Random Oracles in a Quantum World
|
|
|
- Morgan Webster
- 5 years ago
- Views:
Transcription
1 Dan Boneh 1 Özgür Dagdelen 2 Marc Fischlin 2 Anja Lehmann 3 Christian Schaffner 4 Mark Zhandry 1 1 Stanford University, USA 2 CASED & Darmstadt University of Technology, Germany 3 IBM Research Zurich, Switzerland 4 University of Amsterdam and CWI, The Netherlands December 5, 2011
2 Quantum Random Oracle Model Our Results Classical Random Oracle Model Adversaries
3 Quantum Random Oracle Model Our Results Quantum Random Oracle Model Adversaries
4 Quantum Random Oracle Model Our Results Quantum Random Oracle Model (QROM) Why quantum queries? Random oracle models hash function, which a quantum adversary can evaluate on superposition.
5 Quantum Random Oracle Model Our Results Quantum Random Oracle Model (QROM) Why quantum queries? Random oracle models hash function, which a quantum adversary can evaluate on superposition. Because quantum adversaries can query on a superposition, classical proofs of security do not carry over to the quantum setting.
6 Quantum Random Oracle Model Our Results Quantum Random Oracle Model (QROM) Why quantum queries? Random oracle models hash function, which a quantum adversary can evaluate on superposition. Because quantum adversaries can query on a superposition, classical proofs of security do not carry over to the quantum setting. Examples: Simulating the random oracle Determining what points the adversary is interested in Programming the random oracle Rewinding
7 Our Results Introduction Quantum Random Oracle Model Our Results Separation result: Scheme secure in classical ROM, but insecure in QROM
8 Our Results Introduction Quantum Random Oracle Model Our Results Separation result: Scheme secure in classical ROM, but insecure in QROM Identification scheme
9 Our Results Introduction Quantum Random Oracle Model Our Results Separation result: Scheme secure in classical ROM, but insecure in QROM Identification scheme Positive result: Signature Schemes
10 Our Results Introduction Quantum Random Oracle Model Our Results Separation result: Scheme secure in classical ROM, but insecure in QROM Identification scheme Positive result: Signature Schemes Some classical security proofs carry over (if quantum PRFs exist).
11 Our Results Introduction Quantum Random Oracle Model Our Results Separation result: Scheme secure in classical ROM, but insecure in QROM Identification scheme Positive result: Signature Schemes Some classical security proofs carry over (if quantum PRFs exist). Example: Lattice-based signatures ([GPV08]) Example: Specific instances of Full Domain Hash Generic Full Domain Hash is still open.
12 Our Results Introduction Quantum Random Oracle Model Our Results Separation result: Scheme secure in classical ROM, but insecure in QROM Identification scheme Positive result: Signature Schemes Some classical security proofs carry over (if quantum PRFs exist). Example: Lattice-based signatures ([GPV08]) Example: Specific instances of Full Domain Hash Generic Full Domain Hash is still open. Positive result:
13 Preimage Sampleable Functions A preimage sampleable trapdoor function (PSF) F is a triple of functions (G, f, f 1 ): G(1 n ) outputs (sk, pk) f pk (x) is efficiently computable, uniformly distributed for random x. fsk 1 (y) samples uniformly from the set of x such that f pk (x) = y
14 Preimage Sampleable Functions A preimage sampleable trapdoor function (PSF) F is a triple of functions (G, f, f 1 ): G(1 n ) outputs (sk, pk) f pk (x) is efficiently computable, uniformly distributed for random x. fsk 1 (y) samples uniformly from the set of x such that f pk (x) = y F = (G, f, f 1 ) is secure if it is one-way, collision-resistant, and has high preimage min-entropy.
15 Preimage Sampleable Functions A preimage sampleable trapdoor function (PSF) F is a triple of functions (G, f, f 1 ): G(1 n ) outputs (sk, pk) f pk (x) is efficiently computable, uniformly distributed for random x. fsk 1 (y) samples uniformly from the set of x such that f pk (x) = y F = (G, f, f 1 ) is secure if it is one-way, collision-resistant, and has high preimage min-entropy. Secure construction from lattices [GPV08]
16 Example: GPV Given a PSF F = (G, f, f 1 ), construct a signature scheme S O = (G, S O, V O ) as follows:
17 Example: GPV Given a PSF F = (G, f, f 1 ), construct a signature scheme S O = (G, S O, V O ) as follows: Ssk(m) O = fsk 1 (O(m)). Remember this output for future queries of m
18 Example: GPV Given a PSF F = (G, f, f 1 ), construct a signature scheme S O = (G, S O, V O ) as follows: Ssk(m) O = fsk 1 (O(m)). Remember this output for future queries of m V O pk(m, σ) accepts if and only if f pk (σ) = O(m).
19 Example: GPV Given a PSF F = (G, f, f 1 ), construct a signature scheme S O = (G, S O, V O ) as follows: Ssk(m) O = fsk 1 (O(m)). Remember this output for future queries of m V O pk(m, σ) accepts if and only if f pk (σ) = O(m). Theorem Suppose F is a quantum-secure PSF, and that quantum pseudorandom functions exist. Then S is quantum secure.
