White-box Cryptomania
|
|
|
- Marshall Fleming
- 6 years ago
- Views:
Transcription
1 White-box Cryptomania Pascal Paillier CryptoExperts ECRYPT NET Workshop on Crypto for the Cloud & Implementation Paris, June
2 Overview 1 What is white-box crypto? 2 White-box compilers for signatures 3 White-box cryptomania 4 Conclusion: the lesson to learn 5 News from the front: the WhibOx Contest
3 What is white-box crypto? The concept
4 What is NOT white-box crypto? General purpose obfuscation from any program P, generate an obfuscated program O(P) hide any program property π in the code of O(P) meaning: the code of O(P) a black-box oracle that runs P How realistic is obfuscation? very strong requirements on the compiler O known impossibility results (Barak et al, etc)
5 What is white-box crypto? general program obfuscation! White-box cryptography considers programs in a restricted class programs(f ) where f = some keyed function hides some program properties π in the code (but not all) code a black-box oracle only in some adversarial contexts already provably secure constructions for some f no impossibility results so far for f = blockcipher but no secure construction for e.g. f = AES k ( ), k $
6 Overview 1 What is white-box crypto? 2 White-box compilers for signatures 3 White-box cryptomania 4 Conclusion: the lesson to learn 5 News from the front: the WhibOx Contest
7 White-box compilers for signatures Let Σ = (KeyGen, Sign, Verif ) be a public-key signature scheme. Definition A white-box compiler C Σ takes a key pair (sk, pk) KeyGen and some index r R and outputs a program C Σ (sk, pk, r) = [Sign r sk ]. Huge behavioral differences between function Sign(, ) oracle Sign(sk, ) program [Signsk r ] analytic description or algorithmic description remote access, input/output only, word in a language, stateless since rebootable, typically stateful, copiable, transferable, private randomness observable, modifiable, system calls simulatable (specification) (smart card) (executable software)
8 A basic scheme: Schnorr signatures Pick some G = g of order q. KeyGen(1 κ ) Sign(sk, m) Verif (pk, m, (s, c)) x Z q y = g x k Z q c = H(m, g k ) s = k cx mod q H(m, g s y c ) = c? Existentially unforgeable in the ROM under the DL problem Known impossibility results in the SM
9 Schnorr signing programs [Sign r sk ] =
10 Schnorr signing programs [Sign r sk ] =
11 Schnorr signing programs We intercept the call to the random source and put what we want Then given the output (s, c) This is a trivial break. x = k s c Schnorr signatures are not securely implementable as such k = PRNG(m) not good enough either k = PRNG(m, x) seems ok.
12 Overview 1 What is white-box crypto? 2 White-box compilers for signatures 3 White-box cryptomania 4 Conclusion: the lesson to learn 5 News from the front: the WhibOx Contest
13 White-box cryptomania It s the world where [Signsk r ] is safe and cozy. What do we mean by that? A does not exist unless inefficient. Finally we have tamper-proof software for the Cloud!!
14 Security notions for signatures α β: if β can be broken, α can be broken UBK-KOA UUF-KOA EUF-KOA UBK-KMA UUF-KMA EUF-KMA UBK-CMA UUF-CMA EUF-CMA But that s not sufficient to capture attack on programs. Let s introduce known program attacks
15 Known program attacks UBK-KPA:
16 A first observation We have a reduction UBK-KPA UBK-CMA :
17 Equivalence CMA/KPA In white-box cryptomania, we should loose nothing when switching from CMA to KPA. It means there must be a reduction in the other direction: Now UBK-KPA = UBK-CMA :)
