Post-Quantum Security of the Fujisaki-Okamoto (FO) and OAEP Transforms
|
|
|
- Magnus Hodges
- 5 years ago
- Views:
Transcription
1 Post-Quantum Security of the Fujisaki-Okamoto (FO) and OAEP Transforms Made by: Ehsan Ebrahimi Theory of Cryptography Conference, Beijing, China Oct Nov. 3, 2016 Joint work with Dominique Unruh
2 Motivation: Post-Quantum Cryptography Users intend to use classical cryptographic schemes, however, the adversary has the quantum computing power. 1 [Ambainis, Rosmanis and Unruh, Quantum attacks on classical proof systems (the hardness of quantum rewinding), FOCS 2014]
3 Motivation: Post-Quantum Cryptography Users intend to use classical cryptographic schemes, however, the adversary has the quantum computing power. 1 Quantum hard problems are needed. 1 [Ambainis, Rosmanis and Unruh, Quantum attacks on classical proof systems (the hardness of quantum rewinding), FOCS 2014]
4 Motivation: Post-Quantum Cryptography Users intend to use classical cryptographic schemes, however, the adversary has the quantum computing power. 1 Quantum hard problems are needed. 2 Design cryptographic schemes based on them. 1 [Ambainis, Rosmanis and Unruh, Quantum attacks on classical proof systems (the hardness of quantum rewinding), FOCS 2014]
5 Motivation: Post-Quantum Cryptography Users intend to use classical cryptographic schemes, however, the adversary has the quantum computing power. 1 Quantum hard problems are needed. 2 Design cryptographic schemes based on them. 3 Prove quantum security: classical security may not work. 1 [Ambainis, Rosmanis and Unruh, Quantum attacks on classical proof systems (the hardness of quantum rewinding), FOCS 2014]
6 Motivation: Post-Quantum Cryptography Users intend to use classical cryptographic schemes, however, the adversary has the quantum computing power. 1 Quantum hard problems are needed. 2 Design cryptographic schemes based on them. 3 Prove quantum security: classical security may not work. E.g. Security proofs in the Random Oracle Model. 1 [Ambainis, Rosmanis and Unruh, Quantum attacks on classical proof systems (the hardness of quantum rewinding), FOCS 2014]
7 Motivation: Post-Quantum Cryptography Users intend to use classical cryptographic schemes, however, the adversary has the quantum computing power. 1 Quantum hard problems are needed. 2 Design cryptographic schemes based on them. 3 Prove quantum security: classical security may not work. E.g. Security proofs in the Random Oracle Model. Relative to a specific oracle, the Fiat-Shamir transform is insecure in the quantum setting. 1 1 [Ambainis, Rosmanis and Unruh, Quantum attacks on classical proof systems (the hardness of quantum rewinding), FOCS 2014]
8 Our contribution Security of the slightly modified Fujisaki-Okamoto and OAEP transforms in the Quantum Random Oracle Model.
9 Random Oracle Model in quantum setting f Adversary Quantum Setting: Cryptographic Scheme 2 2 [Boneh et al. Random Oracles in a Quantum World. ASIACRYPT 2011]
10 Fujisaki-Okamoto (FO) transform Random δ G key priv Enc G δ H Randomness publ Enc pk Message m C 1 C 2
11 Fujisaki-Okamoto (FO) transform: properties of its ingredients The private-key encryption encryption scheme is One-Time secure.
12 Fujisaki-Okamoto (FO) transform: properties of its ingredients The private-key encryption encryption scheme is One-Time secure. The public-key encryption encryption scheme is One-Way secure.
13 Fujisaki-Okamoto (FO) transform: properties of its ingredients The private-key encryption encryption scheme is One-Time secure. The public-key encryption encryption scheme is One-Way secure. The public-key encryption encryption scheme if Well-Spread.
14 Fujisaki-Okamoto (FO) transform: properties of its ingredients The private-key encryption encryption scheme is One-Time secure. The public-key encryption encryption scheme is One-Way secure. The public-key encryption encryption scheme if Well-Spread. Security: IND-CCA secure in the Random Oracle Model
15 Fujisaki-Okamoto (FO) transform: properties of its ingredients The private-key encryption encryption scheme is One-Time secure. The public-key encryption encryption scheme is One-Way secure. The public-key encryption encryption scheme if Well-Spread. Security: IND-CCA secure in the Random Oracle Model Question: What about security in the Quantum Random Oracle Model (QROM)?
16 IND-CCA in the QROM Random oracles H, G Quantum Adversary (pk) m 0, m 1 y = Enc hy (m b, randomness) Decryption queries (not y) Challenger (pk,sk) b $ {0,1} Outputs b and wins if b = b
17 Challenges in the Quantum setting FO: Enc hy pk (m; δ) = ( Enc publ pk ( δ; H ( δ Enc priv G(δ) (m))), Enc priv G(δ) (m) ) Security techniques used in the classical proof:
18 Challenges in the Quantum setting FO: Enc hy pk (m; δ) = ( Enc publ pk ( δ; H ( δ Enc priv G(δ) (m))), Enc priv G(δ) (m) ) Security techniques used in the classical proof: 1 List of (δ, H(δ)) and (δ, G(δ)) are needed!
