Leakage Resilient ElGamal Encryption
|
|
|
- Victor Day
- 6 years ago
- Views:
Transcription
1 Asiacrypt 2010, December 9th, Singapore
2 Outline 1 Hybrid Encryption, the KEM/DEM framework 2 ElGamal KEM 3 Leakage Resilient Crypto Why? How? Other models? 4 Leakage Resilient ElGamal
3 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE
4 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1
5 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1
6 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1 pk KG sk
7 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1 pk C sk
8 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1 pk Dec(sk, C) sk
9 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1 K b, C pk sk (K 0, C) Enc(pk), K 1 $ K, b {0, 1}
10 CCA1 secure KEM (Key Encapsulation Mechanism) KEM = {KG, Enc, Dec} PKE for random messages. KEM + DEM PKE Pr[Dec(sk,C) = K : (pk,sk) $ KG ; (K,C) $ Enc(pk)] = 1 K b, C pk sk (K 0, C) Enc(pk), K 1 $ K, b {0, 1} CCA1 security: : Pr[ guesses b] 1/2 = negl
11 ElGamal KEM public parameter: Cyclic group G of prime order p, g = G
12 ElGamal KEM public parameter: Cyclic group G of prime order p, g = G KG: sk = x, pk = g x where x $ Z p
13 ElGamal KEM public parameter: Cyclic group G of prime order p, g = G KG: sk = x, pk = g x where x $ Z p Enc(pk): output (C := g r, K := g rx ) where r Dec(sk, C): output C x $ Z p
14 ElGamal KEM public parameter: Cyclic group G of prime order p, g = G KG: sk = x, pk = g x where x $ Z p Enc(pk): output (C := g r, K := g rx ) where r Dec(sk, C): output C x = g rx = K $ Z p
15 Side-Channel Attacks pk sk
16 Side-Channel Attacks pk C sk
17 Side-Channel Attacks pk C x sk
18 Side-Channel Attacks pk C x sk Can e.g. measure time it takes to compute C x
19 Side-Channel Attacks pk C x sk Can e.g. measure time it takes to compute C x Side-Channel Attack: Cryptanalytic attack exploring information leaked from a physical implementation of a cryptosystem.
20 More side-channel attacks power analysis radiation, sound, heat,... probing attacks cold-boot attacks cache attacks
![al. USENIX 08]](/docs-images/75/72530182/images/21-7.jpg "break")
21 More side-channel attacks power analysis [Eisenbarth et al. CRYPTO 08] break wireless car keys radiation, sound, heat,... probing attacks cold-boot attacks [Halderman et al. USENIX 08] break disc-encryption schemes cache attacks [Ristenpart et al. CCS 09] break cloud computing
22 Side-Channel Countermeasures Usually Ad-hoc Implement countermeasures to prevent known attacks.
23 Side-Channel Countermeasures Usually Ad-hoc Implement countermeasures to prevent known attacks. Timing Make computation time independent of inputs.
24 Side-Channel Countermeasures Usually Ad-hoc Implement countermeasures to prevent known attacks. Timing Make computation time independent of inputs. Radiation Shield the chip.
25 Side-Channel Countermeasures Usually Ad-hoc Implement countermeasures to prevent known attacks. Timing Make computation time independent of inputs. Radiation Shield the chip. make physical device look more like a black-box
26 Leakage-Resilient Cryptography [DP 08] extend black-box model to incorporte leakage
27 Leakage-Resilient Cryptography [DP 08] extend black-box model to incorporte leakage
28 Leakage-Resilient Cryptography [DP 08] extend black-box model to incorporte leakage Computation is split in steps. Adversary has black-box access + get bounded amount of arbitrary, adaptively chosen leakage of every step.
29 Leakage-Resilient Cryptography [DP 08] extend black-box model to incorporte leakage Computation is split in steps. Adversary has black-box access + get bounded amount of arbitrary, adaptively chosen leakage of every step. (only computation leaks axiom [MR04].)
30 Leakage Resilient Cryptography Cont. LR primitives must be stateful.
31 Leakage Resilient Cryptography Cont. LR primitives must be stateful. Key evolution: LR stream-cipher [DP 08,P09,YSPY 10] LR (tree-based) signatures [FKPR 10] Evolving PKE sk difficult: must decrypt for fixed pk.
32 Leakage Resilient Cryptography Cont. LR primitives must be stateful. Key evolution: LR stream-cipher [DP 08,P09,YSPY 10] LR (tree-based) signatures [FKPR 10] Evolving PKE sk difficult: must decrypt for fixed pk. We secret-share key (aka blinding.) Frequently re-share.
33 Leakage Resilient Cryptography Cont. LR primitives must be stateful. Key evolution: LR stream-cipher [DP 08,P09,YSPY 10] LR (tree-based) signatures [FKPR 10] Evolving PKE sk difficult: must decrypt for fixed pk. We secret-share key (aka blinding.) Frequently re-share. Scheme is very efficient ( 2x basic ElGamal) Security proofs are very limited (generic group.)