18 Program-reconstructing meta-reduction We see that we can build a meta-reduction!
19 Program-reconstructing meta-reduction... but the public-key given by R might be different from pk
20 Algebraic programs Algebraicity over G: Huge class of algorithms, extends generic model
21 Repairing the biased program If R is algebraic then we can extract the coefficients in pk = y = g α y β so that given a program output (s, c ) on m, we have ( c = H m, g s y c ) = H (m, g s g αc y βc ) If we pose s = s +αc β and c = c and assume that generator g can be put into the public key pk, then the program can be repaired into a signing program wrt the key pair (sk, pk) since ( c = H m, (g β) s (y β) c) pk = (g, y) (g β, y β )
22 The effect of white-box cryptomania To summarize, white-box cryptomania gives us an efficient program reconstruction algorithm:
23 Impact on UUF-CMA Recall the UUF-CMA game:
24 Impact on UUF-CMA Using M, UUF-CMA is now easy to break :( This is a huge collateral damage of white-box cryptomania, unavoidable unless we relax our definition of white-box cryptomania
25 Overview 1 What is white-box crypto? 2 White-box compilers for signatures 3 White-box cryptomania 4 Conclusion: the lesson to learn 5 News from the front: the WhibOx Contest
26 Conclusion: the lesson to learn White-box crypto is a powerful paradigm beside the question of theoretic existence, the range of applications is immense white-box cryptomania is a bit too much: we do not want to loose the unforgeability properties of public-key signatures preferable to leave UBK-CMA and UBK-CPA non-equivalent to allow some security to subsist for UUF-CMA This is work in progress a lot of questions remain can we have the same conclusions for e.g. ECDSA? how to relax white-box cryptomania?
27 Overview 1 What is white-box crypto? 2 White-box compilers for signatures 3 White-box cryptomania 4 Conclusion: the lesson to learn 5 News from the front: the WhibOx Contest
28 News from the front: WhibOx Contest
29 News from the front: WhibOx Contest
From obfuscation to white-box crypto: relaxation and security notions
From obfuscation to white-box crypto: relaxation and security notions Matthieu Rivain WhibOx 26, 4 Aug, UCB What does this program do? ([]+/H/)[&>>]+(+[[]+(-~ )+(~+e)+(.^!)])[[([]+!
CSC 5930/9010 Modern Cryptography: Digital Signatures Professor Henry Carter Fall 2018 Recap Implemented public key schemes in practice commonly encapsulate a symmetric key for the rest of encryption KEM/DEM
Keynote: White-Box Cryptography
Keynote: White-Box Cryptography Matthieu Rivain PHIIC Workshop, 4 Oct 2016 Outline Context: white-box crypto: big trend in the industry cryptographic obfuscation: big trend in the scientific literature
ALIKE: Authenticated Lightweight Key Exchange. Sandrine Agagliate, GEMALTO Security Labs
ALIKE: Authenticated Lightweight Key Exchange Sandrine Agagliate, GEMALTO Security Labs Outline: Context Description of ALIKE Generic description Full specification Security properties Chip Unforgeability
Lecture 8 - Message Authentication Codes
Lecture 8 - Message Authentication Codes Benny Applebaum, Boaz Barak October 12, 2007 Data integrity Until now we ve only been interested in protecting secrecy of data. However, in many cases what we care
APPLICATIONS AND PROTOCOLS. Mihir Bellare UCSD 1
APPLICATIONS AND PROTOCOLS Mihir Bellare UCSD 1 Some applications and protocols Internet Casino Commitment Shared coin flips Threshold cryptography Forward security Program obfuscation Zero-knowledge Certified
Digital Signatures. Sven Laur University of Tartu
Digital Signatures Sven Laur swen@math.ut.ee University of Tartu Formal Syntax Digital signature scheme pk (sk, pk) Gen (m, s) (m,s) m M 0 s Sign sk (m) Ver pk (m, s)? = 1 To establish electronic identity,
Paper presentation sign up sheet is up. Please sign up for papers by next class. Lecture summaries and notes now up on course webpage
1 Announcements Paper presentation sign up sheet is up. Please sign up for papers by next class. Lecture summaries and notes now up on course webpage 2 Recap and Overview Previous lecture: Symmetric key
Anonymous Signature Schemes
Anonymous Signature Schemes Guomin Yang 1, Duncan S. Wong 1, Xiaotie Deng 1, and Huaxiong Wang 2 1 Department of Computer Science City University of Hong Kong Hong Kong, China {csyanggm,duncan,deng}@cs.cityu.edu.hk
