. It is heuristically argued that the security of the proposal cannot be compromised by a polynomial-time adversary even if the compact knapsack is easy to solve. We failed to provide any provable security results about the proposal; however, heuristic illustrations show that the proposal is secure against some known attacks including brute force attacks, linearization attacks, and key-recovery attacks. The proposal turns out to have acceptable key sizes and performs efficiently and hence is practical.

An overview of trace based public key cryptography over finite fields

The Discrete Log Problem (DLP), that is computing x, given y=αx and 〈α〉=G⊂Fq∗, based Public Key Cryptosystem (PKC) have been studied since the late 1970’s. Such development of PKC was possible because of the trapdoor function f:Zℓ→G=〈α〉⊂Fq∗, f(m)=αm is a group homomorphism. Due to this fact we have; Diffie Hellman (DH) type key exchange, ElGamal type message encryption, and Nyberg–Rueppel type digital signature protocols. The cryptosystems based on the trapdoor f(m)=αm are well understood and complete. However, there is another trapdoor function f:Zℓ→G, f(m)→Tr(αm), where G=〈α〉⊂Fqk∗,k≥2, which needs more attention from researchers from a cryptographic protocols point of view. In the above mentioned case, although f is computable, it is not clear how to produce protocols such as Diffie Hellman type key exchange, ElGamal type message encryption, and Nyberg–Rueppel type digital signature algorithm, in general. It would be better, of course if we can find a more efficient algorithm than repeated squaring and trace to compute f(m)=Tr(αm) together with these protocols. In the literature we see some works for a more efficient algorithm to compute f(m)=Tr(αm) and not wondering about the protocols. We also see some works dealing with an efficient algorithm to compute Tr(αm) as well as discussing the cryptographic protocols. In this review paper, we are going to discuss the state of art on the subject.

A Framework for Automated Security Proof and its Application to OAEP

OAEP is a widely used public-key encryption scheme based on trapdoor permutation. Its security proof has been scrutinized and amended repeatedly. In this paper we present a automatically proof for IND-CCA2 security of OAEP, which is completed by a framework for mechanized security proof, without any human intervention. The framework is built on the base of probabilistic polynomial-time process calculus, and capable of dealing with padding-based encryption schemes. We provide an overview of the proof instance and explain several crucial steps of the game transformation.

Monoidal computer I: Basic computability by string diagrams

We present a new model of computation, described in terms of monoidal categories. It conforms to the Church–Turing Thesis, and captures the same computable functions as the standard models. It provides a succinct categorical interface to most of them, free of their diverse implementation details, using the ideas and structures that in the meantime emerged from research in semantics of computation and programming. The salient feature of the language of monoidal categories is that it is supported by a sound and complete graphical formalism, string diagrams, which provide a concrete and intuitive interface for abstract reasoning about computation. The original motivation and the ultimate goal of this effort is to provide a convenient high level programming language for a theory of computational resources, such as one-way functions, and trapdoor functions, by adopting the methods for hiding the low level implementation details that emerged from practice.

Efficient three-party encrypted key exchange using trapdoor functions

Three-party encrypted key exchange (3PEKE) enables two communicating parties to securely exchange confidential and authenticated information over an insecure network via a trusted server. This investigation presents a novel efficient and secure 3PEKE protocol using a super-poly-to-one trapdoor function. The proposed protocol employs the Diffie–Hellman key exchange and adopts the technique that the clients can publicly exchange the factors for generating the session key without the help of the server to reduce the numbers of transmissions. A round-efficient version of the proposed 3PEKE protocol is also described. Compared with related approaches, the proposed protocol not only retains security requirements and possesses lower computational cost but also has fewer transmissions and realizes the lower bounds of communications. Copyright © 2013 John Wiley & Sons, Ltd.

Feebly secure cryptographic primitives

In 1992, A. Hiltgen provided first construction of provably (slightly) secure cryptographic primitives, namely, feebly one-way functions. These functions are provably harder to invert than to compute, but the complexity (viewed as the circuit complexity over circuits with arbitrary binary gates) is amplified only by a constant factor (in Hiltgen’s works, the factor approaches 2). In traditional cryptography, one-way functions are the basic primitive of private-key shemes, while public-key schemes are constructed using trapdoor functions. We continue Hiltgen’s work by providing examples of feebly secure trapdoor functions where the adversary is guaranteed to spend more time than honest participants (also by a constant factor). We give both a (simpler) linear and a (better) nonlinear construction. Bibliography: 25 titles.

Circuit complexity of linear functions: gate elimination and feeble security

In this paper, we consider provably secure cryptographic constructions in the context of circuit complexity. Based on the ideas of provably secure trapdoor functions developed in (Hirsch, Nikolenko, 2009; Melanich, 2009), we present a new linear construction of a provably secure trapdoor function with order of security 5/4. Besides, we present an in-depth general study of the gate elimination method for the case of linear functions. We also give a nonconstructive proof of lower bounds on the circuit complexity of linear Boolean functions and upper bounds on circuit implementations of linear Boolean functions, obtaining specific constants. Bibliography: 53 titles.

Enhancements of Trapdoor Permutations

We take a closer look at several enhancements of the notion of trapdoor permutations. Specifically, we consider the notions of enhanced trapdoor permutation (Goldreich, Foundation of Cryptography: Basic Applications, 2004) and doubly enhanced trapdoor permutation (Goldreich, Computational Complexity: A Conceptual Perspective, 2011) as well as intermediate notions (Rothblum, A Taxonomy of Enhanced Trapdoor Permutations, 2010). These enhancements arose in the study of Oblivious Transfer and NIZK, but they address natural concerns that may arise also in other applications of trapdoor permutations. We clarify why these enhancements are needed in such applications, and show that they actually suffice for these needs.