19 Challenges in the Quantum setting FO: Enc hy pk (m; δ) = ( Enc publ pk ( δ; H ( δ Enc priv G(δ) (m))), Enc priv G(δ) (m) ) Security techniques used in the classical proof: 1 List of (δ, H(δ)) and (δ, G(δ)) are needed! 2 Reprogramme the random oracle: E.g. They use some random elements instead of a given output G(δ ) and H(δ.)!
20 Challenges in the Quantum setting FO: Enc hy pk (m; δ) = ( Enc publ pk Security techniques used in the classical proof: 1 List of (δ, H(δ)) and (δ, G(δ)) are needed! ( δ; H ( δ Enc priv G(δ) (m))), Enc priv G(δ) (m) ) 2 Reprogramme the random oracle: E.g. They use some random elements instead of a given output G(δ ) and H(δ.)! 3 Finding x x st. Enc publ pk (δ ; H(x)) = Enc publ pk (δ ; H(x )) is hard!
21 Challenges in the Quantum setting FO: Enc hy pk (m; δ) = ( Enc publ pk Security techniques used in the classical proof: 1 List of (δ, H(δ)) and (δ, G(δ)) are needed! ( δ; H ( δ Enc priv G(δ) (m))), Enc priv G(δ) (m) ) 2 Reprogramme the random oracle: E.g. They use some random elements instead of a given output G(δ ) and H(δ.)! 3 Finding x x st. Enc publ pk (δ ; H(x)) = Enc publ pk (δ ; H(x )) is hard!
22 Solutions to the Challenges 1 List of (x, H(x)) and (x, G(x)) are needed! Add ( H (δ) to the ciphertext ( Enc asy pk δ; H ( ) δ Enc sy G(δ) (m))), Enc sy G(δ) (m), H (δ). 3 [Unruh, Revocable quantum timed-release encryption, Eurocrypt 2014 ] 4 [Ebrahimi Targhi, Tabia, Unruh. Quantum Collision-Resistance of Non-uniformly Distributed Functions. PQCrypto 2016]
23 Solutions to the Challenges 1 List of (x, H(x)) and (x, G(x)) are needed! Add ( H (δ) to the ciphertext ( Enc asy pk δ; H ( ) δ Enc sy G(δ) (m))), Enc sy G(δ) (m), H (δ) 2 It uses a random element instead of a given output H(δ) or G(δ)! Using One-way to hiding Lemmas 3 as a tool to reprogramme the random oracle. 3 [Unruh, Revocable quantum timed-release encryption, Eurocrypt 2014 ] 4 [Ebrahimi Targhi, Tabia, Unruh. Quantum Collision-Resistance of Non-uniformly Distributed Functions. PQCrypto 2016]
24 Solutions to the Challenges 1 List of (x, H(x)) and (x, G(x)) are needed! Add ( H (δ) to the ciphertext ( Enc asy pk δ; H ( ) δ Enc sy G(δ) (m))), Enc sy G(δ) (m), H (δ) 2 It uses a random element instead of a given output H(δ) or G(δ)! Using One-way to hiding Lemmas 3 as a tool to reprogramme the random oracle 3 Finding x x st. Enc asy pk (δ; H(x)) = Encasy pk (δ; H(x )) is hard! The collision-resistance of random functions with outputs sampled from a non-uniform distribution 4. 3 [Unruh, Revocable quantum timed-release encryption, Eurocrypt 2014 ] 4 [Ebrahimi Targhi, Tabia, Unruh. Quantum Collision-Resistance of Non-uniformly Distributed Functions. PQCrypto 2016]
25 Solutions to the Challenges 1 List of (x, H(x)) and (x, G(x)) are needed! Add ( H (δ) to the ciphertext ( Enc asy pk δ; H ( ) δ Enc sy G(δ) (m))), Enc sy G(δ) (m), H (δ) 2 It uses a random element instead of a given output H(δ) or G(δ)! Using One-way to hiding Lemmas 3 as a tool to reprogramme the random oracle 3 Finding x x st. Enc asy pk (δ; H(x)) = Encasy pk (δ; H(x )) is hard! The collision-resistance of random functions with outputs sampled from a non-uniform distribution 4 Comment: The same proof techniques work for OAEP transform 3 [Unruh, Revocable quantum timed-release encryption, Eurocrypt 2014 ] 4 [Ebrahimi Targhi, Tabia, Unruh. Quantum Collision-Resistance of Non-uniformly Distributed Functions. PQCrypto 2016].
