Cryptographic protocols
|
|
- Barnaby Higgins
- 6 years ago
- Views:
Transcription
1 Cryptographic protocols Lecture 3: Zero-knowledge protocols for identification 6/16/03 (c) Jussipekka Leiwo Overview of ZK Asymmetric identification techniques that do not rely on digital signatures or PK encryption avoid block ciphers, sequence numbers, timestamps Similar to challenge response protocols but are based on interactive proofs and zero-knowledge proofs, and employ random numbers as commitments to prevent cheating Not only as challenges 1
2 ZK concepts ZK allows prover (claimant) to demonstrate knowledge of a secret without revealing any information of use to the verifier Single bit of information need be conveyed that the prover knows the secret (related to trusted oracles) Interactive proofs Multiple messages exchanged Typically dependant on random numbers Probabilistic rather than absolute Called also proof by protocol Proof of knowledge Interactive proof is said to be a proof of knowledge if it has two properties: Completeness: Given honest prover and honest verifier, the protocol succeeds with overwhelming probability Soundness: Exists a polynomial-time algorithm M with the following property: If a dishonest prover (A ) can with non-negligible probability successfully execute the protocol with B, then M can be used to extract from this prover knowledge which with overwhelming probability allows successful subsequent protocol run 2
3 Note on soundness Any party impersonating A must know equivalent of A s secret Soundness guarantees that impersonator must know equivalent of A s secret (can be extracted in polynomial time) Soundness required for cryptographic use prevents dishonest prover from convincing an honest verifier Does not guarantee that acquiring the prover s secret is difficult Zero-knowledge property equally important ZK-property Transcript: A collection of messages resulting from a protocol execution ZK-property: A protocol that is a proof of knowledge has the ZK-property if it is simulatable in the following sense: Exists an expected polynomial-time algorithm (simulator) which can produce, upon input of assertions to be proven but without interacting with the real prover, transcripts indistinguishable from those resulting from interaction with real prover. 3
4 Computational vs. perfect ZK Computational ZK: An observer restricted to probabilistic polynomial-time tests can not distinguish real from simulated transcripts Real and simulated transcripts are said to be polynomially indistinguishable: Any information extracted by a verifier through interaction with a prover provides no advantage to the verifier within polynomial time Perfect ZK: Probability distributions of the transcripts must be identical ZK vs. other asymmetric protocols No degradation with usage: Resist chosen-text attacks Encryption avoided: political advantages? Efficiency: reasonable computation and communication overhead, efficiency raises from the nature of interactive proofs, not from ZK aspect Unproven assumptions: rely on same unproven PK assumptions (factoring, quadratic residuosity) ZK-based vs. ZK: Many real-world implementations not ZK, only based on ZK 4
5 Fiat-Shamir identification protocol A proves knowledge of s to B in t executions of a 3-pass protocol 1. One-time setup 2. Protocol messages 3. Protocol actions Fiat-Shamir setup a. Trust centre T 1. selects and publishes RSA-like modulus n=pq 2. keeps p and q secret b. Each claimant A 1. selects a secret s co-prime to n, 1 s n-1 2. computes v=s 2 mod n 3. registers v with T as it s public key 5
6 Fiat-Shamir protocol messages Each of t rounds has three messages with the form as follows: A B : A B : x = r 2 e {0,1} mod n 3. A B : y = r s e mod n Fiat-Shamir protocol actions Following steps iterated t times, B accepts the proof if all t rounds succeed: a. A chooses a random (commitment) r, 1 r n-1 and sends x=r 2 mod n to B b. B randomly selects a (challenge) bit e, sends to A c. A computes, sends to B (response) y. Either y=r (if e=0) or y=rs mod n (if e=1) d. B rejects the proof if y=0, otherwise accepts upon verifying y 2 x v e (mod n) 6