34 Some Related Work General Compilers [Goldwasser-Rothblum,Juma-Vahlis Crypto 10] General but not practical (One Encryption get gate / Fully homomorphic encryption) Non-Continuous leakage (BRM/memory-attacks, auxiliary input), next talk. Continuous memory attacks [DHLW,BKKV FOCS 10], [LLW eprint 2010/562].
35 ElGamal KEM with shared key g x x Z p
36 ElGamal KEM with shared key g x C x Z p
37 ElGamal KEM with shared key g x C x x Z p
38 ElGamal KEM with shared key g x C, f (.) x Z p Not Leakage-Resilient (learn x bit by bit.)
39 ElGamal KEM with shared key g x C x, f (x) x Z p Not Leakage-Resilient (learn x bit by bit.)
40 ElGamal KEM with shared key g x x 0 x 0 Not Leakage-Resilient (learn x bit by bit.) Multiplicatively Secret-Share x = x 0 x 0.
41 ElGamal KEM with shared key g x C x 0 x 0 Not Leakage-Resilient (learn x bit by bit.) Multiplicatively Secret-Share x = x 0 x 0.
42 ElGamal KEM with shared key g x C x 1 := x 0 r C x 0, r Not Leakage-Resilient (learn x bit by bit.) Multiplicatively Secret-Share x = x 0 x 0. x 0
43 ElGamal KEM with shared key g x C C x 0, r (C x 0 ) x 0 = C x x 1 := x 0 r x 1 := x 0/r Not Leakage-Resilient (learn x bit by bit.) Multiplicatively Secret-Share x = x 0 x 0.
44 ElGamal KEM with shared key g x C C x 0, r (C x 0 ) x 0 = C x x 1 := x 0 r x 1 := x 0/r Not Leakage-Resilient (learn x bit by bit.) Multiplicatively Secret-Share x = x 0 x 0. Re-Sharing: x i+1 x i r, x i+1 x i /r.
45 ElGamal KEM with shared key g x C C x 0, r (C x 0 ) x 0 = C x x 1 := x 0 r x 1 := x 0/r Not Leakage-Resilient (learn x bit by bit.) Multiplicatively Secret-Share x = x 0 x 0. Re-Sharing: x i+1 x i r, x i+1 x i /r. i th query: adaptively chooses f i (.), f i (.). Gets leakage f i (x i, r), f i (x i, r, Cx i ).
46 Conjecture: ElGamal KEM (as on previous slide) is leakage-resilient if the group order p is not smooth (i.e. p 1 has large prime factor.) Range of leakage functions is bounded to, say λ = 0.25 log(p) bits. 1 Howgrave-Graham, Nguyen, Shparlinski. Hidden number problem with hidden multipliers, timed-release crypto, and noisy exponentiation. Math. Comput. 72(243): (2003)
47 Conjecture: ElGamal KEM (as on previous slide) is leakage-resilient if the group order p is not smooth (i.e. p 1 has large prime factor.) Range of leakage functions is bounded to, say λ = 0.25 log(p) bits. Attack exits if we use additive secret sharing, i.e. x = x i + x i mod p instead x = x i x i mod p. 1 Howgrave-Graham, Nguyen, Shparlinski. Hidden number problem with hidden multipliers, timed-release crypto, and noisy exponentiation. Math. Comput. 72(243): (2003)
48 Conjecture: ElGamal KEM (as on previous slide) is leakage-resilient if the group order p is not smooth (i.e. p 1 has large prime factor.) Range of leakage functions is bounded to, say λ = 0.25 log(p) bits. Attack exits if we use additive secret sharing, i.e. x = x i + x i mod p instead x = x i x i mod p. Attack exists if p 1 is smooth. 1 Howgrave-Graham, Nguyen, Shparlinski. Hidden number problem with hidden multipliers, timed-release crypto, and noisy exponentiation. Math. Comput. 72(243): (2003)
49 Conjecture: ElGamal KEM (as on previous slide) is leakage-resilient if the group order p is not smooth (i.e. p 1 has large prime factor.) Range of leakage functions is bounded to, say λ = 0.25 log(p) bits. Attack exits if we use additive secret sharing, i.e. x = x i + x i mod p instead x = x i x i mod p. Attack exists if p 1 is smooth. Attack exists if λ = 0.4 log(p). 1 1 Howgrave-Graham, Nguyen, Shparlinski. Hidden number problem with hidden multipliers, timed-release crypto, and noisy exponentiation. Math. Comput. 72(243): (2003)
50 Conjecture: ElGamal KEM (as on previous slide) is leakage-resilient if the group order p is not smooth (i.e. p 1 has large prime factor.) Range of leakage functions is bounded to, say λ = 0.25 log(p) bits. Attack exits if we use additive secret sharing, i.e. x = x i + x i mod p instead x = x i x i mod p. Attack exists if p 1 is smooth. Attack exists if λ = 0.4 log(p). 1 Scheme if lifted to bilinear groups is secure in generic group model (next slides.) 1 Howgrave-Graham, Nguyen, Shparlinski. Hidden number problem with hidden multipliers, timed-release crypto, and noisy exponentiation. Math. Comput. 72(243): (2003)
51 Bilinear Groups 1 G is a (multiplicative) cyclic group of prime order p. 2 g is a generator of G. 3 e is a bilinear map e : G G G T 1 a,b Z,e(g a,g b ) = e(g,g) ab 2 e(g,g) def = g T 1.