26 Question? Thank you!
On Post-Quantum Cryptography
On Post-Quantum Cryptography Ehsan Ebrahimi Quantum Cryptography Group University of Tartu, Estonia 15 March 2018 Information Security and Cryptography Group Seminar Post-Quantum Cryptography Users intend
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model Presented by: Angela Robinson Department of Mathematical Sciences, Florida Atlantic University April 4, 2018 Motivation Quantum-resistance
Post-quantum Security of the CBC, CFB, OFB, CTR, and XTS Modes of Operation.
OFB, CTR, In CBC, Ehsan Ebrahimi Targhi, Gelo Noel Tabia, Dominique Unruh University of Tartu February 4, 2016 Table of contents In CBC 1 2 3 4 In CBC PRF under quantum 5 6 Being optimistic about the emergence
Cryptographical Security in the Quantum Random Oracle Model
Cryptographical Security in the Quantum Random Oracle Model Center for Advanced Security Research Darmstadt (CASED) - TU Darmstadt, Germany June, 21st, 2012 This work is licensed under a Creative Commons
The Random Oracle Paradigm. Mike Reiter. Random oracle is a formalism to model such uses of hash functions that abound in practical cryptography
1 The Random Oracle Paradigm Mike Reiter Based on Random Oracles are Practical: A Paradigm for Designing Efficient Protocols by M. Bellare and P. Rogaway Random Oracles 2 Random oracle is a formalism to
Outline. The Game-based Methodology for Computational Security Proofs. Public-Key Cryptography. Outline. Introduction Provable Security
The Game-based Methodology for Computational s David Pointcheval Ecole normale supérieure, CNRS & INRIA Computational and Symbolic Proofs of Security Atagawa Heights Japan April 6th, 2009 1/39 2/39 Public-Key
Random Oracles in a Quantum World
Dan Boneh 1 Özgür Dagdelen 2 Marc Fischlin 2 Anja Lehmann 3 Christian Schaffner 4 Mark Zhandry 1 1 Stanford University, USA 2 CASED & Darmstadt University of Technology, Germany 3 IBM Research Zurich,
CRYPTANALYSIS OF COMPACT-LWE
SESSION ID: CRYP-T10 CRYPTANALYSIS OF COMPACT-LWE Jonathan Bootle, Mehdi Tibouchi, Keita Xagawa Background Information Lattice-based cryptographic assumption Based on the learning-with-errors (LWE) assumption
SECURE IDENTITY-BASED ENCRYPTION IN THE QUANTUM RANDOM ORACLE MODEL. Mark Zhandry Stanford University
SECURE IDENTITY-BASED ENCRYPTION IN THE QUANTUM RANDOM ORACLE MODEL Mark Zhandry Stanford University Random Oracle Model (ROM) Sometimes, we can t prove a scheme secure in the standard model. Instead,
ID-based Encryption Scheme Secure against Chosen Ciphertext Attacks
ID-based Encryption Scheme Secure against Chosen Ciphertext Attacks ongxing Lu and Zhenfu Cao Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai 200030, P.. China {cao-zf,
A Strong Identity Based Key-Insulated Cryptosystem
A Strong Identity Based Key-Insulated Cryptosystem Jin Li 1, Fangguo Zhang 2,3, and Yanming Wang 1,4 1 School of Mathematics and Computational Science, Sun Yat-sen University, Guangzhou, 510275, P.R.China
On the Selective-Opening Security of DHIES
On the Selective-Opening Security of DHIES and other practical encryption schemes UbiCrypt Research Retreat, Schloss Raesfeld: 29.& 30. Sep. 2014 Felix Heuer, Tibor Jager, Eike Kiltz, Sven Schäge Horst
Boneh-Franklin Identity Based Encryption Revisited
Boneh-Franklin Identity Based Encryption Revisited David Galindo Institute for Computing and Information Sciences Radboud University Nijmegen P.O.Box 9010 6500 GL, Nijmegen, The Netherlands. d.galindo@cs.ru.nl
Models and analysis of security protocols 1st Semester Symmetric Encryption Lecture 5
Models and analysis of security protocols 1st Semester 2009-2010 Symmetric Encryption Lecture 5 Pascal Lafourcade Université Joseph Fourier, Verimag Master: September 29th 2009 1 / 60 Last Time (I) Security
Analysis - "Post-Quantum Security of Fiat-Shamir" by Dominic Unruh
Analysis - "Post-Quantum Security of Fiat-Shamir" by Dominic Unruh Bruno Produit Institute of Computer Science University of Tartu produit@ut.ee December 19, 2017 Abstract This document is an analysis
CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD
CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD Mark Zhandry Stanford University * Joint work with Dan Boneh But First: My Current Work Indistinguishability Obfuscation (and variants) Multiparty NIKE without
On the power of non-adaptive quantum chosen-ciphertext attacks
On the power of non-adaptive quantum chosen-ciphertext attacks joint work with Gorjan Alagic (UMD, NIST), Stacey Jeffery (QuSoft, CWI), and Maris Ozols (QuSoft, UvA) Alexander Poremba August 29, 2018 Heidelberg
Gentry IBE Paper Reading
Gentry IBE Paper Reading Y. Jiang 1 1 University of Wollongong September 5, 2014 Literature Craig Gentry. Practical Identity-Based Encryption Without Random Oracles. Advances in Cryptology - EUROCRYPT
5199/IOC5063 Theory of Cryptology, 2014 Fall
5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.