20 Security of GPV Two parts:
21 Security of GPV Two parts: Prove that security of a certain type of classical reduction (called history free) implies security in the quantum setting
22 Security of GPV Two parts: Prove that security of a certain type of classical reduction (called history free) implies security in the quantum setting Show that the reduction of [GPV08] is history free
23 (Classical) History-free Reduction Classical RO Techniques:
24 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle.
25 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle.
26 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle. Determine what points the adversary is querying the oracle on.
27 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle. Determine what points the adversary is querying the oracle on. Not allowed.
28 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle. Determine what points the adversary is querying the oracle on. Not allowed. Programming the random oracle.
29 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle. Determine what points the adversary is querying the oracle on. Not allowed. Programming the random oracle. Only non-adaptively (i.e. no knowledge of previous queries)
30 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle. Determine what points the adversary is querying the oracle on. Not allowed. Programming the random oracle. Only non-adaptively (i.e. no knowledge of previous queries) Rewinding
31 (Classical) History-free Reduction Classical RO Techniques: Simulating the random oracle. Use a random oracle. Determine what points the adversary is querying the oracle on. Not allowed. Programming the random oracle. Only non-adaptively (i.e. no knowledge of previous queries) Rewinding Not allowed.
32 (Classical) History-free Reduction
33 (Classical) History-free Reduction Reduction algorithm has private random oracle O c Implemented on the fly
34 (Classical) History-free Reduction Reduction algorithm has private random oracle O c Implemented on the fly Random oracle queries answered by Rand Oc Truly random
35 (Classical) History-free Reduction Reduction algorithm has private random oracle O c Implemented on the fly Random oracle queries answered by Rand Oc Truly random answered by Sign Oc Consistent with random oracle Distribution identical to actual
36 (Classical) History Free Reduction
37 Main Theorem Introduction Theorem Suppose a random oracle model signature scheme S has a history-free reduction that transforms any classical adversary A into a classical algorithm B for some hard problem for quantum computers. Suppose further that quantum pseudorandom functions exist. Then S is secure against quantum adversaries.
38 Proof Introduction
39 Proof Introduction
40 Problem Introduction Quantum adversary could query on a superposition of exponentially many inputs.
41 Problem Introduction Quantum adversary could query on a superposition of exponentially many inputs. Results in queries to O q on exponential superposition.
42 Problem Introduction Quantum adversary could query on a superposition of exponentially many inputs. Results in queries to O q on exponential superposition. Implementing the random oracle would require exponential randomness.
43 Problem Introduction Quantum adversary could query on a superposition of exponentially many inputs. Results in queries to O q on exponential superposition. Implementing the random oracle would require exponential randomness. Idea: Use a quantum pseudorandom function
44 Quantum PRF Introduction A quantum pseudorandom function PRF is a keyed function that quantum computers cannot tell from a random oracle. Precisely, for all polynomial-time quantum oracle algorithms A, Pr[A PRF k () = 1] Pr[A Oq () = 1] < negl Where the left probability is over k and the right is over O q, both chosen randomly.
45 Quantum PRF Introduction A quantum pseudorandom function PRF is a keyed function that quantum computers cannot tell from a random oracle. Precisely, for all polynomial-time quantum oracle algorithms A, Pr[A PRF k () = 1] Pr[A Oq () = 1] < negl Where the left probability is over k and the right is over O q, both chosen randomly. No known provably secure constructions!
46 Proof Introduction
47 Proof Introduction
48 GPV Reduction Introduction
49 Modified GPV Reduction
50 History-Freeness of GPV Reduction This reduction is in history-free form!
51 History-Freeness of GPV Reduction This reduction is in history-free form! Caveats: f pk (r) for random r is NOT truly random for GPV construction. GPV signatures are NOT truly random preimages of O(m)
52 History-Freeness of GPV Reduction This reduction is in history-free form! Caveats: f pk (r) for random r is NOT truly random for GPV construction. GPV signatures are NOT truly random preimages of O(m) Need to relax definition of history freeness to allow indistinguishable (by quantum adversaries)
53 Other History-Free Reductions Full Domain Hash from claw-free permutations ([Cor00]). Katz-Wang (KW03)
54 Encryption Introduction
55 Encryption Introduction History-freeness complicated by the challenge query. Easier to prove directly.
56 Encryption Introduction History-freeness complicated by the challenge query. Easier to prove directly. CPA-security of Bellare-Rogaway encryption scheme ([BR93]): E pk (m) = f pk (r) m O(r) for a random r where f is a trapdoor permutation.
57 Encryption Introduction History-freeness complicated by the challenge query. Easier to prove directly. CPA-security of Bellare-Rogaway encryption scheme ([BR93]): E pk (m) = f pk (r) m O(r) for a random r where f is a trapdoor permutation. CCA-security of hybrid encryption scheme: E pk (m) = f pk (r) (E S ) O(r) (m) for a random r where f is a trapdoor permutation and E S is CCA-secure private key encryption.