52 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g)
53 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g) KG: sk = g x, pk = g x T where x $ Z p
54 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g) KG: sk = g x, pk = g x T where x $ Z p Enc(pk): output (C := g r, K := gt rx) where r $ Z p Dec(sk, C): output e(c, g x )
55 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g) KG: sk = g x, pk = g x T where x $ Z p Enc(pk): output (C := g r, K := gt rx) where r $ Z p Dec(sk, C): output e(c, g x ) = gt rx
56 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g) KG: sk = g x, pk = g x T where x $ Z p Enc(pk): output (C := g r, K := gt rx) where r $ Z p Dec(sk, C): output e(c, g x ) = gt rx
57 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g) KG: sk = g x, pk = g x T where x $ Z p Enc(pk): output (C := g r, K := gt rx) where r $ Z p Dec(sk, C): output e(c, g x ) = gt rx Like for standard ElGamal, can define shared-key version g x = g x r g r.
58 lifted ElGamal KEM public parameter: G, G T of prime order p, e : G G G T, g = G, g T def = e(g, g) KG: sk = g x, pk = g x T where x $ Z p Enc(pk): output (C := g r, K := gt rx) where r $ Z p Dec(sk, C): output e(c, g x ) = gt rx Like for standard ElGamal, can define shared-key version g x = g x r g r. Theorem In the bilinear generic group model the lifted, shared-key ElGamal KEM is Leakage-Resilient (CCA1). The leakage per invocation can be <.49 log(p) bits.
59 Questions?
60 Questions? ICITS 2011, Amsterdam, The Netherlands, May 21-24, th International Conference on Information Theoretic Security Submission deadline: Dec 10, 2010 Invited Speakers: Benny Applebaum, Alexander Barg, Imre Csiszar, Ivan Damgaard, Yuval Ishai, Renato Renner, Leonid Reyzin, Ronald de Wolf
Leakage Resilient ElGamal Encryption
Leakage Resilient ElGamal Encryption Eike Kiltz 1 and Krzysztof Pietrzak 2 1 Ruhr-Universität Bochum, Germany eike.kiltz@rub.de 2 CWI, Amsterdam, The Netherlands pietrzak@cwi.nl Abstract. Blinding is a
Applied cryptography
Applied cryptography Identity-based Cryptography Andreas Hülsing 19 November 2015 1 / 37 The public key problem How to obtain the correct public key of a user? How to check its authenticity? General answer:
Public-Key Cryptosystems Resilient to Key Leakage
Public-Key Cryptosystems Resilient to Key Leakage Moni Naor Gil Segev Abstract Most of the work in the analysis of cryptographic schemes is concentrated in abstract adversarial models that do not capture
Lossy Trapdoor Functions and Their Applications
1 / 15 Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information
Public Key Cryptography
Public Key Cryptography Ali El Kaafarani 1 Mathematical Institute 2 PQShield Ltd. 1 of 44 Outline 1 Public Key Encryption: security notions 2 RSA Encryption Scheme 2 of 44 Course main reference 3 of 44
RSA Key Extraction via Low- Bandwidth Acoustic Cryptanalysis. Daniel Genkin, Adi Shamir, Eran Tromer
RSA Key Extraction via Low- Bandwidth Acoustic Cryptanalysis Daniel Genkin, Adi Shamir, Eran Tromer Mathematical Attacks Input Crypto Algorithm Key Output Goal: recover the key given access to the inputs
Structure Preserving CCA Secure Encryption
Structure Preserving CCA Secure Encryption presented by ZHANG Tao 1 / 9 Introduction Veriable Encryption enable validity check of the encryption (Camenisch et al. @ CRYPTO'03): veriable encryption of discrete
CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University
CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University March 26 2017 Outline RSA encryption in practice Transform RSA trapdoor
Introduction to Cybersecurity Cryptography (Part 5)
Introduction to Cybersecurity Cryptography (Part 5) Prof. Dr. Michael Backes 13.01.2017 February 17 th Special Lecture! 45 Minutes Your Choice 1. Automotive Security 2. Smartphone Security 3. Side Channel
On the CCA1-Security of Elgamal and Damgård s Elgamal
On the CCA1-Security of Elgamal and Damgård s Elgamal Cybernetica AS, Estonia Tallinn University, Estonia October 21, 2010 Outline I Motivation 1 Motivation 2 3 Motivation Three well-known security requirements
Public Key Cryptography
Public Key Cryptography Ali El Kaafarani Mathematical Institute Oxford University 1 of 74 Outline 1 Complexity measures 2 Algebra and Number Theory Background 3 Public Key Encryption: security notions