Linkable Message Tagging Solving the Key Distribution Problem of Signature Schemes Felix Günther
Linkable Message Tagging Solving the Key Distribution Problem of Signature Schemes Felix Günther Technische Universität Darmstadt Germany Bertram Poettering Ruhr-Universität Bochum Germany June 30, 2015
Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials
W I S S E N T E C H N I K L E I D E N S C H A F T IAIK Structure-Preserving Signatures on Equivalence Classes and their Application to Anonymous Credentials Christian Hanser and Daniel Slamanig, IAIK,
More crypto and security
More crypto and security CSE 199, Projects/Research Individual enrollment Projects / research, individual or small group Implementation or theoretical Weekly one-on-one meetings, no lectures Course grade
Cryptographic Primitives and Protocols for MANETs. Jonathan Katz University of Maryland
Cryptographic Primitives and Protocols for MANETs Jonathan Katz University of Maryland Fundamental problem(s) How to achieve secure message authentication / transmission in MANETs, when: Severe resource
Cryptography. Andreas Hülsing. 6 September 2016
Cryptography Andreas Hülsing 6 September 2016 1 / 21 Announcements Homepage: http: //www.hyperelliptic.org/tanja/teaching/crypto16/ Lecture is recorded First row might be on recordings. Anything organizational:
Notes for Lecture 21. From One-Time Signatures to Fully Secure Signatures
U.C. Berkeley CS276: Cryptography Handout N21 Luca Trevisan April 7, 2009 Notes for Lecture 21 Scribed by Anand Bhaskar, posted May 1, 2009 Summary Today we show how to construct an inefficient (but efficiently
Lecture 10, Zero Knowledge Proofs, Secure Computation
CS 4501-6501 Topics in Cryptography 30 Mar 2018 Lecture 10, Zero Knowledge Proofs, Secure Computation Lecturer: Mahmoody Scribe: Bella Vice-Van Heyde, Derrick Blakely, Bobby Andris 1 Introduction Last
Homework 2 CS161 Computer Security, Spring 2008 Assigned 2/13/08 Due 2/25/08
Homework 2 CS161 Computer Security, Spring 2008 Assigned 2/13/08 Due 2/25/08 1. Signatures and Attacks Recall that to use the ElGamal signature scheme, Alice randomly selects her private signing key x
Symmetric-Key Cryptography Part 1. Tom Shrimpton Portland State University
Symmetric-Key Cryptography Part 1 Tom Shrimpton Portland State University Building a privacy-providing primitive I want my communication with Bob to be private -- Alice What kind of communication? SMS?
Lecture 3.4: Public Key Cryptography IV
Lecture 3.4: Public Key Cryptography IV CS 436/636/736 Spring 2012 Nitesh Saxena Course Administration HW1 submitted Trouble with BB Trying to check with BB support HW1 solution will be posted very soon
Direct Anonymous Attestation
Direct Anonymous Attestation Revisited Jan Camenisch IBM Research Zurich Joint work with Ernie Brickell, Liqun Chen, Manu Drivers, Anja Lehmann. jca@zurich.ibm.com, @JanCamenisch, ibm.biz/jancamenisch
Cryptography. Lecture 12. Arpita Patra
Cryptography Lecture 12 Arpita Patra Digital Signatures q In PK setting, privacy is provided by PKE q Integrity/authenticity is provided by digital signatures (counterpart of MACs in PK world) q Definition:
Lecture 18 - Chosen Ciphertext Security
Lecture 18 - Chosen Ciphertext Security Boaz Barak November 21, 2005 Public key encryption We now go back to public key encryption. As we saw in the case of private key encryption, CPA security is not
Public-Key Encryption, Key Exchange, Digital Signatures CMSC 23200/33250, Autumn 2018, Lecture 7
Public-Key Encryption, Key Exchange, Digital Signatures CMSC 23200/33250, Autumn 2018, Lecture 7 David Cash University of Chicago Plan 1. Security of RSA 2. Key Exchange, Diffie-Hellman 3. Begin digital
Verifiably Encrypted Signature Scheme with Threshold Adjudication
Verifiably Encrypted Signature Scheme with Threshold Adjudication M. Choudary Gorantla and Ashutosh Saxena Institute for Development and Research in Banking Technology Road No. 1, Castle Hills, Masab Tank,
La Science du Secret sans Secrets
La Science du Secret sans Secrets celebrating Jacques Stern s 60 s birthday Moti Yung Columbia University and Google Research Inspired by a Book by Jacques Popularizing Cryptography Doing research, teaching,
Public-Key Cryptography
Computer Security Spring 2008 Public-Key Cryptography Aggelos Kiayias University of Connecticut A paradox Classic cryptography (ciphers etc.) Alice and Bob share a short private key using a secure channel.