58 Introduction Open Problems
59 Introduction Open Problems Classical security reductions do not carry over to the quantum world
60 Introduction Open Problems Classical security reductions do not carry over to the quantum world Restricted class of classical security proofs do imply quantum security
61 Introduction Open Problems Classical security reductions do not carry over to the quantum world Restricted class of classical security proofs do imply quantum security GPV are secure
62 Open Problems Introduction Open Problems Generic Full Domain Hash
63 Open Problems Introduction Open Problems Generic Full Domain Hash from Identification Protocols [FS86]
64 Open Problems Introduction Open Problems Generic Full Domain Hash from Identification Protocols [FS86] CCA-security from weaker security notions [FO99]
65 Open Problems Introduction Open Problems Generic Full Domain Hash from Identification Protocols [FS86] CCA-security from weaker security notions [FO99] Quantum PRFs from one-way functions
SECURE IDENTITY-BASED ENCRYPTION IN THE QUANTUM RANDOM ORACLE MODEL. Mark Zhandry Stanford University
SECURE IDENTITY-BASED ENCRYPTION IN THE QUANTUM RANDOM ORACLE MODEL Mark Zhandry Stanford University Random Oracle Model (ROM) Sometimes, we can t prove a scheme secure in the standard model. Instead,
Random Oracles in a Quantum World
Random Oracles in a Quantum World AsiaISG Research Seminars 2011/2012 Özgür Dagdelen, Marc Fischlin (TU Darmstadt) Dan Boneh, Mark Zhandry (Stanford University) Anja Lehmann (IBM Zurich) Christian Schaffner
BEYOND POST QUANTUM CRYPTOGRAPHY
BEYOND POST QUANTUM CRYPTOGRAPHY Mark Zhandry Stanford University Joint work with Dan Boneh Classical Cryptography Post-Quantum Cryptography All communication stays classical Beyond Post-Quantum Cryptography
Cryptographical Security in the Quantum Random Oracle Model
Cryptographical Security in the Quantum Random Oracle Model Center for Advanced Security Research Darmstadt (CASED) - TU Darmstadt, Germany June, 21st, 2012 This work is licensed under a Creative Commons
A survey on quantum-secure cryptographic systems
A survey on quantum-secure cryptographic systems Tomoka Kan May 24, 2018 1 Abstract Post-quantum cryptography refers to the search for classical cryptosystems which remain secure in the presence of a quantum
Random Oracles in a Quantum World
Random Oracles in a Quantum World Dan Boneh 1, Özgür Dagdelen2, Marc Fischlin 2, Anja Lehmann 3, Christian Schaffner 4, and Mark Zhandry 1 1 Stanford University, USA 2 CASED & Darmstadt University of Technology,
CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD
CLASSICAL CRYPTOSYSTEMS IN A QUANTUM WORLD Mark Zhandry Stanford University * Joint work with Dan Boneh But First: My Current Work Indistinguishability Obfuscation (and variants) Multiparty NIKE without
The Random Oracle Paradigm. Mike Reiter. Random oracle is a formalism to model such uses of hash functions that abound in practical cryptography
1 The Random Oracle Paradigm Mike Reiter Based on Random Oracles are Practical: A Paradigm for Designing Efficient Protocols by M. Bellare and P. Rogaway Random Oracles 2 Random oracle is a formalism to
arxiv: v2 [quant-ph] 20 Jan 2012
![arxiv: v2 [quant-ph] 20 Jan 2012](/thumbs/73/68228497.jpg "arxiv: v2 [quant-ph] 20 Jan 2012")
Random Oracles in a Quantum World Dan Boneh 1, Özgür Dagdelen2, Marc Fischlin 2, Anja Lehmann 3, Christian Schaffner 4, and Mark Zhandry 1 arxiv:1008.0931v2 [quant-ph] 20 Jan 2012 1 Stanford University,
CRYPTOGRAPHY IN THE AGE OF QUANTUM COMPUTERS
CRYPTOGRAPHY IN THE AGE OF QUANTUM COMPUTERS A DISSERTATION SUBMITTED TO THE DEPARTMENT OF COMPUTER SCIENCE AND THE COMMITTEE ON GRADUATE STUDIES OF STANFORD UNIVERSITY IN PARTIAL FULFILLMENT OF THE REQUIREMENTS
Tighter Security Proofs for GPV-IBE in the Quantum Random Oracle Model. Shuichi Katsumata (The University of Tokyo /AIST) Takashi Yamakawa (NTT)
1 Tighter Security Proofs for GPV-IBE in the Quantum Random Oracle Model (The University of Tokyo /AIST) *Pronounced as Shuichi Katsumata (The University of Tokyo /AIST) Shota Yamada (AIST) Takashi Yamakawa
Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World. Dan Boneh and Mark Zhandry Stanford University