On the Impossibility of Constructing Efficient KEMs and Programmable Hash Functions in Prime Order Groups
On the Impossibility of Constructing Efficient KEMs and Programmable Hash Functions in Prime Order Groups Goichiro Hanaoka, Takahiro Matsuda, Jacob C.N. Schuldt Research Institute for Secure Systems (RISEC)
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Provable Security against Side-Channel Attacks
Provable Security against Side-Channel Attacks Matthieu Rivain matthieu.rivain@cryptoexperts.com MCrypt Seminar Aug. 11th 2014 Outline 1 Introduction 2 Modeling side-channel leakage 3 Achieving provable
Smooth Projective Hash Function and Its Applications
Smooth Projective Hash Function and Its Applications Rongmao Chen University of Wollongong November 21, 2014 Literature Ronald Cramer and Victor Shoup. Universal Hash Proofs and a Paradigm for Adaptive
Bounded-Collusion IBE from Semantically-Secure PKE: Generic Constructions with Short Ciphertexts
Bounded-Collusion IBE from Semantically-Secure PKE: Generic Constructions with Short Ciphertexts Stefano Tessaro (UC Santa Barbara) David A. Wilson (MIT) Bounded-Collusion IBE from Semantically-Secure
Introduction to Cryptography. Lecture 8
Introduction to Cryptography Lecture 8 Benny Pinkas page 1 1 Groups we will use Multiplication modulo a prime number p (G, ) = ({1,2,,p-1}, ) E.g., Z 7* = ( {1,2,3,4,5,6}, ) Z p * Z N * Multiplication
4-3 A Survey on Oblivious Transfer Protocols
4-3 A Survey on Oblivious Transfer Protocols In this paper, we survey some constructions of oblivious transfer (OT) protocols from public key encryption schemes. We begin with a simple construction of
EXAM IN. TDA352 (Chalmers) - DIT250 (GU) 12 January 2018, 08:
CHALMERS GÖTEBORGS UNIVERSITET EXAM IN CRYPTOGRAPHY TDA352 (Chalmers) - DIT250 (GU) 12 January 2018, 08:30 12.30 Tillåtna hjälpmedel: Typgodkänd räknare. Annan minnestömd räknare får användas efter godkännande
Lecture 19: Public-key Cryptography (Diffie-Hellman Key Exchange & ElGamal Encryption) Public-key Cryptography
Lecture 19: (Diffie-Hellman Key Exchange & ElGamal Encryption) Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies
Adaptive partitioning. Dennis Hofheinz (KIT, Karlsruhe)
Adaptive partitioning Dennis Hofheinz (KIT, Karlsruhe) Public-Key Encryption Public-Key Encryption Accepted security notion: chosen-ciphertext security (IND-CCA) Public-Key Encryption Accepted security
Leakage-Resilient Public-Key Encryption from Obfuscation
Leakage-Resilient Public-Key Encryption from Obfuscation Dana Dachman-Soled S. Dov Gordon Feng-Hao Liu Adam O Neill Hong-Sheng Zhou July 25, 2016 Abstract The literature on leakage-resilient cryptography
Notes for Lecture 16
COS 533: Advanced Cryptography Lecture 16 (11/13/2017) Lecturer: Mark Zhandry Princeton University Scribe: Boriana Gjura Notes for Lecture 16 1 Lattices (continued) 1.1 Last time. We defined lattices as
Lecture 30: Hybrid Encryption and Prime Number Generation. Hybrid Encryption & Primes
Lecture 30: Hybrid Encryption and Prime Number Generation Recall: ElGamal Encryption I We begin by recalling the ElGamal Public-key Encryption Recall that to describe a private-key encryption scheme we
Chapter 11 : Private-Key Encryption
COMP547 Claude Crépeau INTRODUCTION TO MODERN CRYPTOGRAPHY _ Second Edition _ Jonathan Katz Yehuda Lindell Chapter 11 : Private-Key Encryption 1 Chapter 11 Public-Key Encryption Apologies: all numbering
Public Key 9/17/2018. Symmetric Cryptography Review. Symmetric Cryptography: Shortcomings (1) Symmetric Cryptography: Analogy
Symmetric Cryptography Review Alice Bob Public Key x e K (x) y d K (y) x K K Instructor: Dr. Wei (Lisa) Li Department of Computer Science, GSU Two properties of symmetric (secret-key) crypto-systems: The
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky. Lecture 7
CS 282A/MATH 209A: Foundations of Cryptography Prof. Rafail Ostrovsky Lecture 7 Lecture date: Monday, 28 February, 2005 Scribe: M.Chov, K.Leung, J.Salomone 1 Oneway Trapdoor Permutations Recall that a
Notes for Lecture 9. Last time, we introduced zero knowledge proofs and showed how interactive zero knowledge proofs could be constructed from OWFs.