arxiv: v2 [cs.cr] 14 Feb 2018
![arxiv: v2 [cs.cr] 14 Feb 2018](/thumbs/82/84767973.jpg "arxiv: v2 [cs.cr] 14 Feb 2018")
Code-based Key Encapsulation from McEliece s Cryptosystem Edoardo Persichetti arxiv:1706.06306v2 [cs.cr] 14 Feb 2018 Florida Atlantic University Abstract. In this paper we show that it is possible to extend
(Tightly) QCCA-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model
(Tightly) QCCA-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model Keita Xagawa and Takashi Yamakawa October 19, 018 NTT Secure Platform Laboratories 3-9-11, Midori-cho umsashino-shi,
Secure Certificateless Public Key Encryption without Redundancy
Secure Certificateless Public Key Encryption without Redundancy Yinxia Sun and Futai Zhang School of Mathematics and Computer Science Nanjing Normal University, Nanjing 210097, P.R.China Abstract. Certificateless
Outline Proxy Re-Encryption NTRU NTRUReEncrypt PS-NTRUReEncrypt Experimental results Conclusions. NTRUReEncrypt
NTRUReEncrypt An Efficient Proxy Re-Encryption Scheme based on NTRU David Nuñez, Isaac Agudo, and Javier Lopez Network, Information and Computer Security Laboratory (NICS Lab) Universidad de Málaga, Spain
Practical CCA2-Secure and Masked Ring-LWE Implementation
Practical CCA2-Secure and Masked Ring-LWE Implementation Tobias Oder 1, Tobias Schneider 2, Thomas Pöppelmann 3, Tim Güneysu 1,4 1 Ruhr-University Bochum, 2 Université Catholique de Louvain, 3 Infineon
Public Key Broadcast Encryption with Low Number of Keys and Constant Decryption Time
Public Key Broadcast Encryption with Low Number of Keys and Constant Decryption Time Yi-Ru Liu, Wen-Guey Tzeng Department of Computer Science National Chiao Tung University Hsinchu, Taiwan 30050 Email:
Public Key Cryptography
Public Key Cryptography Ali El Kaafarani 1 Mathematical Institute 2 PQShield Ltd. 1 of 44 Outline 1 Public Key Encryption: security notions 2 RSA Encryption Scheme 2 of 44 Course main reference 3 of 44
Cryptography. Lecture 2: Perfect Secrecy and its Limitations. Gil Segev
Cryptography Lecture 2: Perfect Secrecy and its Limitations Gil Segev Last Week Symmetric-key encryption (KeyGen, Enc, Dec) Historical ciphers that are completely broken The basic principles of modern
Post-quantum security models for authenticated encryption
Post-quantum security models for authenticated encryption Vladimir Soukharev David R. Cheriton School of Computer Science February 24, 2016 Introduction Bellare and Namprempre in 2008, have shown that
BEYOND POST QUANTUM CRYPTOGRAPHY
BEYOND POST QUANTUM CRYPTOGRAPHY Mark Zhandry Stanford University Joint work with Dan Boneh Classical Cryptography Post-Quantum Cryptography All communication stays classical Beyond Post-Quantum Cryptography
Quantum Attacks on Classical Proof Systems
Quantum Attacks on Classical Proof Systems The Hardness of Quantum Rewinding University of Tartu With Andris Ambainis, Ansis Rosmanis QCrypt 2014 Classical Crypto (Quick intro.) Quantum Attacks on Classical
Verifiable Security of Boneh-Franklin Identity-Based Encryption. Federico Olmedo Gilles Barthe Santiago Zanella Béguelin
Verifiable Security of Boneh-Franklin Identity-Based Encryption Federico Olmedo Gilles Barthe Santiago Zanella Béguelin IMDEA Software Institute, Madrid, Spain 5 th International Conference on Provable
Solution of Exercise Sheet 7
saarland Foundations of Cybersecurity (Winter 16/17) Prof. Dr. Michael Backes CISPA / Saarland University university computer science Solution of Exercise Sheet 7 1 Variants of Modes of Operation Let (K,
Applied cryptography
Applied cryptography Identity-based Cryptography Andreas Hülsing 19 November 2015 1 / 37 The public key problem How to obtain the correct public key of a user? How to check its authenticity? General answer:
Extractable Perfectly One-way Functions
Extractable Perfectly One-way Functions Ran Canetti 1 and Ronny Ramzi Dakdouk 2 1 IBM T. J. Watson Research Center, Hawthorne, NY. canetti@watson.ibm.com 2 Yale University, New Haven, CT. dakdouk@cs.yale.edu
Quantum Collision-Finding in Non-Uniform Random Functions
Quantum Collision-Finding in Non-Uniform Random Functions Marko Balogh 1, Edward Eaton 2, and Fang Song 3 1 Department of Physics, Portland State University marko balogh@me.com 2 Department of Combinatorics
Modern Cryptography Lecture 4