7 Why is it secure? A must answer two questions: One that demonstrates knowledge of secret s Another (easy) to prevent cheating Adversary impersonating A might try to cheat selecting any r and setting x=r 2 /v, answering challenge e=1 with correct y=r can not answer challenge e=0 that requires knowledge of square root of x mod n Has probability 2 -t for guessing t times right Prover A can answer both questions Schnorr identification protocol Security based on the intractability of the discrete logarithm problem Allows pre-computation, reducing real-time computation of the claimant to a single multiplication module a prime q Suitable for low-end devices Further efficiency through use of a subgroup of order q of the multiplicative group of integers module p, where q (p-1) Lower communication bandwidth than Fiat- Shamir 7
8 Schnorr protocol overview A proves knowledge of secret a (without revealing it) in a time-variant manner (depending on challenge e), identifying A through the association of a with the public key v via A s authenticated certificate A proves it s identity to B in a 3-pass protocol: Selection of system parameters Selection of per-user parameters Protocol messages Protocol actions Schnorr system parameters 1. Prime p is selected such that p-1 is divisible by other prime Discrete logarithms modulo p must be computationally infeasible (e.g. p , q ) 2. Element β is chosen, 1 β p-1 having multiplicative order q E.g. for α, a generator mod p, β= α (p-1)/q mod p 3. Each party obtains an authentic copy of system parameters (p,q, β) and the public key of trusted party T allowing verification of T s signatures S T (m) 4. Parameter t, 2 t < q is chosen, defines security level 2 t 8
9 Schnorr per-user parameters 1. Each claimant A is given a unique identity I A 2. A chooses private key a, 0 a q-1, computes v= β -a mod p 3. A identifies itself by conventional means (e.g. passport) to T, transfers v to T with integrity, obtains certificate cert A from T binding I A with v. Schnorr protocol messages Involves three messages: 1. A B : cert 2. A B : e where r, x = β mod p 1 e 2 3. A B : y = ae + r mod q A t q 9
10 Schnorr protocol actions 1. A chooses a random r (commitment), 1 r q-1, computes (witness) x= β r mod p, sends to B 2. B verifies certa, sends to A (never previously used) random e (challenge), 1 e 2 t 3. A checks 1 e 2 t and sends B (response) y=ae+r mod q 4. B computes z=β y v e mod p, accepts A s identity provided z=x. Notes on Schnorr security Probability of forgery: t must be sufficiently large to make the probability 2 -t of correctly guessing challenge e negligible. t=40, q 22t = 280 originally recommended. Larger q may be needed to timememory trade-offs, q 2160 recommended to preclude other off-line discrete log attacks. Guessing of e allows adversary to impersonate A. Soundness: Any party completing the protocol as A must be capable of computing a (i.e. protocol is a proof of knowledge). ZK-property:Not ZK for large e because through interaction, B obtains solution (x,y,e) to x=β y v e mod pi which B itself might not be able to compute 10
11 Avoiding attacks on identification Type of attack replay interleaving reflection chosen-text forced delay Avoidance Use of challenge response, use of nonces, embed target identity in response linking together all messages from a protocol run (e.g. using chained nonces) embed identifier of target party in responses to challenges, construc protocols with each message being different format (avoid symmetries), use unidirectional keys use of ZK, embed in each response to a challenge a self-chosen random number (cofounder) combine use of random numbers with short response time-outs, timestamps Thank you! Jussipekka Leiwo, Ph.D. 6/16/03 (c) Jussipekka Leiwo 11
Identification Schemes
Identification Schemes Lecture Outline Identification schemes passwords one-time passwords challenge-response zero knowledge proof protocols Authentication Data source authentication (message authentication):
More informationICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification Hossen Asiful Mustafa Introduction Entity Authentication is a technique designed to let one party prove the identity of another
More informationA Mathematical Proof. Zero Knowledge Protocols. Interactive Proof System. Other Kinds of Proofs. When referring to a proof in logic we usually mean:
A Mathematical Proof When referring to a proof in logic we usually mean: 1. A sequence of statements. 2. Based on axioms. Zero Knowledge Protocols 3. Each statement is derived via the derivation rules.
More informationZero Knowledge Protocols. c Eli Biham - May 3, Zero Knowledge Protocols (16)
Zero Knowledge Protocols c Eli Biham - May 3, 2005 442 Zero Knowledge Protocols (16) A Mathematical Proof When referring to a proof in logic we usually mean: 1. A sequence of statements. 2. Based on axioms.