COS 533: Advanced Cryptography Lecture 9 (October 11, 2017) Lecturer: Mark Zhandry Princeton University Scribe: Udaya Ghai Notes for Lecture 9 1 Last Time Last time, we introduced zero knowledge proofs
Practice Final Exam Winter 2017, CS 485/585 Crypto March 14, 2017
Practice Final Exam Name: Winter 2017, CS 485/585 Crypto March 14, 2017 Portland State University Prof. Fang Song Instructions This exam contains 7 pages (including this cover page) and 5 questions. Total
Classical hardness of the Learning with Errors problem
Classical hardness of the Learning with Errors problem Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé August 12, 2013 Adeline Langlois Hardness
Cryptography. Lecture 2: Perfect Secrecy and its Limitations. Gil Segev
Cryptography Lecture 2: Perfect Secrecy and its Limitations Gil Segev Last Week Symmetric-key encryption (KeyGen, Enc, Dec) Historical ciphers that are completely broken The basic principles of modern
Public Key Cryptography
Public Key Cryptography Introduction Public Key Cryptography Unlike symmetric key, there is no need for Alice and Bob to share a common secret Alice can convey her public key to Bob in a public communication:
Classical hardness of Learning with Errors
Classical hardness of Learning with Errors Adeline Langlois Aric Team, LIP, ENS Lyon Joint work with Z. Brakerski, C. Peikert, O. Regev and D. Stehlé Adeline Langlois Classical Hardness of LWE 1/ 13 Our
A ROBUST AND PLAINTEXT-AWARE VARIANT OF SIGNED ELGAMAL ENCRYPTION
A ROBUST AND PLAINTEXT-AWARE VARIANT OF SIGNED ELGAMAL ENCRYPTION Joana Treger ANSSI, France. Session ID: CRYP-W21 Session Classification: Advanced ELGAMAL ENCRYPTION & BASIC CONCEPTS CDH / DDH Computational
Outline Proxy Re-Encryption NTRU NTRUReEncrypt PS-NTRUReEncrypt Experimental results Conclusions. NTRUReEncrypt
NTRUReEncrypt An Efficient Proxy Re-Encryption Scheme based on NTRU David Nuñez, Isaac Agudo, and Javier Lopez Network, Information and Computer Security Laboratory (NICS Lab) Universidad de Málaga, Spain
Introduction to Cryptography. Susan Hohenberger
Introduction to Cryptography Susan Hohenberger 1 Cryptography -- from art to science -- more than just encryption -- essential today for non-military applications 2 Symmetric Crypto Shared secret K =>
Gentry IBE Paper Reading
Gentry IBE Paper Reading Y. Jiang 1 1 University of Wollongong September 5, 2014 Literature Craig Gentry. Practical Identity-Based Encryption Without Random Oracles. Advances in Cryptology - EUROCRYPT
Basics in Cryptology. Outline. II Distributed Cryptography. Key Management. Outline. David Pointcheval. ENS Paris 2018
Basics in Cryptology II Distributed Cryptography David Pointcheval Ecole normale supérieure, CNRS & INRIA ENS Paris 2018 NS/CNRS/INRIA Cascade David Pointcheval 1/26ENS/CNRS/INRIA Cascade David Pointcheval
Identity-based encryption
Identity-based encryption Michel Abdalla ENS & CNRS MPRI - Course 2-12-1 Michel Abdalla (ENS & CNRS) Identity-based encryption 1 / 43 Identity-based encryption (IBE) Goal: Allow senders to encrypt messages
A New Variant of the Cramer-Shoup KEM Secure against Chosen Ciphertext Attack
A New Variant of the Cramer-Shoup KEM Secure against Chosen Ciphertext Attack Joonsang Baek 1 Willy Susilo 2 Joseph K. Liu 1 Jianying Zhou 1 1 Institute for Infocomm Research, Singapore 2 University of
Public-Key Encryption: ElGamal, RSA, Rabin
Public-Key Encryption: ElGamal, RSA, Rabin Introduction to Modern Cryptography Benny Applebaum Tel-Aviv University Fall Semester, 2011 12 Public-Key Encryption Syntax Encryption algorithm: E. Decryption
Practical Key Recovery for Discrete-Logarithm Based Authentication Schemes from Random Nonce Bits
Practical Key Recovery for Discrete-Logarithm Based Authentication Schemes from Random Nonce Bits Damien Vergnaud École normale supérieure CHES September, 15th 2015 (with Aurélie Bauer) Damien Vergnaud
How to Use Short Basis : Trapdoors for Hard Lattices and new Cryptographic Constructions
Presentation Article presentation, for the ENS Lattice Based Crypto Workgroup http://www.di.ens.fr/~pnguyen/lbc.html, 30 September 2009 How to Use Short Basis : Trapdoors for http://www.cc.gatech.edu/~cpeikert/pubs/trap_lattice.pdf
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model Presented by: Angela Robinson Department of Mathematical Sciences, Florida Atlantic University April 4, 2018 Motivation Quantum-resistance
Lecture 9 Julie Staub Avi Dalal Abheek Anand Gelareh Taban. 1 Introduction. 2 Background. CMSC 858K Advanced Topics in Cryptography February 24, 2004
CMSC 858K Advanced Topics in Cryptography February 24, 2004 Lecturer: Jonathan Katz Lecture 9 Scribe(s): Julie Staub Avi Dalal Abheek Anand Gelareh Taban 1 Introduction In previous lectures, we constructed
EXAM IN. TDA352 (Chalmers) - DIT250 (GU) 18 January 2019, 08:
CHALMERS GÖTEBORGS UNIVERSITET EXAM IN CRYPTOGRAPHY TDA352 (Chalmers) - DIT250 (GU) 18 January 2019, 08:30 12.30 Tillåtna hjälpmedel: Typgodkänd räknare. Annan minnestömd räknare får användas efter godkännande
The Cramer-Shoup Cryptosystem
The Cramer-Shoup Cryptosystem Eileen Wagner October 22, 2014 1 / 28 The Cramer-Shoup system is an asymmetric key encryption algorithm, and was the first efficient scheme proven to be secure against adaptive
CONSTRUCTIONS SECURE AGAINST RECEIVER SELECTIVE OPENING AND CHOSEN CIPHERTEXT ATTACKS
CONSRUCIONS SECURE AGAINS RECEIVER SELECIVE OPENING AND CHOSEN CIPHEREX AACKS Dingding Jia, Xianhui Lu, Bao Li jiadingding@iie.ac.cn C-RSA 2017 02-17 Outline Background Motivation Our contribution Existence:
Simple SK-ID-KEM 1. 1 Introduction
1 Simple SK-ID-KEM 1 Zhaohui Cheng School of Computing Science, Middlesex University The Burroughs, Hendon, London, NW4 4BT, United Kingdom. m.z.cheng@mdx.ac.uk Abstract. In 2001, Boneh and Franklin presented
Advanced Cryptography 1st Semester Public Encryption
Advanced Cryptography 1st Semester 2007-2008 Pascal Lafourcade Université Joseph Fourrier, Verimag Master: October 1st 2007 1 / 64 Last Time (I) Indistinguishability Negligible function Probabilities Indistinguishability
Efficient Public-Key Cryptography in the Presence of Key Leakage
Efficient Public-Key Cryptography in the Presence of Key Leakage Yevgeniy Dodis Kristiyan Haralambiev Adriana López-Alt Daniel Wichs August 17, 2010 Abstract We study the design of cryptographic primitives
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction Daniel J. Bernstein 1 Leon Groot Bruinderink 2 Tanja Lange 2 Lorenz Panny 2 1 University of Illinois at Chicago 2
Lecture 28: Public-key Cryptography. Public-key Cryptography
Lecture 28: Recall In private-key cryptography the secret-key sk is always established ahead of time The secrecy of the private-key cryptography relies on the fact that the adversary does not have access
Outline. The Game-based Methodology for Computational Security Proofs. Public-Key Cryptography. Outline. Introduction Provable Security
The Game-based Methodology for Computational s David Pointcheval Ecole normale supérieure, CNRS & INRIA Computational and Symbolic Proofs of Security Atagawa Heights Japan April 6th, 2009 1/39 2/39 Public-Key
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 33 The Diffie-Hellman Problem
Intro to Public Key Cryptography Diffie & Hellman Key Exchange
Introduction to Modern Cryptography Lecture 5 Number Theory: 1. Quadratic residues. 2. The discrete log problem. Intro to Public Key Cryptography Diffie & Hellman Key Exchange Course Summary - Math Part
Public-Key Cryptography. Lecture 9 Public-Key Encryption Diffie-Hellman Key-Exchange
Public-Key Cryptography Lecture 9 Public-Key Encryption Diffie-Hellman Key-Exchange Shared/Symmetric-Key Encryption (a.k.a. private-key encryption) SKE: Syntax KeyGen outputs K K E scheme E Syntax a.k.a.
ASYMMETRIC ENCRYPTION
ASYMMETRIC ENCRYPTION 1 / 1 Recommended Book Steven Levy. Crypto. Penguin books. 2001. A non-technical account of the history of public-key cryptography and the colorful characters involved. 2 / 1 Recall
Notes on Property-Preserving Encryption
Notes on Property-Preserving Encryption The first type of specialized encryption scheme that can be used in secure outsourced storage we will look at is property-preserving encryption. This is encryption
Partial Key Exposure: Generalized Framework to Attack RSA
Partial Key Exposure: Generalized Framework to Attack RSA Cryptology Research Group Indian Statistical Institute, Kolkata 12 December 2011 Outline of the Talk 1 RSA - A brief overview 2 Partial Key Exposure
Advanced Topics in Cryptography
Advanced Topics in Cryptography Lecture 6: El Gamal. Chosen-ciphertext security, the Cramer-Shoup cryptosystem. Benny Pinkas based on slides of Moni Naor page 1 1 Related papers Lecture notes of Moni Naor,
ADVERTISING AGGREGATIONARCHITECTURE
SOMAR LAPS PRIVACY-PRESERVING LATTICE-BASED PRIVATE-STREAM SOCIAL MEDIA ADVERTISING AGGREGATIONARCHITECTURE OR: HOW NOT TO LEAVE YOUR PERSONAL DATA AROUND REVISITING PRIVATE-STREAM AGGREGATION: LATTICE-BASED
CRYPTANALYSIS OF COMPACT-LWE
SESSION ID: CRYP-T10 CRYPTANALYSIS OF COMPACT-LWE Jonathan Bootle, Mehdi Tibouchi, Keita Xagawa Background Information Lattice-based cryptographic assumption Based on the learning-with-errors (LWE) assumption
Efficient Identity-based Encryption Without Random Oracles
Efficient Identity-based Encryption Without Random Oracles Brent Waters Weiwei Liu School of Computer Science and Software Engineering 1/32 Weiwei Liu Efficient Identity-based Encryption Without Random
Notes for Lecture A can repeat step 3 as many times as it wishes. We will charge A one unit of time for every time it repeats step 3.