Modern Cryptography Lecture 4 Pseudorandom Functions Block-Ciphers Modes of Operation Chosen-Ciphertext Security 1 October 30th, 2018 2 Webpage Page for first part, Homeworks, Slides http://pub.ist.ac.at/crypto/moderncrypto18.html
REMARKS ON IBE SCHEME OF WANG AND CAO
REMARKS ON IBE SCEME OF WANG AND CAO Sunder Lal and Priyam Sharma Derpartment of Mathematics, Dr. B.R.A.(Agra), University, Agra-800(UP), India. E-mail- sunder_lal@rediffmail.com, priyam_sharma.ibs@rediffmail.com
On the CCA1-Security of Elgamal and Damgård s Elgamal
On the CCA1-Security of Elgamal and Damgård s Elgamal Cybernetica AS, Estonia Tallinn University, Estonia October 21, 2010 Outline I Motivation 1 Motivation 2 3 Motivation Three well-known security requirements
Secure Signatures and Chosen Ciphertext Security in a Post-Quantum World
Secure Signatures and Chosen Ciphertext Security in a Post-Quantum World Dan Boneh Mark Zhandry Stanford University {dabo,zhandry}@cs.stanford.edu Abstract We initiate the study of quantum-secure digital
Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World. Dan Boneh and Mark Zhandry Stanford University
Secure Signatures and Chosen Ciphertext Security in a Quantu Coputing World Dan Boneh and Mark Zhandry Stanford University Classical Chosen Message Attack (CMA) σ = S(sk, ) signing key sk Classical CMA
Chosen-Ciphertext Security without Redundancy
This is the full version of the extended abstract which appears in Advances in Cryptology Proceedings of Asiacrypt 03 (30 november 4 december 2003, Taiwan) C. S. Laih Ed. Springer-Verlag, LNCS 2894, pages
CPA-Security. Definition: A private-key encryption scheme
CPA-Security The CPA Indistinguishability Experiment PrivK cpa A,Π n : 1. A key k is generated by running Gen 1 n. 2. The adversary A is given input 1 n and oracle access to Enc k, and outputs a pair of
Evaluation of Security Level of Cryptography: The HIME(R) Encryption Scheme. Alfred Menezes University of Waterloo Contact:
Evaluation of Security Level of Cryptography: The HIME(R) Encryption Scheme Alfred Menezes University of Waterloo Contact: ajmeneze@uwaterloo.ca July 31, 2002 Contents Page 1 Contents 1 Executive Summary
G Advanced Cryptography April 10th, Lecture 11
G.30-001 Advanced Cryptography April 10th, 007 Lecturer: Victor Shoup Lecture 11 Scribe: Kristiyan Haralambiev We continue the discussion of public key encryption. Last time, we studied Hash Proof Systems
Chapter 11 : Private-Key Encryption
COMP547 Claude Crépeau INTRODUCTION TO MODERN CRYPTOGRAPHY _ Second Edition _ Jonathan Katz Yehuda Lindell Chapter 11 : Private-Key Encryption 1 Chapter 11 Public-Key Encryption Apologies: all numbering
CRYPTOGRAPHY IN THE AGE OF QUANTUM COMPUTERS
CRYPTOGRAPHY IN THE AGE OF QUANTUM COMPUTERS A DISSERTATION SUBMITTED TO THE DEPARTMENT OF COMPUTER SCIENCE AND THE COMMITTEE ON GRADUATE STUDIES OF STANFORD UNIVERSITY IN PARTIAL FULFILLMENT OF THE REQUIREMENTS
Recent Advances in Identity-based Encryption Pairing-based Constructions
Fields Institute Workshop on New Directions in Cryptography 1 Recent Advances in Identity-based Encryption Pairing-based Constructions Kenny Paterson kenny.paterson@rhul.ac.uk June 25th 2008 Fields Institute
f (x) f (x) easy easy
A General Construction of IND-CCA2 Secure Public Key Encryption? Eike Kiltz 1 and John Malone-Lee 2 1 Lehrstuhl Mathematik & Informatik, Fakultat fur Mathematik, Ruhr-Universitat Bochum, Germany. URL:
Simple SK-ID-KEM 1. 1 Introduction
1 Simple SK-ID-KEM 1 Zhaohui Cheng School of Computing Science, Middlesex University The Burroughs, Hendon, London, NW4 4BT, United Kingdom. m.z.cheng@mdx.ac.uk Abstract. In 2001, Boneh and Franklin presented
III. Pseudorandom functions & encryption
III. Pseudorandom functions & encryption Eavesdropping attacks not satisfactory security model - no security for multiple encryptions - does not cover practical attacks new and stronger security notion:
Public Key Cryptography
Public Key Cryptography Ali El Kaafarani Mathematical Institute Oxford University 1 of 60 Outline 1 RSA Encryption Scheme 2 Discrete Logarithm and Diffie-Hellman Algorithm 3 ElGamal Encryption Scheme 4
Report on Learning with Errors over Rings-based HILA5 and its CCA Security
Report on Learning with Errors over Rings-based HILA5 and its CCA Security Jesús Antonio Soto Velázquez January 24, 2018 Abstract HILA5 is a cryptographic primitive based on lattices that was submitted