Secure Signatures and Chosen Ciphertext Security in a Quantu Coputing World Dan Boneh and Mark Zhandry Stanford University Classical Chosen Message Attack (CMA) σ = S(sk, ) signing key sk Classical CMA
Semantic Security and Indistinguishability in the Quantum World
Semantic Security and Indistinguishability in the Quantum World Tommaso Gagliardoni 1, Andreas Hülsing 2, Christian Schaffner 3 1 IBM Research, Swiss; TU Darmstadt, Germany 2 TU Eindhoven, The Netherlands
Secure Signatures and Chosen Ciphertext Security in a Post-Quantum World
Secure Signatures and Chosen Ciphertext Security in a Post-Quantum World Dan Boneh Mark Zhandry Stanford University {dabo,zhandry}@cs.stanford.edu Abstract We initiate the study of quantum-secure digital
How to Use Short Basis : Trapdoors for Hard Lattices and new Cryptographic Constructions
Presentation Article presentation, for the ENS Lattice Based Crypto Workgroup http://www.di.ens.fr/~pnguyen/lbc.html, 30 September 2009 How to Use Short Basis : Trapdoors for http://www.cc.gatech.edu/~cpeikert/pubs/trap_lattice.pdf
Uninstantiability of Full-Domain Hash
Uninstantiability of based on On the Generic Insecurity of, Crypto 05, joint work with Y.Dodis and R.Oliveira Krzysztof Pietrzak CWI Amsterdam June 3, 2008 Why talk about this old stuff? Why talk about
CPA-Security. Definition: A private-key encryption scheme
CPA-Security The CPA Indistinguishability Experiment PrivK cpa A,Π n : 1. A key k is generated by running Gen 1 n. 2. The adversary A is given input 1 n and oracle access to Enc k, and outputs a pair of
Post-Quantum Security of the Fujisaki-Okamoto (FO) and OAEP Transforms
Post-Quantum Security of the Fujisaki-Okamoto (FO) and OAEP Transforms Made by: Ehsan Ebrahimi Theory of Cryptography Conference, Beijing, China Oct. 31 - Nov. 3, 2016 Joint work with Dominique Unruh Motivation:
THE RANK METHOD AND APPLICATIONS TO POST- QUANTUM CRYPTOGRAPHY
THE RANK METHOD AND APPLICATIONS TO POST- QUANTUM CRYPTOGRAPHY Mark Zhandry - Stanford University Joint work with Dan Boneh Classical Cryptography Post-Quantum Cryptography All communication stays classical
1 Number Theory Basics
ECS 289M (Franklin), Winter 2010, Crypto Review 1 Number Theory Basics This section has some basic facts about number theory, mostly taken (or adapted) from Dan Boneh s number theory fact sheets for his
Lecture 16 Chiu Yuen Koo Nikolai Yakovenko. 1 Digital Signature Schemes. CMSC 858K Advanced Topics in Cryptography March 18, 2004
CMSC 858K Advanced Topics in Cryptography March 18, 2004 Lecturer: Jonathan Katz Lecture 16 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Digital Signature Schemes In this lecture, we introduce
Analysis of Random Oracle Instantiation Scenarios for OAEP and other Practical Schemes
Analysis of Random Oracle Instantiation Scenarios for OAEP and other Practical Schemes Alexandra Boldyreva 1 and Marc Fischlin 2 1 College of Computing, Georgia Institute of Technology, 801 Atlantic Drive,
Block Ciphers/Pseudorandom Permutations
Block Ciphers/Pseudorandom Permutations Definition: Pseudorandom Permutation is exactly the same as a Pseudorandom Function, except for every key k, F k must be a permutation and it must be indistinguishable
Notes for Lecture A can repeat step 3 as many times as it wishes. We will charge A one unit of time for every time it repeats step 3.
COS 533: Advanced Cryptography Lecture 2 (September 18, 2017) Lecturer: Mark Zhandry Princeton University Scribe: Mark Zhandry Notes for Lecture 2 1 Last Time Last time, we defined formally what an encryption
The Random Oracle Model and the Ideal Cipher Model are Equivalent
The Random Oracle Model and the Ideal Cipher Model are Equivalent Jean-ébastien Coron 1, Jacques Patarin 2, and Yannick eurin 2,3 (1) Univ. Luxembourg, (2) Univ. Versailles, (3)Orange Labs éminaire EN
On Post-Quantum Cryptography
On Post-Quantum Cryptography Ehsan Ebrahimi Quantum Cryptography Group University of Tartu, Estonia 15 March 2018 Information Security and Cryptography Group Seminar Post-Quantum Cryptography Users intend
Outline. Provable Security in the Computational Model. III Signatures. Public-Key Encryption. Outline. David Pointcheval.