Introduction. Cambridge University Press Mathematics of Public Key Cryptography Steven D. Galbraith Excerpt More information
1 Introduction Cryptography is an interdisciplinary field of great practical importance. The subfield of public key cryptography has notable applications, such as digital signatures. The security of a
Somewhat Homomorphic Encryption
Somewhat Homomorphic Encryption Craig Gentry and Shai Halevi June 3, 2014 China Summer School on Lattices and Cryptography Part 1: Homomorphic Encryption: Background, Applications, Limitations Computing
Iron: Functional encryption using Intel SGX
Iron: Functional encryption using Intel SGX Sergey Gorbunov University of Waterloo Joint work with Ben Fisch, Dhinakaran Vinayagamurthy, Dan Boneh. Motivation DNA_A DB = Database of DNA sequences DNA_B
ISA 562: Information Security, Theory and Practice. Lecture 1
ISA 562: Information Security, Theory and Practice Lecture 1 1 Encryption schemes 1.1 The semantics of an encryption scheme. A symmetric key encryption scheme allows two parties that share a secret key
Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives
Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives Sebastian Ramacher Joint work with Melissa Chase, David Derler, Steven Goldfeder, Claudio Orlandi, Christian Rechberger, Daniel
Strong Privacy for RFID Systems from Plaintext-Aware Encryption
Strong Privacy for RFID Systems from Plaintext-Aware Encryption Khaled Ouafi and Serge Vaudenay ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE http://lasec.epfl.ch/ supported by the ECRYPT project SV strong
A CCA2 Secure PKE Based on McEliece Assumptions in the Standard Model
A CCA2 Secure PKE Based on McEliece Assumptions in the Standard Model Jörn Müller-Quade European Institute for System Security KIT, Karlsruhe, Germany 04/23/09 Session ID: CRYP301 Session Classification:
Foundations of Cryptography CS Shweta Agrawal
Foundations of Cryptography CS 6111 Shweta Agrawal Course Information 4-5 homeworks (20% total) A midsem (25%) A major (35%) A project (20%) Attendance required as per institute policy Challenge questions
Cryptography: More Primitives
Design and Analysis of Algorithms May 8, 2015 Massachusetts Institute of Technology 6.046J/18.410J Profs. Erik Demaine, Srini Devadas and Nancy Lynch Recitation 11 Cryptography: More Primitives 1 Digital
Security of Identity Based Encryption - A Different Perspective
Security of Identity Based Encryption - A Different Perspective Priyanka Bose and Dipanjan Das priyanka@cs.ucsb.edu,dipanjan@cs.ucsb.edu Department of Computer Science University of California Santa Barbara
Cryptography. and Network Security. Lecture 0. Manoj Prabhakaran. IIT Bombay
Cryptography and Network Security Lecture 0 Manoj Prabhakaran IIT Bombay Security In this course: Cryptography as used in network security Humans, Societies, The World Network Hardware OS Libraries Programs
Universal designated multi verifier signature schemes
University of Wollongong esearch Online Faculty of Informatics - Papers (Archive) Faculty of Engineering and Information Sciences 2005 Universal designated multi verifier signature schemes Ching Yu Ng
CSC 5930/9010 Modern Cryptography: Public Key Cryptography
CSC 5930/9010 Modern Cryptography: Public Key Cryptography Professor Henry Carter Fall 2018 Recap Number theory provides useful tools for manipulating integers and primes modulo a large value Abstract
Anonymizable Ring Signature Without Pairing
Anonymizable Ring Signature Without Pairing Olivier Blazy, Xavier Bultel, Pascal Lafourcade To cite this version: Olivier Blazy, Xavier Bultel, Pascal Lafourcade. Anonymizable Ring Signature Without Pairing.