More informationZero Knowledge Protocol
Akash Patel (SJSU) Zero Knowledge Protocol Zero knowledge proof or protocol is method in which a party A can prove that given statement X is certainly true to party B without revealing any additional information
More informationComputer Security CS 426 Lecture 35. CS426 Fall 2010/Lecture 35 1
Computer Security CS 426 Lecture 35 Commitment & Zero Knowledge Proofs 1 Readings for This Lecture Optional: Haveli and Micali: Practical and Privably-Secure Commitment Schemes from Collision-Free Hashing
More informationStudy Guide for the Final Exam
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Handout #22 Professor M. J. Fischer April 30, 2005 1 Exam Coverage Study Guide for the Final Exam The final
More informationCSA E0 312: Secure Computation October 14, Guest Lecture 2-3
CSA E0 312: Secure Computation October 14, 2015 Guest Lecture 2-3 Guest Instructor: C. Pandu Rangan Submitted by: Cressida Hamlet 1 Introduction Till now we have seen only semi-honest parties. From now
More informationLecture 5: Zero Knowledge for all of NP
600.641 Special Topics in Theoretical Cryptography February 5, 2007 Lecture 5: Zero Knowledge for all of NP Instructor: Susan Hohenberger Scribe: Lori Kraus 1 Administrative The first problem set goes
More informationElements of Cryptography and Computer and Networking Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy
Elements of Cryptography and Computer and Networking Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy Homework 2 Due: Friday, 10/28/2016 at 11:55pm PT Will be posted on
More informationSolutions to exam in Cryptography December 17, 2013
CHALMERS TEKNISKA HÖGSKOLA Datavetenskap Daniel Hedin DIT250/TDA351 Solutions to exam in Cryptography December 17, 2013 Hash functions 1. A cryptographic hash function is a deterministic function that
More informationMTAT Research Seminar in Cryptography IND-CCA2 secure cryptosystems
MTAT.07.006 Research Seminar in Cryptography IND-CCA2 secure cryptosystems Dan Bogdanov October 31, 2005 Abstract Standard security assumptions (IND-CPA, IND- CCA) are explained. A number of cryptosystems
More informationMTAT Cryptology II. Entity Authentication. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Entity Authentication Sven Laur University of Tartu Formal Syntax Entity authentication pk (sk, pk) Gen α 1 β 1 β i V pk (α 1,...,α i 1 ) α i P sk (β 1,...,β i 1 ) Is it Charlie?
More informationPublicly-verifiable proof of storage: a modular construction. Federico Giacon
Publicly-verifiable proof of storage: a modular construction Federico Giacon Ruhr-Universita t Bochum federico.giacon@rub.de 6th BunnyTN, Trent 17 December 2015 Proof of Storage Proof of Storage (PoS)
More informationCristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
More informationCSC 5930/9010 Modern Cryptography: Digital Signatures
CSC 5930/9010 Modern Cryptography: Digital Signatures Professor Henry Carter Fall 2018 Recap Implemented public key schemes in practice commonly encapsulate a symmetric key for the rest of encryption KEM/DEM
More informationDigital Signatures. Sven Laur University of Tartu
Digital Signatures Sven Laur swen@math.ut.ee University of Tartu Formal Syntax Digital signature scheme pk (sk, pk) Gen (m, s) (m,s) m M 0 s Sign sk (m) Ver pk (m, s)? = 1 To establish electronic identity,
More informationCS 395T. Formal Model for Secure Key Exchange
CS 395T Formal Model for Secure Key Exchange Main Idea: Compositionality Protocols don t run in a vacuum Security protocols are typically used as building blocks in a larger secure system For example,
More informationHOST Authentication Overview ECE 525
Authentication Overview Authentication refers to the process of verifying the identity of the communicating principals to one another Usually sub-divided into Entity authentication Authentication in real-time
More informationDigital Signatures. KG November 3, Introduction 1. 2 Digital Signatures 2
Digital Signatures KG November 3, 2017 Contents 1 Introduction 1 2 Digital Signatures 2 3 Hash Functions 3 3.1 Attacks.................................... 4 3.2 Compression Functions............................