A New Paradigm of Hybrid Encryption Scheme
A New Paradigm of Hybrid Encryption Scheme Kaoru Kurosawa 1 and Yvo Desmedt 2 1 Ibaraki University, Japan kurosawa@cis.ibaraki.ac.jp 2 Dept. of Computer Science, University College London, UK, and Florida
A new security notion for asymmetric encryption Draft #10
A new security notion for asymmetric encryption Draft #10 Muhammad Rezal Kamel Ariffin 1,2 1 Al-Kindi Cryptography Research Laboratory, Institute for Mathematical Research, 2 Department of Mathematics,
Question 2.1. Show that. is non-negligible. 2. Since. is non-negligible so is μ n +
Homework #2 Question 2.1 Show that 1 p n + μ n is non-negligible 1. μ n + 1 p n > 1 p n 2. Since 1 p n is non-negligible so is μ n + 1 p n Question 2.1 Show that 1 p n - μ n is non-negligible 1. μ n O(
Efficient Identity-based Encryption Without Random Oracles
Efficient Identity-based Encryption Without Random Oracles Brent Waters Weiwei Liu School of Computer Science and Software Engineering 1/32 Weiwei Liu Efficient Identity-based Encryption Without Random
Lizard: Cut off the Tail! Practical Post-Quantum Public-Key Encryption from LWE and LWR
Lizard: Cut off the Tail! Practical Post-Quantum Public-Key Encryption from LWE and LWR Jung Hee Cheon 1, Duhyeong Kim 1, Joohee Lee 1, and Yongsoo Song 1 1 Seoul National University (SNU), Republic of
T Advanced Course in Cryptology. March 28 th, ID-based authentication frameworks and primitives. Mikko Kiviharju
March 28 th, 2006 ID-based authentication frameworks and primitives Helsinki University of Technology mkivihar@cc.hut.fi 1 Overview Motivation History and introduction of IB schemes Mathematical basis
A new security notion for asymmetric encryption Draft #12
A new security notion for asymmetric encryption Draft #12 Muhammad Rezal Kamel Ariffin 1,2 1 Al-Kindi Cryptography Research Laboratory, Institute for Mathematical Research, 2 Department of Mathematics,
Random Oracles in a Quantum World
Random Oracles in a Quantum World AsiaISG Research Seminars 2011/2012 Özgür Dagdelen, Marc Fischlin (TU Darmstadt) Dan Boneh, Mark Zhandry (Stanford University) Anja Lehmann (IBM Zurich) Christian Schaffner
arxiv: v1 [quant-ph] 28 Apr 2014
![arxiv: v1 [quant-ph] 28 Apr 2014](/thumbs/77/76625244.jpg "arxiv: v1 [quant-ph] 28 Apr 2014")
Quantum Attacks on Classical Proof Systems The Hardness of Quantum Rewinding Andris Ambainis University of Latvia and nstitute for Advanced Study Princeton Ansis Rosmanis nstitute for Quantum Computing
Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange
Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange Nina Bindel 1 Jacqueline Brendel 1 Marc Fischlin 1 Brian Goncalves 2 Douglas Stebila 3 1 Technische Universität Darmstadt, Darmstadt,
Block ciphers And modes of operation. Table of contents
Block ciphers And modes of operation Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction Pseudorandom permutations Block Ciphers Modes of Operation
The Cramer-Shoup Cryptosystem
The Cramer-Shoup Cryptosystem Eileen Wagner October 22, 2014 1 / 28 The Cramer-Shoup system is an asymmetric key encryption algorithm, and was the first efficient scheme proven to be secure against adaptive
An efficient variant of Boneh-Gentry-Hamburg's identity-based encryption without pairing
University of Wollongong Research Online Faculty of Engineering and Information Sciences - Papers: Part A Faculty of Engineering and Information Sciences 2015 An efficient variant of Boneh-Gentry-Hamburg's
ASYMMETRIC ENCRYPTION
ASYMMETRIC ENCRYPTION 1 / 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters involved. 2 / 1 Recall
Katz, Lindell Introduction to Modern Cryptrography
Katz, Lindell Introduction to Modern Cryptrography Slides Chapter 12 Markus Bläser, Saarland University Digital signature schemes Goal: integrity of messages Signer signs a message using a private key
A new security notion for asymmetric encryption Draft #8
A new security notion for asymmetric encryption Draft #8 Muhammad Rezal Kamel Ariffin 1,2 1 Al-Kindi Cryptography Research Laboratory, Institute for Mathematical Research, 2 Department of Mathematics,
Secure and Practical Identity-Based Encryption
Secure and Practical Identity-Based Encryption David Naccache Groupe de Cyptographie, Deṕartement d Informatique École Normale Supérieure 45 rue d Ulm, 75005 Paris, France david.nacache@ens.fr Abstract.