Password Authenticated Key Exchange by Juggling
A key exchange protocol without PKI Feng Hao Centre for Computational Science University College London Security Protocols Workshop 08 Outline 1 Introduction 2 Related work 3 Our Solution 4 Evaluation
If DDH is secure then ElGamal is also secure w.r.t IND-CPA
CS 6903 Modern Cryptography May 5th, 2011 Lecture 12 Instructor:Nitesh Saxena Recap of the previous lecture Scribe:Orcun Berkem, Turki Turki, Preetham Deshikachar Shrinivas The ElGamal encryption scheme
Cryptographically Secure Bloom-Filters
131 139 Cryptographically Secure Bloom-Filters Ryo Nojima, Youki Kadobayashi National Institute of Information and Communications Technology (NICT), 4-2-1 Nukuikitamachi, Koganei, Tokyo, 184-8795, Japan.
Crypto-systems all around us ATM machines Remote logins using SSH Web browsers (https invokes Secure Socket Layer (SSL))
Introduction (Mihir Bellare Text/Notes: http://cseweb.ucsd.edu/users/mihir/cse207/) Cryptography provides: Data Privacy Data Integrity and Authenticity Crypto-systems all around us ATM machines Remote
White-Box Cryptography State of the Art. Paul Gorissen
White-Box Cryptography State of the Art Paul Gorissen paul.gorissen@philips.com Outline Introduction Attack models White-box cryptography How it is done Interesting properties State of the art Conclusion
Advanced Cryptography 1st Semester Symmetric Encryption
Advanced Cryptography 1st Semester 2007-2008 Pascal Lafourcade Université Joseph Fourrier, Verimag Master: October 22th 2007 1 / 58 Last Time (I) Security Notions Cyclic Groups Hard Problems One-way IND-CPA,
Digital Signatures. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 54
Digital Signatures Ali El Kaafarani Mathematical Institute Oxford University 1 of 54 Outline 1 Definitions 2 Factoring Based Signatures 3 Dlog Based Signatures 4 Hash-Based Signatures 5 Certificates 6
Timed-Release Certificateless Encryption
Timed-Release Certificateless Encryption Toru Oshikiri Graduate School of Engineering Tokyo Denki University Tokyo, Japan Taiichi Saito Tokyo Denki University Tokyo, Japan Abstract Timed-Release Encryption(TRE)
Relaxing IND-CCA: Indistinguishability Against Chosen Ciphertext Verification Attack
Relaxing IND-CCA: Indistinguishability Against Chosen Ciphertext Verification Attack Sumit Kumar Pandey, Santanu Sarkar and Mahavir Prasad Jhanwar CR Rao AIMSCS Hyderabad November 2, 2012 Outline 1 Definitions
Authenticated encryption
Authenticated encryption Mac forgery game M {} k R 0,1 s m t M M {m } t mac k (m ) Repeat as many times as the adversary wants (m, t) Wins if m M verify m, t = 1 Mac forgery game Allow the adversary to
On the Security of a Certificateless Public-Key Encryption
On the Security of a Certificateless Public-Key Encryption Zhenfeng Zhang, Dengguo Feng State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences, Beijing 100080,
Introduction to Public-Key Cryptography
Introduction to Public-Key Cryptography Nadia Heninger University of Pennsylvania June 11, 2018 We stand today on the brink of a revolution in cryptography. Diffie and Hellman, 1976 Symmetric cryptography
Digital Signatures. KG November 3, Introduction 1. 2 Digital Signatures 2
Digital Signatures KG November 3, 2017 Contents 1 Introduction 1 2 Digital Signatures 2 3 Hash Functions 3 3.1 Attacks.................................... 4 3.2 Compression Functions............................
Cryptography Today. Ali El Kaafarani. Mathematical Institute Oxford University. 1 of 44
Cryptography Today Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 About the Course Regular classes with worksheets so you can work with some concrete examples (every Friday at 1pm).