More informationCS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lectures 16, 17: Security of RSA El Gamal Cryptosystem Announcement Final exam will be on May 11, 2015 between 11:30am 2:00pm in FMH 319 http://www.njit.edu/registrar/exams/finalexams.php
More informationOne-Shot Verifiable Encryption from Lattices. Vadim Lyubashevsky and Gregory Neven IBM Research -- Zurich
One-Shot Verifiable Encryption from Lattices Vadim Lyubashevsky and Gregory Neven IBM Research -- Zurich Zero-Knowledge Proofs Zero-Knowledge Proofs Relation f(s)=t, and want to prove knowledge of s Zero-Knowledge
More informationIdeal Security Protocol. Identify Friend or Foe (IFF) MIG in the Middle 4/2/2012
Ideal Security Protocol Satisfies security requirements Requirements must be precise Efficient Small computational requirement Small bandwidth usage, network delays Not fragile Works when attacker tries
More informationNotes for Lecture 24
U.C. Berkeley CS276: Cryptography Handout N24 Luca Trevisan April 21, 2009 Notes for Lecture 24 Scribed by Milosh Drezgich, posted May 11, 2009 Summary Today we introduce the notion of zero knowledge proof
More informationProofs for Key Establishment Protocols
Information Security Institute Queensland University of Technology December 2007 Outline Key Establishment 1 Key Establishment 2 3 4 Purpose of key establishment Two or more networked parties wish to establish
More informationCryptography V: Digital Signatures
Cryptography V: Digital Signatures Computer Security Lecture 10 David Aspinall School of Informatics University of Edinburgh 10th February 2011 Outline Basics Constructing signature schemes Security of
More informationInformation Security. message M. fingerprint f = H(M) one-way hash. 4/19/2006 Information Security 1
Information Security message M one-way hash fingerprint f = H(M) 4/19/2006 Information Security 1 Outline and Reading Digital signatures Definition RSA signature and verification One-way hash functions
More informationALIKE: Authenticated Lightweight Key Exchange. Sandrine Agagliate, GEMALTO Security Labs
ALIKE: Authenticated Lightweight Key Exchange Sandrine Agagliate, GEMALTO Security Labs Outline: Context Description of ALIKE Generic description Full specification Security properties Chip Unforgeability
More informationIntroduction to Modern Cryptography. Benny Chor
Introduction to Modern Cryptography Benny Chor Identification (User Authentication) Fiat-Shamir Scheme Lecture 12 Tel-Aviv University 4 January 2010 Model and Major Issues Alice wishes to prove to Bob
More informationOn Deniability in the Common Reference String and Random Oracle Model
On Deniability in the Common Reference String and Random Oracle Model Rafael Pass Department of Numerical Analysis and Computer Science Royal Institute of Technology, Stockholm, Sweden rafael@nada.kth.se
More informationT Cryptography and Data Security
T-79.4501 Cryptography and Data Security Lecture 10: 10.1 Random number generation 10.2 Key management - Distribution of symmetric keys - Management of public keys Stallings: Ch 7.4; 7.3; 10.1 1 The Use
More informationIntroduction to Public-Key Cryptography
Introduction to Public-Key Cryptography Nadia Heninger University of Pennsylvania June 11, 2018 We stand today on the brink of a revolution in cryptography. Diffie and Hellman, 1976 Symmetric cryptography
More informationChapter 9. Public Key Cryptography, RSA And Key Management
Chapter 9 Public Key Cryptography, RSA And Key Management RSA by Rivest, Shamir & Adleman of MIT in 1977 The most widely used public-key cryptosystem is RSA. The difficulty of attacking RSA is based on
More informationZero-Knowledge Proof and Authentication Protocols
Zero-Knowledge Proof and Authentication Protocols Ben Lipton April 26, 2016 Outline Background Zero-Knowledge Proofs Zero-Knowledge Authentication History Example Protocols Guillou-Quisquater Non-zero-knowledge
More informationCS549: Cryptography and Network Security
CS549: Cryptography and Network Security by Xiang-Yang Li Department of Computer Science, IIT Cryptography and Network Security 1 Notice This lecture note (Cryptography and Network Security) is prepared
More informationPublic Key Cryptography on RFID tags "A survey on the GPS identification scheme"
Public Key Cryptography on RFID tags "A survey on the GPS identification scheme" Spyridon Antakis Eindhoven University of Technology Department of Mathematics & Computer Science Email: s.antakis@student.tue.nl
More informationCSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong, Spring and 6 February 2018
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong, Spring 2018 5 and 6 February 2018 Identification schemes are mechanisms for Alice to prove her identity to Bob They comprise a setup
More informationReminder: Homework 4. Due: Friday at the beginning of class