COS 533: Advanced Cryptography Lecture 2 (September 18, 2017) Lecturer: Mark Zhandry Princeton University Scribe: Mark Zhandry Notes for Lecture 2 1 Last Time Last time, we defined formally what an encryption
Candidate Differing-Inputs Obfuscation from Indistinguishability Obfuscation and Auxiliary-Input Point Obfuscation
Candidate Differing-Inputs Obfuscation from Indistinguishability Obfuscation and Auxiliary-Input Point Obfuscation Dongxue Pan 1,2, Hongda Li 1,2, Peifang Ni 1,2 1 The Data Assurance and Communication
CPA-Security. Definition: A private-key encryption scheme
CPA-Security The CPA Indistinguishability Experiment PrivK cpa A,Π n : 1. A key k is generated by running Gen 1 n. 2. The adversary A is given input 1 n and oracle access to Enc k, and outputs a pair of
Quantum-secure symmetric-key cryptography based on Hidden Shifts
Quantum-secure symmetric-key cryptography based on Hidden Shifts Gorjan Alagic QMATH, Department of Mathematical Sciences University of Copenhagen Alexander Russell Department of Computer Science & Engineering
Converting Pairing-Based Cryptosystems from Composite-Order Groups to Prime-Order Groups
Converting Pairing-Based Cryptosystems from Composite-Order Groups to Prime-Order Groups David Mandell Freeman Stanford University, USA Eurocrypt 2010 Monaco, Monaco 31 May 2010 David Mandell Freeman (Stanford)
Fully Homomorphic Encryption over the Integers
Fully Homomorphic Encryption over the Integers Many slides borrowed from Craig Marten van Dijk 1, Craig Gentry 2, Shai Halevi 2, Vinod Vaikuntanathan 2 1 MIT, 2 IBM Research Computing on Encrypted Data
CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD
CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD Mark Zhandry Stanford University * Joint work with Dan Boneh But First: My Current Work Indistinguishability Obfuscation (and variants) Multiparty NIKE without
CRYSTALS Kyber and Dilithium. Peter Schwabe February 7, 2018
CRYSTALS Kyber and Dilithium Peter Schwabe peter@cryptojedi.org https://cryptojedi.org February 7, 2018 Crypto today 5 building blocks for a secure channel Symmetric crypto Block or stream cipher (e.g.,
Remote Timing Attacks are Practical
Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in Advanced Topics in Network Security (600/650.624) Outline Traditional threat model in cryptography Side-channel
A new security notion for asymmetric encryption Draft #8
A new security notion for asymmetric encryption Draft #8 Muhammad Rezal Kamel Ariffin 1,2 1 Al-Kindi Cryptography Research Laboratory, Institute for Mathematical Research, 2 Department of Mathematics,
ECS 189A Final Cryptography Spring 2011
ECS 127: Cryptography Handout F UC Davis Phillip Rogaway June 9, 2011 ECS 189A Final Cryptography Spring 2011 Hints for success: Good luck on the exam. I don t think it s all that hard (I do believe I
Introduction to Elliptic Curve Cryptography
Indian Statistical Institute Kolkata May 19, 2017 ElGamal Public Key Cryptosystem, 1984 Key Generation: 1 Choose a suitable large prime p 2 Choose a generator g of the cyclic group IZ p 3 Choose a cyclic
Lattice Based Crypto: Answering Questions You Don't Understand
Lattice Based Crypto: Answering Questions You Don't Understand Vadim Lyubashevsky INRIA / ENS, Paris Cryptography Secure communication in the presence of adversaries Symmetric-Key Cryptography Secret key
5199/IOC5063 Theory of Cryptology, 2014 Fall
5199/IOC5063 Theory of Cryptology, 2014 Fall Homework 2 Reference Solution 1. This is about the RSA common modulus problem. Consider that two users A and B use the same modulus n = 146171 for the RSA encryption.