Provable Security in the Computational Model III Signatures David Pointcheval Ecole normale supérieure, CNRS & INRI Public-Key Encryption Signatures 2 dvanced Security for Signature dvanced Security Notions
Notes for Lecture 16
COS 533: Advanced Cryptography Lecture 16 (11/13/2017) Lecturer: Mark Zhandry Princeton University Scribe: Boriana Gjura Notes for Lecture 16 1 Lattices (continued) 1.1 Last time. We defined lattices as
Extractable Perfectly One-way Functions
Extractable Perfectly One-way Functions Ran Canetti 1 and Ronny Ramzi Dakdouk 2 1 IBM T. J. Watson Research Center, Hawthorne, NY. canetti@watson.ibm.com 2 Yale University, New Haven, CT. dakdouk@cs.yale.edu
Revisiting Post-Quantum Fiat-Shamir
Revisiting Post-Quantum Fiat-Shamir Qipeng Liu, Mark Zhandry Princeton University, Princeton NJ 08544, USA Abstract. The Fiat-Shamir transformation is a useful approach to building non-interactive arguments
Post-quantum security models for authenticated encryption
Post-quantum security models for authenticated encryption Vladimir Soukharev David R. Cheriton School of Computer Science February 24, 2016 Introduction Bellare and Namprempre in 2008, have shown that
The Cramer-Shoup Cryptosystem
The Cramer-Shoup Cryptosystem Eileen Wagner October 22, 2014 1 / 28 The Cramer-Shoup system is an asymmetric key encryption algorithm, and was the first efficient scheme proven to be secure against adaptive
Post-quantum verifiable random functions from ring signatures
Post-quantum verifiable random functions from ring signatures Endre Abraham December 22, 2018 Abstract One of the greatest challenges on exchanging seemingly random nonces or data either on a trusted or
Digital Signature Schemes and the Random Oracle Model. A. Hülsing
Digital Signature Schemes and the Random Oracle Model A. Hülsing Today s goal Review provable security of in use signature schemes. (PKCS #1 v2.x) PAGE 1 Digital Signature Source: http://hari-cio-8a.blog.ugm.ac.id/files/2013/03/dsa.jpg
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model
A Generic Hybrid Encryption Construction in the Quantum Random Oracle Model Presented by: Angela Robinson Department of Mathematical Sciences, Florida Atlantic University April 4, 2018 Motivation Quantum-resistance
Quantum-secure symmetric-key cryptography based on Hidden Shifts
Quantum-secure symmetric-key cryptography based on Hidden Shifts Gorjan Alagic QMATH, Department of Mathematical Sciences University of Copenhagen Alexander Russell Department of Computer Science & Engineering
Provable Security in Symmetric Key Cryptography
Provable Security in Symmetric Key Cryptography Jooyoung Lee Faculty of Mathematics and Statistics, Sejong University July 5, 2012 Outline 1. Security Proof of Blockcipher-based Hash Functions K i E X
The Fiat Shamir Transformation in a Quantum World
The Fiat Shamir Transformation in a Quantum World Özgür Dagdelen, Marc Fischlin, and Tommaso Gagliardoni Technische Universität Darmstadt, Germany oezguer.dagdelen@cased.de, marc.fischlin@gmail.com, tommaso@gagliardoni.net
CTR mode of operation
CSA E0 235: Cryptography 13 March, 2015 Dr Arpita Patra CTR mode of operation Divya and Sabareesh 1 Overview In this lecture, we formally prove that the counter mode of operation is secure against chosen-plaintext
III. Pseudorandom functions & encryption
III. Pseudorandom functions & encryption Eavesdropping attacks not satisfactory security model - no security for multiple encryptions - does not cover practical attacks new and stronger security notion:
Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World
Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World Dan Boneh and Mark Zhandry Stanford University {dabo,zhandry}@cs.stanford.edu Abstract. We initiate the study of quantum-secure
The Fiat Shamir Transformation in a Quantum World
The Fiat Shamir Transformation in a Quantum World Özgür Dagdelen Marc Fischlin Tommaso Gagliardoni Technische Universität Darmstadt, Germany www.cryptoplexity.de oezguer.dagdelen @ cased.de marc.fischlin
Tightly-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model
Tightly-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model Tsunekazu Saito, Keita Xagawa, and Takashi Yamakawa NTT Secure Platform Laboratories 3-9-11, Midori-cho Musashino-shi, Tokyo
COS433/Math 473: Cryptography. Mark Zhandry Princeton University Spring 2017
COS433/Math 473: Cryptography Mark Zhandry Princeton University Spring 2017 Authenticated Encryption Syntax Syntax: Enc: K M à C Dec: K C à M { } Correctness: For all k K, m M, Dec(k, Enc(k,m) ) = m Unforgeability
Semantic Security of RSA. Semantic Security
Semantic Security of RSA Murat Kantarcioglu Semantic Security As before our goal is to come up with a public key system that protects against more than total break We want our system to be secure against
Lecture 5, CPA Secure Encryption from PRFs
CS 4501-6501 Topics in Cryptography 16 Feb 2018 Lecture 5, CPA Secure Encryption from PRFs Lecturer: Mohammad Mahmoody Scribe: J. Fu, D. Anderson, W. Chao, and Y. Yu 1 Review Ralling: CPA Security and
Lecture Summary. 2 Simplified Cramer-Shoup. CMSC 858K Advanced Topics in Cryptography February 26, Chiu Yuen Koo Nikolai Yakovenko
CMSC 858K Advanced Topics in Cryptography February 26, 2004 Lecturer: Jonathan Katz Lecture 10 Scribe(s): Jeffrey Blank Chiu Yuen Koo Nikolai Yakovenko 1 Summary We had previously begun to analyze the
Post-quantum Security of the CBC, CFB, OFB, CTR, and XTS Modes of Operation.