Reminder: Homework 4 Due: Friday at the beginning of class 1 Cryptography CS 555 Topic 33: Digital Signatures Part 2 2 Recap El-Gamal/RSA-OAEP Digital Signatures Similarities and differences with MACs
More informationCryptography V: Digital Signatures
Cryptography V: Digital Signatures Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 19th February 2009 Outline Basics Constructing signature schemes Security of
More informationLecture 10, Zero Knowledge Proofs, Secure Computation
CS 4501-6501 Topics in Cryptography 30 Mar 2018 Lecture 10, Zero Knowledge Proofs, Secure Computation Lecturer: Mahmoody Scribe: Bella Vice-Van Heyde, Derrick Blakely, Bobby Andris 1 Introduction Last
More informationL13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
More informationSecure Multiparty Computation
CS573 Data Privacy and Security Secure Multiparty Computation Problem and security definitions Li Xiong Outline Cryptographic primitives Symmetric Encryption Public Key Encryption Secure Multiparty Computation
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 11 October 4, 2017 CPSC 467, Lecture 11 1/39 ElGamal Cryptosystem Message Integrity and Authenticity Message authentication codes
More informationIntroduction to Cryptography and Security Mechanisms: Unit 5. Public-Key Encryption
Introduction to Cryptography and Security Mechanisms: Unit 5 Public-Key Encryption Learning Outcomes Explain the basic principles behind public-key cryptography Recognise the fundamental problems that
More informationSpring 2010: CS419 Computer Security
Spring 2010: CS419 Computer Security Vinod Ganapathy Lecture 7 Topic: Key exchange protocols Material: Class handout (lecture7_handout.pdf) Chapter 2 in Anderson's book. Today s agenda Key exchange basics
More informationAdvanced Topics in Cryptography
Advanced Topics in Cryptography Lecture 9: Identity based encryption (IBE), Cocks scheme. Benny Pinkas page 1 1 Related papers Lecture notes from MIT http://crypto.csail.mit.edu/classes/6.876/lecture-notes.html
More informationApplied Cryptography and Computer Security CSE 664 Spring 2018
Applied Cryptography and Computer Security Lecture 13: Public-Key Cryptography and RSA Department of Computer Science and Engineering University at Buffalo 1 Public-Key Cryptography What we already know
More informationIntroduction to Cryptography Lecture 7
Introduction to Cryptography Lecture 7 Public-Key Encryption: El-Gamal, RSA Benny Pinkas page 1 1 Public key encryption Alice publishes a public key PK Alice. Alice has a secret key SK Alice. Anyone knowing
More informationSession key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
More informationSession key establishment protocols
our task is to program a computer which gives answers which are subtly and maliciously wrong at the most inconvenient possible moment. -- Ross Anderson and Roger Needham, Programming Satan s computer Session
More informationParallel Coin-Tossing and Constant-Round Secure Two-Party Computation
Parallel Coin-Tossing and Constant-Round Secure Two-Party Computation Yehuda Lindell Department of Computer Science and Applied Math, Weizmann Institute of Science, Rehovot, Israel. lindell@wisdom.weizmann.ac.il
More informationCSCI 454/554 Computer and Network Security. Topic 5.2 Public Key Cryptography
CSCI 454/554 Computer and Network Security Topic 5.2 Public Key Cryptography Outline 1. Introduction 2. RSA 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard 2 Introduction Public Key Cryptography
More informationl20 nov zero-knowledge proofs
l0 nov 00 zero-knowledge proofs what properties should an interactive proof system have? Alice Bob if c= o.w. quadratic equations prove that equation has a solution without revealing the solution! Alice
More informationSecure Computation of Functionalities based on Hamming Distance and its Application to Computing Document Similarity
Secure Computation of Functionalities based on Hamming Distance and its Application to Computing Document Similarity Ayman Jarrous 1 and Benny Pinkas 2,* 1 University of Haifa, Israel. 2 Bar Ilan University,
More informationOutline. CSCI 454/554 Computer and Network Security. Introduction. Topic 5.2 Public Key Cryptography. 1. Introduction 2. RSA
CSCI 454/554 Computer and Network Security Topic 5.2 Public Key Cryptography 1. Introduction 2. RSA Outline 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard 2 Introduction Public Key Cryptography
More informationPublic Key Algorithms
Public Key Algorithms CS 472 Spring 13 Lecture 6 Mohammad Almalag 2/19/2013 Public Key Algorithms - Introduction Public key algorithms are a motley crew, how? All hash algorithms do the same thing: Take
More informationPublic Key Algorithms