STRONGER SECURITY NOTIONS FOR DECENTRALIZED TRACEABLE ATTRIBUTE-BASED SIGNATURES AND MORE EFFICIENT CONSTRUCTIONS
STRONGER SECURITY NOTIONS FOR DECENTRALIZED TRACEABLE ATTRIBUTE-BASED SIGNATURES AND MORE EFFICIENT CONSTRUCTIONS Essam Ghadafi University College London e.ghadafi@ucl.ac.uk CT-RSA 2015 STRONGER SECURITY
Applied Cryptography and Computer Security CSE 664 Spring 2018
Applied Cryptography and Computer Security Lecture 13: Public-Key Cryptography and RSA Department of Computer Science and Engineering University at Buffalo 1 Public-Key Cryptography What we already know
Authenticated Encryption
18733: Applied Cryptography Anupam Datta (CMU) Authenticated Encryption Online Cryptography Course Authenticated Encryption Active attacks on CPA-secure encryption Recap: the story so far Confidentiality:
MTAT Cryptology II. Entity Authentication. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Entity Authentication Sven Laur University of Tartu Formal Syntax Entity authentication pk (sk, pk) Gen α 1 β 1 β i V pk (α 1,...,α i 1 ) α i P sk (β 1,...,β i 1 ) Is it Charlie?
the Presence of Adversaries Sharon Goldberg David Xiao, Eran Tromer, Boaz Barak, Jennifer Rexford
Internet Path-Quality Monitoring in the Presence of Adversaries Sharon Goldberg David Xiao, Eran Tromer, Boaz Barak, Jennifer Rexford Princeton University Penn State University CS Seminar November 29,
Applied cryptography
Applied cryptography Electronic Cash Andreas Hülsing 29 November 2016 1 / 61 Classical Cash - Life Cycle Mint produces money (coins / bank notes) Sent to bank User withdraws money (reduces account balance)
Overview of Cryptography
18739A: Foundations of Security and Privacy Overview of Cryptography Anupam Datta CMU Fall 2007-08 Is Cryptography A tremendous tool The basis for many security mechanisms Is not The solution to all security
CS 495 Cryptography Lecture 6
CS 495 Cryptography Lecture 6 Dr. Mohammad Nabil Alaggan malaggan@fci.helwan.edu.eg Helwan University Faculty of Computers and Information CS 495 Fall 2014 http://piazza.com/fci_helwan_university/fall2014/cs495
Efficient Compilers for Authenticated Group Key Exchange
Efficient Compilers for Authenticated Group Key Exchange Qiang Tang and Chris J. Mitchell Information Security Group, Royal Holloway, University of London Egham, Surrey TW20 0EX, UK {qiang.tang, c.mitchell}@rhul.ac.uk
Financial Cryptography February 2001 Grand Cayman Islands - BWI
Financial Cryptography 2001 19-22 February 2001 Grand Cayman Islands - BWI Joint work with David Naccache and Christophe Tymen (Gemplus, France) Département d Informatique ENS - CNRS David.Pointcheval@ens.fr
Efficient Round Optimal Blind Signatures
Efficient Round Optimal Blind Signatures Sanjam Garg IBM T.J. Watson Divya Gupta UCLA Complexity Leveraging Highly theoretical tool Used to obtain feasibility results Gives inefficient constructions Is
Cryptography III. Public-Key Cryptography Digital Signatures. 2/1/18 Cryptography III
Cryptography III Public-Key Cryptography Digital Signatures 2/1/18 Cryptography III 1 Public Key Cryptography 2/1/18 Cryptography III 2 Key pair Public key: shared with everyone Secret key: kept secret,
Homomorphic Encryption
Homomorphic Encryption Travis Mayberry Cloud Computing Cloud Computing Cloud Computing Cloud Computing Cloud Computing Northeastern saves money on infrastructure and gets the benefit of redundancy and
Notes for Lecture 24
U.C. Berkeley CS276: Cryptography Handout N24 Luca Trevisan April 21, 2009 Notes for Lecture 24 Scribed by Milosh Drezgich, posted May 11, 2009 Summary Today we introduce the notion of zero knowledge proof
Securely Combining Public-Key Cryptosystems
Securely Combining Public-Key Cryptosystems Stuart Haber Benny Pinkas STAR Lab, Intertrust Tech. 821 Alexander Road Princeton, NJ 08540 {stuart,bpinkas}@intertrust.com Abstract It is a maxim of sound computer-security
Publicly Verifiable Secret Sharing for Cloud-based Key Management