Lossy trapdoor functions from homomorphic reproducible encryption

Reproducible public-key encryption (reproducible PKE) provides an alternative way of encryption, which is called a reproduction algorithm, in addition to normally applying the encryption algorithm with the message and the randomness — applying the reproduction algorithm with the message, the secret key, and a ciphertext (possibly encrypted under a different public key).In this work, we show how to construct lossy trapdoor functions from homomorphic reproducible PKE, generalizing the DDH-based construction given by Peikert and Waters (STOC 2008). We also show that reproducible PKE can be constructed from standard number-theoretic assumptions, including DDH, QR, and DCR, and from smooth projective hash proof systems.

Anonymous overlay network supporting authenticated routing

Typical anonymous networks mainly focus on providing strong anonymity at the price of having lower bandwidth, higher latency and degraded usability with limited routing support. They also often anonymize only a few specific applications. In this paper, we propose a new approach of constructing an anonymous network by building an overlay network atop a conventional IP network. The overlay network decouples the actual IP addresses of nodes and the virtual addresses that the nodes are using in actual applications. To do so, we use virtual addresses to anonymize the hosts and the physical IP address for efficient routing. The virtual addresses can also be dynamic for enhancing the nodes’ anonymity further. This approach also allows the network to support almost any application running on it. Together with a new anonymous routing protocol, our simulation results show that the expected latency of our proposed anonymous system can be reduced by up to 50% compared to existing systems.We also propose a suite of authentication methods which can be applied to the anonymous routing protocol we propose for preventing any malicious path cost reduction. Traditional routing protocols leak network topology information to nodes while existing anonymous routing protocols do not provide authentication for routing information. A malicious node can arbitrarily reduce the path cost value carried in an anonymous route announcement message for the purpose of negatively influencing routing efficiency or facilitating the launch of various attacks such as eavesdropping or man-in-the-middle attacks. We propose three generic schemes and several concrete instantiations to transform an anonymous routing protocol into an authenticated one which not only prevents path cost reduction attacks but also maintains anonymity. These schemes are based on three different primitives, namely one-way trapdoor functions, digital signature schemes and collision-resistant hash functions.

An Efficient Non-interactive Universally Composable String-Commitment Scheme

This paper presents a new non-interactive string-commitment scheme that achieves universally composable security. Security is proven under the decisional composite residuosity (DCR) assumption (or the decisional Diffie-Hellman (DDH) assumption) in the common reference string (CRS) model. The universal composability (UC) is a very strong security notion. If cryptographic protocols are proven secure in the UC framework, then they remain secure even if they are composed with arbitrary protocols and polynomially many copies of the protocols are run concurrently. Many UC commitment schemes in the CRS model have been proposed, but they are either interactive commitment or bit-commitment (not string-commitment) schemes. We note, however, that although our scheme is the first non-interactive UC string-commitment scheme, a CRS is not reusable. We use an extension of all-but-one trapdoor functions (ABO-TDFs) proposed by Peikert and Waters at STOC 2008 as an essential building block. Our main idea is to extend (original deterministic) ABO-TDFs to probabilistic ones by using the homomorphic properties of their function indices. The function indices of ABO-TDFs consist of ciphertexts of homomorphic encryption schemes (such as ElGamal, and Damgard-Jurik encryption). Therefore we can re-randomize the output of ABO-TDFs by re-randomization of ciphertexts. This is a new application of ABO-TDFs.

More Constructions of Lossy and Correlation-Secure Trapdoor Functions

We propose new and improved instantiations of lossy trapdoor functions (Peikert and Waters in STOC'08, pp. 187---196, 2008), and correlation-secure trapdoor functions (Rosen and Segev in TCC'09, LNCS, vol. 5444, pp. 419---436, 2009). Our constructions widen the set of number-theoretic assumptions upon which these primitives can be based, and are summarized as follows:

IK-CPA security implies IE-CCA security in the random oracle model

Key-privacy is a notion of security that is concerned with the key anonymity in public-key encryption. Some popular schemes keep key-privacy, while others do not. Key-privacy has been shown to be orthogonal to data-privacy within one cryptosystem. This paper investigates the relationship between keyprivacy and data-privacy in public-key encryption. We show that the existence of IK-CPA secure cryptosystems implies the existence of IE-CCA secure cryptosystems in the random oracle model. The main contributions include a novel construction of a family of injective one-way trapdoor functions directly based on any IK-CPA secure public-key cryptosystem in the random oracle model. This construction adopts a novel idea in the construction compared to the existing one. The latter was based on unapproximable trapdoor predicates. The novelty of the construction allows to show that the injective trapdoor functions are secure under correlated products with respect to uniform repetitional distribution. That further allows us to conclude, in the random oracle model, that the existence of IK-CPA secure public-key cryptosystems implies the existence of CCA secure cryptosystems by a result of Rosen and Segev.

Quantum Public-Key Cryptosystem

Quantum one-way functions play a fundamental role in cryptography because of its necessity for the secure encryption schemes taking into account the quantum computer. In this paper our purpose is to establish a theoretical framework for a candidate of the quantum one-way functions and quantum trapdoor functions based on one-parameter unitary groups. The dynamics of parameterized unitary groups ensure the one-wayness and quantum undistinguishability in different levels, and the physical feasibility are derived from the simultaneous approximation of its infinitesimal generators. Moreover, these special functions are used to construct new cryptosystems-the quantum public-key cryptosystems for encrypting both the classical and quantum information.