OFB, CTR, In CBC, Ehsan Ebrahimi Targhi, Gelo Noel Tabia, Dominique Unruh University of Tartu February 4, 2016 Table of contents In CBC 1 2 3 4 In CBC PRF under quantum 5 6 Being optimistic about the emergence
Models and analysis of security protocols 1st Semester Symmetric Encryption Lecture 5
Models and analysis of security protocols 1st Semester 2009-2010 Symmetric Encryption Lecture 5 Pascal Lafourcade Université Joseph Fourier, Verimag Master: September 29th 2009 1 / 60 Last Time (I) Security
Alain Passelègue Ecole Normale Supérieure Joint work with: Michel Abdalla (ENS), Fabrice Benhamouda (ENS), Kenneth G.
Alain Passelègue Ecole Normale Supérieure Joint work with: Michel Abdalla (ENS), Fabrice Benhamouda (ENS), Kenneth G. Paterson (RHUL) 26 mars 2014 Journées C2 Single-Key Attack on a cryptosystem F k F
6.892 Computing on Encrypted Data October 28, Lecture 7
6.892 Computing on Encrypted Data October 28, 2013 Lecture 7 Lecturer: Vinod Vaikuntanathan Scribe: Prashant Vasudevan 1 Garbled Circuits Picking up from the previous lecture, we start by defining a garbling
Lecture 1. Crypto Background
Lecture 1 Crypto Background This lecture Crypto background hash functions random oracle model digital signatures and applications Cryptographic Hash Functions Hash function takes a string of arbitrary
On Notions of Security for Deterministic Encryption, and Efficient Constructions without Random Oracles
A preliminary version of this paper appears in Advances in Cryptology - CRYPTO 2008, 28th Annual International Cryptology Conference, D. Wagner ed., LNCS, Springer, 2008. This is the full version. On Notions
Lecture 11: Hash Functions, Merkle-Damgaard, Random Oracle
CS 7880 Graduate Cryptography October 20, 2015 Lecture 11: Hash Functions, Merkle-Damgaard, Random Oracle Lecturer: Daniel Wichs Scribe: Tanay Mehta 1 Topics Covered Review Collision-Resistant Hash Functions
Lecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004
CMSC 858K Advanced Topics in Cryptography February 5, 2004 Lecturer: Jonathan Katz Lecture 4 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Summary The focus of this lecture is efficient public-key
An introduction to Hash functions
An introduction to Hash functions Anna Rimoldi eriscs - Universitée de la Méditerranée, Marseille Secondo Workshop di Crittografia BunnyTN 2011 A. Rimoldi (eriscs) Hash function 12 September 2011 1 / 27
Constrained Keys for Invertible Pseudorandom Functions
Constrained Keys or Invertible Pseudorandom Functions Dan Boneh, Sam Kim, and David J. Wu Stanord University {dabo,skim13,dwu4}@cs.stanord.edu Abstract A constrained pseudorandom unction (PRF) is a secure
On the CCA1-Security of Elgamal and Damgård s Elgamal
On the CCA1-Security of Elgamal and Damgård s Elgamal Cybernetica AS, Estonia Tallinn University, Estonia October 21, 2010 Outline I Motivation 1 Motivation 2 3 Motivation Three well-known security requirements
Q B (pk, sk) Gen x u M pk y Map pk (x) return [B(pk, y)? = x]. (m, s) A O h
![Q B (pk, sk) Gen x u M pk y Map pk (x) return [B(pk, y)? = x]. (m, s) A O h](/thumbs/89/100584859.jpg "Q B (pk, sk) Gen x u M pk y Map pk (x) return [B(pk, y)? = x]. (m, s) A O h")
MTAT.07.003 Cryptology II Spring 2012 / Exercise session?? / Example Solution Exercise (FRH in RO model). Show that the full domain hash signature is secure against existential forgeries in the random
Modern symmetric-key Encryption
Modern symmetric-key Encryption Citation I would like to thank Claude Crepeau for allowing me to use his slide from his crypto course to mount my course. Some of these slides are taken directly from his
Public Key Cryptography
Public Key Cryptography Ali El Kaafarani 1 Mathematical Institute 2 PQShield Ltd. 1 of 44 Outline 1 Public Key Encryption: security notions 2 RSA Encryption Scheme 2 of 44 Course main reference 3 of 44
SIS-based Signatures
Lattices and Homomorphic Encryption, Spring 2013 Instructors: Shai Halevi, Tal Malkin February 26, 2013 Basics We will use the following parameters: n, the security parameter. =poly(n). m 2n log s 2 n
Perfectly-Crafted Swiss Army Knives in Theory
Perfectly-Crafted Swiss Army Knives in Theory Workshop Hash Functions in Cryptology * supported by Emmy Noether Program German Research Foundation (DFG) Hash Functions as a Universal Tool collision resistance
Quantum-Secure Message Authentication Codes
Quantum-Secure Message Authentication Codes Dan Boneh and Mark Zhandry Stanford University {dabo,zhandry}@cs.stanford.edu Abstract. We construct the first Message Authentication Codes (MACs) that are existentially
From Fixed-Length Messages to Arbitrary-Length Messages Practical RSA Signature Padding Schemes
From Fixed-Length Messages to Arbitrary-Length Messages Practical RSA Signature Padding Schemes [Published in D. Naccache, Ed., Topics in Cryptology CT-RSA 2001, vol. 2020 of Lecture Notes in Computer
Secure and Practical Identity-Based Encryption
Secure and Practical Identity-Based Encryption David Naccache Groupe de Cyptographie, Deṕartement d Informatique École Normale Supérieure 45 rue d Ulm, 75005 Paris, France david.nacache@ens.fr Abstract.