Publicly Verifiable Secret Sharing for Cloud-based Key Management Roy D Souza, David Jao, Ilya Mironov and Omkant Pandey Microsoft Corporation and University of Waterloo December 13, 2011 Overview Motivation:
MTAT Cryptology II. Commitment Schemes. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Commitment Schemes Sven Laur University of Tartu Formal Syntax m M 0 (c,d) Com pk (m) pk Canonical use case Gen c d pk m Open pk (c,d) A randomised key generation algorithm Gen
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2017
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2017 Previously Exchanging keys and public key encryption Public Key Encryption pk sk Public Key Encryption pk cß Enc(pk,m) sk m Public
Implementing Resettable UC-functionalities with Untrusted Tamper-proof Hardware-Tokens
Implementing Resettable UC-functionalities with Untrusted Tamper-proof Hardware-Tokens Nico Döttling, Thilo Mie, Jörn Müller-Quade, and Tobias Nilges Karlsruhe Institute of Technology, Karlsruhe, Germany
Brief Introduction to Provable Security
Brief Introduction to Provable Security Michel Abdalla Département d Informatique, École normale supérieure michel.abdalla@ens.fr http://www.di.ens.fr/users/mabdalla 1 Introduction The primary goal of
On the Difficulty of Protecting Private Keys in Software Environments
On the Difficulty of Protecting Private Keys in Software Environments Taekyoung Kwon Sejong University, Seoul 143-747, Korea tkwon@sejong.ac.kr Abstract. This paper makes simple observation on security
On the security of a certificateless signature scheme in the standard model
On the security of a certificateless signature scheme in the standard model Lin Cheng, Qiaoyan Wen, Zhengping Jin, Hua Zhang State Key Laboratory of Networking and Switch Technology, Beijing University
Lecture 8: Cryptography in the presence of local/public randomness
Randomness in Cryptography Febuary 25, 2013 Lecture 8: Cryptography in the presence of local/public randomness Lecturer: Yevgeniy Dodis Scribe: Hamidreza Jahanjou So far we have only considered weak randomness
COMS W4995 Introduction to Cryptography November 13, Lecture 21: Multiple Use Signature Schemes
COMS W4995 Introduction to Cryptography November 13, 2003 Lecture 21: Multiple Use Signature Schemes Lecturer: Tal Malkin Scribes: M. Niccolai, M. Raibert Summary In this lecture, we use the one time secure
Advances in Securely Outsourcing Computation
Advances in Securely Outsourcing Computation Xiaofeng Chen December, 2017 Agenda Cloud Computing Verifiable Computation Secure Outsourcing of Scientific Computations Secure Outsourcing of Cryptographic
Publicly-verifiable proof of storage: a modular construction. Federico Giacon
Publicly-verifiable proof of storage: a modular construction Federico Giacon Ruhr-Universita t Bochum federico.giacon@rub.de 6th BunnyTN, Trent 17 December 2015 Proof of Storage Proof of Storage (PoS)
Plaintext Awareness via Key Registration
Plaintext Awareness via Key Registration Jonathan Herzog CIS, TOC, CSAIL, MIT Plaintext Awareness via Key Registration p.1/38 Context of this work Originates from work on Dolev-Yao (DY) model Symbolic
Relaxing IND-CCA: Indistinguishability Against Chosen. Chosen Ciphertext Verification Attack
Relaxing IND-CCA: Indistinguishability Against Chosen Ciphertext Verification Attack Indian Statistical Institute Kolkata January 14, 2012 Outline 1 Definitions Encryption Scheme IND-CPA IND-CCA IND-CCVA
Key-Evolution Schemes Resilient to Space Bounded Leakage
Key-Evolution Schemes Resilient to Space Bounded Leakage Stefan Dziembowski Tomasz Kazana Daniel Wichs Main contribution We propose a secure scheme for deterministic key-evolution Properties: leakage-resilient
A Ring Signature Scheme with Strong Designated Verifiers to Provide Signer Anonymity
A Ring Signature Scheme with Strong Designated Verifiers to Provide Signer Anonymity Shin-Jia Hwang Department of Computer Science and Information Engineering,Tamkang University, Tamsui, Taipei Hsien,
On cryptographic properties of the CVV and PVV parameters generation procedures in payment systems