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Analysis of Random Oracle Instantiation Scenarios for OAEP and other Practical Schemes
Analysis of Random Oracle Instantiation Scenarios for OAEP and other Practical Schemes Alexandra Boldyreva 1 and Marc Fischlin 2 1 College of Computing, Georgia Institute of Technology, 801 Atlantic Drive,
Semantic Security of RSA. Semantic Security
Semantic Security of RSA Murat Kantarcioglu Semantic Security As before our goal is to come up with a public key system that protects against more than total break We want our system to be secure against
Models and analysis of security protocols 1st Semester Symmetric Encryption Lecture 5
Models and analysis of security protocols 1st Semester 2010-2011 Symmetric Encryption Lecture 5 Pascal Lafourcade Université Joseph Fourier, Verimag Master: October 11th 2010 1 / 61 Last Time (I) Security
Short Exponent Diffie-Hellman Problems
Short Exponent Diffie-Hellman Problems Takeshi Koshiba 12 and Kaoru Kurosawa 3 1 Secure Computing Lab., Fujitsu Laboratories Ltd. 2 ERATO Quantum Computation and Information Project, Japan Science and
Structure Preserving CCA Secure Encryption
Structure Preserving CCA Secure Encryption presented by ZHANG Tao 1 / 9 Introduction Veriable Encryption enable validity check of the encryption (Camenisch et al. @ CRYPTO'03): veriable encryption of discrete
Fang Song. Joint work with Sean Hallgren and Adam Smith. Computer Science and Engineering Penn State University
Fang Song Joint work with Sean Hallgren and Adam Smith Computer Science and Engineering Penn State University Are classical cryptographic protocols secure against quantum attackers? 2 Are classical cryptographic
How to Enhance the Security of Public-Key. Encryption at Minimum Cost 3. NTT Laboratories, 1-1 Hikarinooka Yokosuka-shi Kanagawa Japan
How to Enhance the Security of Public-Key Encryption at Minimum Cost 3 Eiichiro Fujisaki Tatsuaki Okamoto NTT Laboratories, 1-1 Hikarinooka Yokosuka-shi Kanagawa 239-0847 Japan ffujisaki,okamotog@isl.ntt.co.jp
A note on the equivalence of IND-CCA & INT-PTXT and IND-CCA & INT-CTXT
A note on the equivalence of IND-CCA & INT-PTXT and IND-CCA & INT-CTXT Daniel Jost, Christian Badertscher, Fabio Banfi Department of Computer Science, ETH Zurich, Switzerland daniel.jost@inf.ethz.ch christian.badertscher@inf.ethz.ch
Practice Final Exam Winter 2017, CS 485/585 Crypto March 14, 2017
Practice Final Exam Name: Winter 2017, CS 485/585 Crypto March 14, 2017 Portland State University Prof. Fang Song Instructions This exam contains 7 pages (including this cover page) and 5 questions. Total
Efficient Constructions of Deterministic Encryption from Hybrid Encryption and Code-Based PKE
Efficient Constructions of Deterministic Encryption from Hybrid Encryption and Code-Based PKE Yang Cui 1,2, Kirill Morozov 1, Kazukuni Kobara 1,2, and Hideki Imai 1,2 1 Research Center for Information
Strongly Unforgeable Signatures Based on Computational Diffie-Hellman
Strongly Unforgeable Signatures Based on Computational Diffie-Hellman Dan Boneh 1, Emily Shen 1, and Brent Waters 2 1 Computer Science Department, Stanford University, Stanford, CA {dabo,emily}@cs.stanford.edu
Quantum-secure symmetric-key cryptography based on Hidden Shifts
Quantum-secure symmetric-key cryptography based on Hidden Shifts Gorjan Alagic QMATH, Department of Mathematical Sciences University of Copenhagen Alexander Russell Department of Computer Science & Engineering
Provable Security for Public-Key Schemes. Outline. I Basics. Secrecy of Communications. Outline. David Pointcheval
Provable Security for Public-Key Schemes I Basics David Pointcheval Ecole normale supérieure, CNRS & INRIA IACR-SEAMS School Cryptographie: Foundations and New Directions November 2016 Hanoi Vietnam Introduction
arxiv: v1 [quant-ph] 9 Sep 2015
![arxiv: v1 [quant-ph] 9 Sep 2015](/thumbs/84/89301275.jpg "arxiv: v1 [quant-ph] 9 Sep 2015")
Making Existential-Unforgeable Signatures Strongly Unforgeable in the Quantum Random-Oracle Model Edward Eaton 1 and Fang Song 1,2 1 Department of Combinatorics & Optimization, University of Waterloo {eeaton,fang.song}@uwaterloo.ca
arxiv: v2 [quant-ph] 19 Oct 2014