Towards Tightly Secure Lattice Short Signature and Id-Based Encryption
Towards Tightly Secure Lattice Short Signature and Id-Based Encryption Xavier Boyen Qinyi Li QUT Asiacrypt 16 2016-12-06 1 / 19 Motivations 1. Short lattice signature with tight security reduction w/o
Lossy Trapdoor Functions and Their Applications
1 / 15 Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information
A Second Look at s Transforma3on
A Second Look at s Transforma3on - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Özgür Dagdelen Technische Universität Darmstadt Daniele Venturi Sapienza University
Randomness-Dependent Message Security
Randomness-Dependent Message Security Eleanor Birrell Kai-Min Chung Rafael Pass Sidharth Telang December 28, 2012 Abstract Traditional definitions of the security of encryption schemes assume that the
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security
Lecture 17 - Diffie-Hellman key exchange, pairing, Identity-Based Encryption and Forward Security Boaz Barak November 21, 2007 Cyclic groups and discrete log A group G is cyclic if there exists a generator
arxiv: v1 [quant-ph] 28 Apr 2014
![arxiv: v1 [quant-ph] 28 Apr 2014](/thumbs/77/76625244.jpg "arxiv: v1 [quant-ph] 28 Apr 2014")
Quantum Attacks on Classical Proof Systems The Hardness of Quantum Rewinding Andris Ambainis University of Latvia and nstitute for Advanced Study Princeton Ansis Rosmanis nstitute for Quantum Computing
OAEP Reconsidered. Victor Shoup. IBM Zurich Research Lab, Säumerstr. 4, 8803 Rüschlikon, Switzerland
OAEP Reconsidered Victor Shoup IBM Zurich Research Lab, Säumerstr. 4, 8803 Rüschlikon, Switzerland sho@zurich.ibm.com February 13, 2001 Abstract The OAEP encryption scheme was introduced by Bellare and
Provable security. Michel Abdalla
Lecture 1: Provable security Michel Abdalla École normale supérieure & CNRS Cryptography Main goal: Enable secure communication in the presence of adversaries Adversary Sender 10110 10110 Receiver Only
Available online at J. Math. Comput. Sci. 6 (2016), No. 3, ISSN:
Available online at http://scik.org J. Math. Comput. Sci. 6 (2016), No. 3, 281-289 ISSN: 1927-5307 AN ID-BASED KEY-EXPOSURE FREE CHAMELEON HASHING UNDER SCHNORR SIGNATURE TEJESHWARI THAKUR, BIRENDRA KUMAR
f (x) f (x) easy easy
A General Construction of IND-CCA2 Secure Public Key Encryption? Eike Kiltz 1 and John Malone-Lee 2 1 Lehrstuhl Mathematik & Informatik, Fakultat fur Mathematik, Ruhr-Universitat Bochum, Germany. URL:
Lecture 10 - MAC s continued, hash & MAC
Lecture 10 - MAC s continued, hash & MAC Boaz Barak March 3, 2010 Reading: Boneh-Shoup chapters 7,8 The field GF(2 n ). A field F is a set with a multiplication ( ) and addition operations that satisfy
A New Paradigm of Hybrid Encryption Scheme
A New Paradigm of Hybrid Encryption Scheme Kaoru Kurosawa 1 and Yvo Desmedt 2 1 Ibaraki University, Japan kurosawa@cis.ibaraki.ac.jp 2 Dept. of Computer Science, University College London, UK, and Florida
From 5-pass MQ-based identification to MQ-based signatures
From 5-pass MQ-based identification to MQ-based signatures Andreas Hülsing, Joost Rijneveld, Simona Samardjiska, and Peter Schwabe 30 June 2016 1 / 31 Our take on PQ-Crypto Prepare for actual use Reliable
Symmetric Encryption
1 Symmetric Encryption Mike Reiter Based on Chapter 5 of Bellare and Rogaway, Introduction to Modern Cryptography. Symmetric Encryption 2 A symmetric encryption scheme is a triple SE = K, E, D of efficiently
Quantum Collision-Finding in Non-Uniform Random Functions
Quantum Collision-Finding in Non-Uniform Random Functions Marko Balogh 1, Edward Eaton 2, and Fang Song 3 1 Department of Physics, Portland State University marko balogh@me.com 2 Department of Combinatorics
1 Cryptographic hash functions
CSCI 5440: Cryptography Lecture 6 The Chinese University of Hong Kong 23 February 2011 1 Cryptographic hash functions Last time we saw a construction of message authentication codes (MACs) for fixed-length
Provable-Security Approach begins with [GM82] Classical Approach. Practical Cryptography: Provable Security as a Tool for Protocol Design
![Provable-Security Approach begins with [GM82] Classical Approach. Practical Cryptography: Provable Security as a Tool for Protocol Design](/thumbs/72/66884306.jpg "Provable-Security Approach begins with [GM82] Classical Approach. Practical Cryptography: Provable Security as a Tool for Protocol Design")
Practical Cryptography: Provable Security as a Tool for Protocol Design Phillip Rogaway UC Davis & Chiang Mai Univ rogaway@csucdavisedu http://wwwcsucdavisedu/~rogaway Summer School on Foundations of Internet