Public Key Algorithms 1 Public Key Algorithms It is necessary to know some number theory to really understand how and why public key algorithms work Most of the public key algorithms are based on modular
More informationThe most important development from the work on public-key cryptography is the digital signature. Message authentication protects two parties who
1 The most important development from the work on public-key cryptography is the digital signature. Message authentication protects two parties who exchange messages from any third party. However, it does
More informationEfficient and Non-Malleable Proofs of Plaintext Knowledge and Applications
Efficient and Non-Malleable Proofs of Plaintext Knowledge and Applications (Extended Abstract ) Jonathan Katz Abstract We describe very efficient protocols for non-malleable (interactive) proofs of plaintext
More informationCombining ABCs with ABE
Combining ABCs with ABE T. R. van de Kamp Combining ABCs with ABE Privacy-Friendly Key Generation for Smart Card Based Attribute-Based Encryption 2014 Master s thesis Computer Science, Services, Cybersecurity,
More informationOutline. Public Key Cryptography. Applications of Public Key Crypto. Applications (Cont d)
Outline AIT 682: Network and Systems Security 1. Introduction 2. RSA 3. Diffie-Hellman Key Exchange 4. Digital Signature Standard Topic 5.2 Public Key Cryptography Instructor: Dr. Kun Sun 2 Public Key
More informationLecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall Nitesh Saxena
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall 2009 Nitesh Saxena *Adopted from a previous lecture by Gene Tsudik Course Admin HW3 Problem 3 due Friday midnight
More informationCryptography and Network Security Chapter 13. Digital Signatures & Authentication Protocols
Cryptography and Network Security Chapter 13 Digital Signatures & Authentication Protocols Digital Signatures have looked at message authentication but does not address issues of lack of trust digital
More informationDigital Signatures 1
Digital Signatures 1 Outline [1] Introduction [2] Security Requirements for Signature Schemes [3] The ElGamal Signature Scheme [4] Variants of the ElGamal Signature Scheme The Digital Signature Algorithm
More informationElements of Cryptography and Computer and Network Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy
Elements of Cryptography and Computer and Network Security Computer Science 134 (COMPSCI 134) Fall 2016 Instructor: Karim ElDefrawy Homework 3 Due: Monday, 11/28/2016 at 11:55pm PT Solution: Will be posted
More informationRelaxing IND-CCA: Indistinguishability Against Chosen. Chosen Ciphertext Verification Attack
Relaxing IND-CCA: Indistinguishability Against Chosen Ciphertext Verification Attack Indian Statistical Institute Kolkata January 14, 2012 Outline 1 Definitions Encryption Scheme IND-CPA IND-CCA IND-CCVA
More informationContents Digital Signatures Digital Signature Properties Direct Digital Signatures
Contents Digital Signatures... 197 Digital Signature Properties... 198 Direct Digital Signatures... 198 199...قابلداوری Arbitrated Digital Signatures Arbitrated Digital Signature Technaiques... 200 Authentication
More informationCS 161 Computer Security
Popa & Wagner Spring 2016 CS 161 Computer Security Midterm 2 Print your name:, (last) (first) I am aware of the Berkeley Campus Code of Student Conduct and acknowledge that academic misconduct will be
More informationCryptographic proof of custody for incentivized file-sharing
Cryptographic proof of custody for incentivized file-sharing Pavel Kravchenko 1, Vlad Zamfir 2 1 Distributed Lab, pavel@distributedlab.com 2 Coinculture, vlad@coinculture.info Abstract. A cryptographic
More informationPublic Key Algorithms
CSE597B: Special Topics in Network and Systems Security Public Key Cryptography Instructor: Sencun Zhu The Pennsylvania State University Public Key Algorithms Public key algorithms RSA: encryption and
More informationCSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Next Topic in Cryptographic Tools Symmetric key encryption Asymmetric key encryption Hash functions and
More informationDawn Song
1 Secret-Sharing & Zero-knowledge Proof Dawn Song dawnsong@cs.berkeley.edu Review DH key exchange protocol Password authentication protocol Random number generation 2 Lessons Learned Seeds must be unpredictable
More informationSecurity. Communication security. System Security
Security Communication security security of data channel typical assumption: adversary has access to the physical link over which data is transmitted cryptographic separation is necessary System Security
More informationPublic-Key Cryptography
Computer Security Spring 2008 Public-Key Cryptography Aggelos Kiayias University of Connecticut A paradox Classic cryptography (ciphers etc.) Alice and Bob share a short private key using a secure channel.