CTCrypt 2017 S. V. Smyshlyaev (Crypto-Pro LLC) CTCrypt 2017 1 / 36 On cryptographic properties of the CVV and PVV parameters generation procedures in payment systems Stanislav V. Smyshlyaev, Head of information
Completely Non-Malleable Schemes
Completely Non-Malleable Schemes Marc Fischlin Institute for Theoretical Computer Science, ETH Zürich, Switzerland marc.fischlin @ inf.ethz.ch http://www.fischlin.de/ Abstract An encryption scheme is non-malleable
Online Cryptography Course. Basic key exchange. Trusted 3 rd par7es. Dan Boneh
Online Cryptography Course Dan Boneh Basic key exchange Trusted 3 rd par7es Key management Problem: n users. Storing mutual secret keys is difficult Total: O(n) keys per user A befer solu7on Online Trusted
Cryptography V: Digital Signatures
Cryptography V: Digital Signatures Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 19th February 2009 Outline Basics Constructing signature schemes Security of
Introduction to Obfuscation. Black-box Security
Introduction to Obfuscation. Black-box Security Yury Lifshits Steklov Institute of Mathematics, St.Petersburg, Russia yura@logic.pdmi.ras.ru Tartu University 13/03/2006 Yury Lifshits (Steklov Inst. of
Refining Computationally Sound Mech. Proofs for Kerberos
Refining Computationally Sound Mechanized Proofs for Kerberos Bruno Blanchet Aaron D. Jaggard Jesse Rao Andre Scedrov Joe-Kai Tsay 07 October 2009 Protocol exchange Meeting Partially supported by ANR,
Cryptography V: Digital Signatures
Cryptography V: Digital Signatures Computer Security Lecture 10 David Aspinall School of Informatics University of Edinburgh 10th February 2011 Outline Basics Constructing signature schemes Security of
Multi-Theorem Preprocessing NIZKs from Lattices
Multi-Theorem Preprocessing NIZKs from Lattices Sam Kim and David J. Wu Stanford University Soundness: x L, P Pr P, V (x) = accept = 0 No prover can convince honest verifier of false statement Proof Systems
An Exploration of Group and Ring Signatures
An Exploration of Group and Ring Signatures Sarah Meiklejohn February 4, 2011 Abstract Group signatures are a modern cryptographic primitive that allow a member of a specific group (e.g., the White House
NIST Post- Quantum Cryptography Standardiza9on
NIST Post- Quantum Cryptography Standardiza9on Lily Chen Cryptographic Technology Group Computer Security Division, Informa9on Technology Lab Na9onal Ins9tute of Standards and Technology (NIST) NIST Crypto
Post-Quantum Cryptography A Collective Challenge
Post-Quantum Cryptography A Collective Challenge Christophe Petit University of Oxford Mathematical Institute Christophe Petit -Oxford Crypto Day 1 Cryptography is very useful Cryptography is the science
Towards Post-Quantum Cryptography Standardization. Lily Chen and Dustin Moody National Institute of Standards and Technology USA
Towards Post-Quantum Cryptography Standardization Lily Chen and Dustin Moody National Institute of Standards and Technology USA First mile - Towards PQC standardization After about four years of preparation,
Obfuscation Omer Paneth
Obfuscation Omer Paneth What does it do? #include void primes(int cap) { int i, j, composite; for(i = 2; i < cap; ++i) { composite = 0; for(j = 2; j * j
Concrete cryptographic security in F*
Concrete cryptographic security in F* crypto hash (SHA3) INT-CMA encrypt then-mac Auth. encryption Secure RPC some some some adversary attack attack symmetric encryption (AES). IND-CMA, CCA2 secure channels
Solutions to exam in Cryptography December 17, 2013
CHALMERS TEKNISKA HÖGSKOLA Datavetenskap Daniel Hedin DIT250/TDA351 Solutions to exam in Cryptography December 17, 2013 Hash functions 1. A cryptographic hash function is a deterministic function that
Efficient and Non-malleable Proofs of Plaintext Knowledge and Applications
Efficient and Non-malleable Proofs of Plaintext Knowledge and Applications (Extended Abstract) Jonathan Katz Dept. of Computer Science, University of Maryland, College Park, MD jkatz@cs.umd.edu Abstract.