Practical Verifiable Encryption and Decryption of Discrete Logarithms
Practical Verifiable Encryption and Decryption of Discrete Logarithms Jan Camenisch IBM Zurich Research Lab Victor Shoup New York University p.1/27 Verifiable encryption of discrete logs Three players:
Inaccessible Entropy and its Applications. 1 Review: Psedorandom Generators from One-Way Functions
Columbia University - Crypto Reading Group Apr 27, 2011 Inaccessible Entropy and its Applications Igor Carboni Oliveira We summarize the constructions of PRGs from OWFs discussed so far and introduce the
Non-interactive zero-knowledge proofs in the quantum random oracle model
Non-interactive zero-knowledge proofs in the quantum random oracle model Dominique Unruh University of Tartu Abstract. We present a construction for non-interactive zero-knowledge proofs of knowledge in
Technische Universität München (I7) Winter 2013/14 Dr. M. Luttenberger / M. Schlund SOLUTION. Cryptography Endterm
Technische Universität München (I7) Winter 2013/14 Dr. M. Luttenberger / M. Schlund SOLUTION Cryptography Endterm Exercise 1 One Liners 1.5P each = 12P For each of the following statements, state if it
Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange
Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange Nina Bindel 1 Jacqueline Brendel 1 Marc Fischlin 1 Brian Goncalves 2 Douglas Stebila 3 1 Technische Universität Darmstadt, Darmstadt,
New Notions of Security: Universal Composability without Trusted Setup
New Notions of Security: Universal Composability without Trusted Setup Manoj Prabhakaran & Amit Sahai Princeton University To appear in STOC 04 Defining Security Central Problem in Cryptography Understanding
Practice Exam Winter 2018, CS 485/585 Crypto March 14, 2018
Practice Exam Name: Winter 2018, CS 485/585 Crypto March 14, 2018 Portland State University Prof. Fang Song Instructions This exam contains 8 pages (including this cover page) and 5 questions. Total of
Adaptive partitioning. Dennis Hofheinz (KIT, Karlsruhe)
Adaptive partitioning Dennis Hofheinz (KIT, Karlsruhe) Public-Key Encryption Public-Key Encryption Accepted security notion: chosen-ciphertext security (IND-CCA) Public-Key Encryption Accepted security
Universal Samplers with Fast Verification
Universal Samplers with Fast Verification Venkata Koppula University of Texas at Austin kvenkata@csutexasedu Brent Waters University of Texas at Austin bwaters@csutexasedu January 9, 2017 Andrew Poelstra
From Fixed-Length to Arbitrary-Length RSA Encoding Schemes Revisited
From Fixed-Length to Arbitrary-Length RSA Encoding Schemes Revisited Julien Cathalo 1, Jean-Sébastien Coron 2, and David Naccache 2,3 1 UCL Crypto Group Place du Levant 3, Louvain-la-Neuve, B-1348, Belgium
Authentication. Chapter Message Authentication
Chapter 5 Authentication 5.1 Message Authentication Suppose Bob receives a message addressed from Alice. How does Bob ensure that the message received is the same as the message sent by Alice? For example,
Hash-based signatures & Hash-and-sign without collision-resistance
Hash-based signatures & Hash-and-sign without collision-resistance Andreas Hülsing 22.12.2016 Hash-based Signature Schemes [Mer89] Post quantum Only secure hash function Security well understood Fast 22-12-2016
Block ciphers And modes of operation. Table of contents
Block ciphers And modes of operation Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction Pseudorandom permutations Block Ciphers Modes of Operation
RSA OAEP is Secure under the RSA Assumption
RSA OAEP is Secure under the RSA Assumption Eiichiro Fujisaki 1, Tatsuaki Okamoto 1, David Pointcheval 2, and Jacques Stern 2 1 NTT Labs, 1-1 Hikarino-oka, Yokosuka-shi, 239-0847 Japan. E-mail: {fujisaki,okamoto}@isl.ntt.co.jp.
CS 4770: Cryptography. CS 6750: Cryptography and Communication Security. Alina Oprea Associate Professor, CCIS Northeastern University
CS 4770: Cryptography CS 6750: Cryptography and Communication Security Alina Oprea Associate Professor, CCIS Northeastern University March 26 2017 Outline RSA encryption in practice Transform RSA trapdoor
A Group Signature Scheme from Lattice Assumptions
A Group Signature Scheme from Lattice Assumptions S. Dov Gordon Jonathan Katz Vinod Vaikuntanathan Abstract Group signature schemes allow users to sign messages on behalf of a group while (1) maintaining
Lecture 14 - CCA Security
Lecture 14 - CCA Security Boaz Barak November 7, 2007 Key exchange Suppose we have following situation: Alice wants to buy something from the well known website Bob.com Since they will exchange private