The Advanced Encryption Standard
Lecturers: Mark D. Ryan and David Galindo. Cryptography 2017. Slide: 48 The Advanced Encryption Standard Successor of DES DES considered insecure; 3DES considered too slow. NIST competition in 1997 15
Other Public-Key Cryptosystems
Other Public-Key Cryptosystems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: 10-1 Overview 1. How to exchange
ENEE 457: Computer Systems Security 10/3/16. Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange
ENEE 457: Computer Systems Security 10/3/16 Lecture 9 RSA Encryption and Diffie-Helmann Key Exchange Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland,
Report on Learning with Errors over Rings-based HILA5 and its CCA Security
Report on Learning with Errors over Rings-based HILA5 and its CCA Security Jesús Antonio Soto Velázquez January 24, 2018 Abstract HILA5 is a cryptographic primitive based on lattices that was submitted
Parallel Implementations of Masking Schemes and the Bounded Moment Leakage Model
Parallel Implementations of Masking Schemes and the Bounded Moment Leakage Model G. Barthe, F. Dupressoir, S. Faust, B. Grégoire, F.-X. Standaert, P.-Y. Strub IMDEA (Spain), Univ. Surrey (UK), Univ. Bochum
Lecture 8 Alvaro A. Cardenas Nicholas Sze Yinian Mao Kavitha Swaminathan. 1 Introduction. 2 The Dolev-Dwork-Naor (DDN) Scheme [1]
![Lecture 8 Alvaro A. Cardenas Nicholas Sze Yinian Mao Kavitha Swaminathan. 1 Introduction. 2 The Dolev-Dwork-Naor (DDN) Scheme [1]](/thumbs/82/86919338.jpg "Lecture 8 Alvaro A. Cardenas Nicholas Sze Yinian Mao Kavitha Swaminathan. 1 Introduction. 2 The Dolev-Dwork-Naor (DDN) Scheme [1]")
CMSC 858K Advanced Topics in Cryptography February 19, 2004 Lecturer: Jonathan Katz Lecture 8 Scribe(s): Alvaro A. Cardenas Nicholas Sze Yinian Mao Kavitha Swaminathan 1 Introduction Last time we introduced
Public-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols University of Massachusetts Amherst nichols@math.umass.edu WINRS Research Symposium Brown University March 4, 2017 Cryptography basics Cryptography
Oblivious Transfer (OT) and OT Extension
Oblivious Transfer (OT) and OT Extension School on Secure Multiparty Computation Arpita Patra Arpita Patra Roadmap o Oblivious Transfer - Construction from `special PKE o OT Extension - IKNP OT extension
McBits: Fast code-based cryptography
McBits: Fast code-based cryptography Peter Schwabe Radboud University Nijmegen, The Netherlands Joint work with Daniel Bernstein, Tung Chou December 17, 2013 IMA International Conference on Cryptography
On Post-Quantum Cryptography
On Post-Quantum Cryptography Ehsan Ebrahimi Quantum Cryptography Group University of Tartu, Estonia 15 March 2018 Information Security and Cryptography Group Seminar Post-Quantum Cryptography Users intend
Digital Signatures. p1.
Digital Signatures p1. Digital Signatures Digital signature is the same as MAC except that the tag (signature) is produced using the secret key of a public-key cryptosystem. Message m MAC k (m) Message
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security Boaz Barak November 21, 2007 Cyclic groups and discrete log A group G is cyclic if there exists a generator
Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents
Side Channel Attack to Actual Cryptanalysis: Breaking CRT-RSA with Low Weight Decryption Exponents Santanu Sarkar and Subhamoy Maitra Applied Statistics Unit, Indian Statistical Institute, 203 B. T. Road,
Lecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004
CMSC 858K Advanced Topics in Cryptography February 5, 2004 Lecturer: Jonathan Katz Lecture 4 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Summary The focus of this lecture is efficient public-key
Proxy Re-Encryption in a Stronger Security Model Extended from CT-RSA2012
Proxy Re-Encryption in a Stronger Security Model Extended from CT-RSA2012 Manh Ha Nguyen Tokyo Institute of Technology Toshiyuki Isshiki 1,2 and Keisuke Tanaka 2 1 NEC Corporation 2 Tokyo Institute of
CHALMERS GÖTEBORGS UNIVERSITET. TDA352 (Chalmers) - DIT250 (GU) 11 April 2017, 8:30-12:30
CHALMERS GÖTEBORGS UNIVERSITET CRYPTOGRAPHY TDA35 (Chalmers) - DIT50 (GU) 11 April 017, 8:30-1:30 No extra material is allowed during the exam except for pens and a simple calculator (not smartphones).
Notes for Lecture 17
U.C. Berkeley CS276: Cryptography Handout N17 Luca Trevisan March 17, 2009 Notes for Lecture 17 Scribed by Matt Finifter, posted April 8, 2009 Summary Today we begin to talk about public-key cryptography,
Secure Certificateless Public Key Encryption without Redundancy
Secure Certificateless Public Key Encryption without Redundancy Yinxia Sun and Futai Zhang School of Mathematics and Computer Science Nanjing Normal University, Nanjing 210097, P.R.China Abstract. Certificateless
Cryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
2. Cryptography 2.5. ElGamal cryptosystems and Discrete logarithms
CRYPTOGRAPHY 19 Cryptography 5 ElGamal cryptosystems and Discrete logarithms Definition Let G be a cyclic group of order n and let α be a generator of G For each A G there exists an uniue 0 a n 1 such
Semantic Security and Indistinguishability in the Quantum World
Semantic Security and Indistinguishability in the Quantum World Tommaso Gagliardoni 1, Andreas Hülsing 2, Christian Schaffner 3 1 IBM Research, Swiss; TU Darmstadt, Germany 2 TU Eindhoven, The Netherlands
Provable security. Michel Abdalla
Lecture 1: Provable security Michel Abdalla École normale supérieure & CNRS Cryptography Main goal: Enable secure communication in the presence of adversaries Adversary Sender 10110 10110 Receiver Only