More informationCryptography Today. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 44
Cryptography Today Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 About the Course Regular classes with worksheets so you can work with some concrete examples (every Friday at 1pm).
More informationLECTURE NOTES ON PUBLIC- KEY CRYPTOGRAPHY. (One-Way Functions and ElGamal System)
Department of Software The University of Babylon LECTURE NOTES ON PUBLIC- KEY CRYPTOGRAPHY (One-Way Functions and ElGamal System) By College of Information Technology, University of Babylon, Iraq Samaher@itnet.uobabylon.edu.iq
More informationCryptography CS 555. Topic 16: Key Management and The Need for Public Key Cryptography. CS555 Spring 2012/Topic 16 1
Cryptography CS 555 Topic 16: Key Management and The Need for Public Key Cryptography CS555 Spring 2012/Topic 16 1 Outline and Readings Outline Private key management between two parties Key management
More informationOther Topics in Cryptography. Truong Tuan Anh
Other Topics in Cryptography Truong Tuan Anh 2 Outline Public-key cryptosystem Cryptographic hash functions Signature schemes Public-Key Cryptography Truong Tuan Anh CSE-HCMUT 4 Outline Public-key cryptosystem
More informationZero-Knowledge Proofs
Zero-Knowledge Proofs Yevgeniy Dodis New York University Special thanks: Salil Vadhan Zero-Knowledge Proofs [GMR85] Interactive proofs that reveal nothing other than the validity of assertion being proven
More informationSpring 2010: CS419 Computer Security
Spring 2010: CS419 Computer Security MAC, HMAC, Hash functions and DSA Vinod Ganapathy Lecture 6 Message Authentication message authentication is concerned with: protecting the integrity of a message validating
More informationIndistinguishable Proofs of Work or Knowledge
Indistinguishable Proofs of Work or Knowledge Foteini Baldimtsi, Aggelos Kiayias, Thomas Zacharias, Bingsheng Zhang ASIACRYPT 2016 8th December, Hanoi, Vietnam Motivation (ZK) Proofs of Knowledge - PoK
More informationLecture 2 Applied Cryptography (Part 2)
Lecture 2 Applied Cryptography (Part 2) Patrick P. C. Lee Tsinghua Summer Course 2010 2-1 Roadmap Number theory Public key cryptography RSA Diffie-Hellman DSA Certificates Tsinghua Summer Course 2010 2-2
More informationLecture 6: ZK Continued and Proofs of Knowledge
600.641 Special Topics in Theoretical Cryptography 02/06/06 Lecture 6: ZK Continued and Proofs of Knowledge Instructor: Susan Hohenberger Scribe: Kevin Snow 1 Review / Clarification At the end of last
More informationOverview. Public Key Algorithms I
Public Key Algorithms I Dr. Arjan Durresi Louisiana State University Baton Rouge, LA 70810 Durresi@csc.lsu.Edu These slides are available at: http://www.csc.lsu.edu/~durresi/csc4601-04/ Louisiana State
More informationSecurely Combining Public-Key Cryptosystems
Securely Combining Public-Key Cryptosystems Stuart Haber Benny Pinkas STAR Lab, Intertrust Tech. 821 Alexander Road Princeton, NJ 08540 {stuart,bpinkas}@intertrust.com Abstract It is a maxim of sound computer-security
More informationDirect Anonymous Attestation
Direct Anonymous Attestation Revisited Jan Camenisch IBM Research Zurich Joint work with Ernie Brickell, Liqun Chen, Manu Drivers, Anja Lehmann. jca@zurich.ibm.com, @JanCamenisch, ibm.biz/jancamenisch
More informationCryptography and Network Security. Sixth Edition by William Stallings
Cryptography and Network Security Sixth Edition by William Stallings Chapter 13 Digital Signatures To guard against the baneful influence exerted by strangers is therefore an elementary dictate of savage
More informationIntroduction to Cryptography Lecture 7
Introduction to Cryptography Lecture 7 El Gamal Encryption RSA Encryption Benny Pinkas page 1 1 Public key encryption Alice publishes a public key PK Alice. Alice has a secret key SK Alice. Anyone knowing
More informationPractical Solutions to Identification and Signature Problems
How To Prove Yourself: Practical Solutions to Identification and Signature Problems Amos Fiat and Adi Shamir Department of Applied Mathematics The Weizmann Institute of Science Rehovot 76100, Israel Abstract.