![arxiv: v2 [quant-ph] 19 Oct 2014](/thumbs/77/76625187.jpg "arxiv: v2 [quant-ph] 19 Oct 2014")
Quantum Attacks on Classical Proof Systems The Hardness of Quantum Rewinding arxiv:1404.6898v2 [quant-ph] 19 Oct 2014 Andris Ambainis University of Latvia and Institute for Advanced Study Princeton Ansis
Perfectly-Crafted Swiss Army Knives in Theory
Perfectly-Crafted Swiss Army Knives in Theory Workshop Hash Functions in Cryptology * supported by Emmy Noether Program German Research Foundation (DFG) Hash Functions as a Universal Tool collision resistance
Non-interactive zero-knowledge proofs in the quantum random oracle model
Non-interactive zero-knowledge proofs in the quantum random oracle model Dominique Unruh University of Tartu Abstract. We present a construction for non-interactive zero-knowledge proofs of knowledge in
Public-Key Cryptography. Public-Key Certificates. Public-Key Certificates: Use
Public-Key Cryptography Tutorial on Dr. Associate Professor Department of Computer Science and Engineering Indian Institute of Technology Kharagpur http://cse.iitkgp.ac.in/ abhij/ January 30, 2017 Short
INDIAN INSTITUTE OF TECHNOLOGY KHARAGPUR Stamp / Signature of the Invigilator
INDIAN INSTITUTE OF TECHNOLOGY KHARAGPUR Stamp / Signature of the Invigilator EXAMINATION ( End Semester ) SEMESTER ( Spring ) Roll Number Section Name Subject Number C S 6 0 0 8 8 Subject Name Foundations
Pairing-Based Cryptography An Introduction
ECRYPT Summer School Samos 1 Pairing-Based Cryptography An Introduction Kenny Paterson kenny.paterson@rhul.ac.uk May 4th 2007 ECRYPT Summer School Samos 2 The Pairings Explosion Pairings originally used
Unforgeable quantum encryption. Christian Majenz Joint work with Gorjan Alagic and Tommaso Gagliardoni
Unforgeable quantum encryption Christian Majenz Joint work with Gorjan Alagic and Tommaso Gagliardoni Authenticated Encryption! (Using AES with 128 bit block size in Galois Counter Mode and SHA2) Authenticated
Lossy Trapdoor Functions and Their Applications
1 / 15 Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information
The Theory and Applications of Homomorphic Cryptography
The Theory and Applications of Homomorphic Cryptography by Kevin Henry A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master of Mathematics
CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University
CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University March 26 2017 Outline RSA encryption in practice Transform RSA trapdoor
Smooth Projective Hash Function and Its Applications
Smooth Projective Hash Function and Its Applications Rongmao Chen University of Wollongong November 21, 2014 Literature Ronald Cramer and Victor Shoup. Universal Hash Proofs and a Paradigm for Adaptive
Breaking Symmetric Cryptosystems Using Quantum Algorithms
Breaking Symmetric Cryptosystems Using Quantum Algorithms Gaëtan Leurent Joined work with: Marc Kaplan Anthony Leverrier María Naya-Plasencia Inria, France FOQUS Workshop Gaëtan Leurent (Inria) Breaking
RSA OAEP is Secure under the RSA Assumption
RSA OAEP is Secure under the RSA Assumption Eiichiro Fujisaki 1, Tatsuaki Okamoto 1, David Pointcheval 2, and Jacques Stern 2 1 NTT Labs, 1-1 Hikarino-oka, Yokosuka-shi, 239-0847 Japan. E-mail: {fujisaki,okamoto}@isl.ntt.co.jp.
Notes for Lecture A can repeat step 3 as many times as it wishes. We will charge A one unit of time for every time it repeats step 3.
COS 533: Advanced Cryptography Lecture 2 (September 18, 2017) Lecturer: Mark Zhandry Princeton University Scribe: Mark Zhandry Notes for Lecture 2 1 Last Time Last time, we defined formally what an encryption
Tighter Security Proofs for GPV-IBE in the Quantum Random Oracle Model. Shuichi Katsumata (The University of Tokyo /AIST) Takashi Yamakawa (NTT)
1 Tighter Security Proofs for GPV-IBE in the Quantum Random Oracle Model (The University of Tokyo /AIST) *Pronounced as Shuichi Katsumata (The University of Tokyo /AIST) Shota Yamada (AIST) Takashi Yamakawa
Chosen-Ciphertext Security (I)
Chosen-Ciphertext Security (I) CS 601.442/642 Modern Cryptography Fall 2018 S 601.442/642 Modern Cryptography Chosen-Ciphertext Security (I) Fall 2018 1 / 20 Recall: Public-Key Encryption Syntax: Genp1