More informationDigital Signatures. Luke Anderson. 7 th April University Of Sydney.
Digital Signatures Luke Anderson luke@lukeanderson.com.au 7 th April 2017 University Of Sydney Overview 1. Digital Signatures 1.1 Background 1.2 Basic Operation 1.3 Attack Models Replay Naïve RSA 2. PKCS#1
More informationPublic Key Cryptography
graphy CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L07, Steve/Courses/2011/S2/CSS322/Lectures/rsa.tex,
More informationComputer Security CS 526
Computer Security CS 526 Topic 4 Cryptography: Semantic Security, Block Ciphers and Encryption Modes CS555 Topic 4 1 Readings for This Lecture Required reading from wikipedia Block Cipher Ciphertext Indistinguishability
More informationA Thesis for the Degree of Master of Science. Provably Secure Threshold Blind Signature Scheme Using Pairings
A Thesis for the Degree of Master of Science Provably Secure Threshold Blind Signature Scheme Using Pairings Vo Duc Liem School of Engineering Information and Communications University 2003 Provably Secure
More informationPractical Threshold Signatures with Linear Secret Sharing Schemes
Practical Threshold Signatures with Linear Secret Sharing Schemes İlker Nadi Bozkurt, Kamer Kaya, Ali Aydın Selçuk Department of Computer Engineering Bilkent University Ankara, 06800, Turkey {bozkurti,kamer,selcuk}@cs.bilkent.edu.tr
More informationAn Identity Escrow Scheme with Appointed Verifiers
An Identity Escrow Scheme with Appointed Verifiers Jan Camenisch 1 and Anna Lysyanskaya 2 1 IBM Research Zurich Research Laboratory CH 8803 Rüschlikon jca@zurich.ibm.com 2 MIT LCS 545 Technology Square
More informationUNIVERSITY OF MASSACHUSETTS Dept. of Electrical & Computer Engineering. Introduction to Cryptography ECE 597XX/697XX
UNIVERSITY OF MASSACHUSETTS Dept. of Electrical & Computer Engineering Introduction to Cryptography ECE 597XX/697XX Part 10 Digital Signatures Israel Koren ECE597/697 Koren Part.10.1 Content of this part
More informationAn Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation
An Efficient System for Non-transferable Anonymous Credentials with ptional Anonymity Revocation Jan Camenisch IBM Research Zurich Research Laboratory CH 8803 Rüschlikon jca@zurich.ibm.com Anna Lysyanskaya
More informationRandom and Pseudorandom Bit Generators
Random and Pseudorandom Bit Generators Random bit generators Pseudorandom bit generators Cryptographically Secure PRBG Statistical tests Unpredictable quantities The security of many cryptographic systems
More informationCryptographic Primitives and Protocols for MANETs. Jonathan Katz University of Maryland
Cryptographic Primitives and Protocols for MANETs Jonathan Katz University of Maryland Fundamental problem(s) How to achieve secure message authentication / transmission in MANETs, when: Severe resource
More informationAnalysis, demands, and properties of pseudorandom number generators
Analysis, demands, and properties of pseudorandom number generators Jan Krhovják Department of Computer Systems and Communications Faculty of Informatics, Masaryk University Brno, Czech Republic Jan Krhovják
More information