The objective of this paper is to give a comprehensive introduction to applied cryptography with an engineer or computer scientist in mind. The emphasis is on the knowledge needed to create practical systems which supports integrity, confidentiality, or authenticity. Topics covered includes an introduction to the concepts in cryptography, attacks against cryptographic systems, key use and handling, random bit generation, encryption modes, and message authentication codes. Recommendations on algorithms and further reading is given in the end of the paper. This paper should make the reader able to build, understand and evaluate system descriptions and designs based on the cryptographic components described in the paper.

[서평]「Applied Cryptography」

We provide formal definitions and efficient secure techniques for 


turning biometric information into keys usable for any cryptographic application, and


reliably and securely authenticating biometric data.

/pdf/fuzzy-extractors-how-to-generate-strong-keys-from-biometrics-3ft5jjgesl.pdf

Fuzzy extractors: How to generate strong keys from biometrics and other noisy data

We provide formal definitions and efficient secure techniques for turning noisy information into keys usable for any cryptographic application, and, in particular, reliably and securely authenticating biometric data. Our techniques apply not just to biometric information, but to any keying material that, unlike traditional cryptographic keys, is (1) not reproducible precisely and (2) not distributed uniformly. We propose two primitives: a fuzzy extractor reliably extracts nearly uniform randomness $R$ from its input; the extraction is error-tolerant in the sense that $R$ will be the same even if the input changes, as long as it remains reasonably close to the original. Thus, $R$ can be used as a key in a cryptographic application. A secure sketch produces public information about its input $w$ that does not reveal $w$ and yet allows exact recovery of $w$ given another value that is close to $w$. Thus, it can be used to reliably reproduce error-prone biometric inputs without incurring the security risk inherent in storing them. We define the primitives to be both formally secure and versatile, generalizing much prior work. In addition, we provide nearly optimal constructions of both primitives for various measures of “closeness” of input data, such as Hamming distance, edit distance, and set difference.

/pdf/fuzzy-extractors-how-to-generate-strong-keys-from-biometrics-3jizcwtwjh.pdf

Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data

An adaptive interface for a programmable system, for predicting a desired user function, based on user history, as well as machine internal status and context. The apparatus receives an input from the user and other data. A predicted input is presented for confirmation by the user, and the predictive mechanism is updated based on this feedback. Also provided is a pattern recognition system for a multimedia device, wherein a user input is matched to a video stream on a conceptual basis, allowing inexact programming of a multimedia device. The system analyzes a data stream for correspondence with a data pattern for processing and storage. The data stream is subjected to adaptive pattern recognition to extract features of interest to provide a highly compressed representation that may be efficiently processed to determine correspondence. Applications of the interface and system include a video cassette recorder (VCR), medical device, vehicle control system, audio device, environmental control system, securities trading terminal, and smart house. The system optionally includes an actuator for effecting the environment of operation, allowing closed-loop feedback operation and automated learning.

Adaptive pattern recognition based control system and method

The invention provides a method, system, and computer program product to control the access, copying, and/or transfer of a digital asset by mobile, wireless devices using a digital voucher. The digital voucher references a primary content that contains all of the expression for that particular asset and a secondary content that contains information that can be distilled out as a preview. The information in the primary content can be limited to a specified duration or a specific number of viewings. The author, owner, or possessor of the digital asset specifies the terms and conditions for distribution of the digital asset. The digital voucher authorizes the mobile, wireless device to access a specified primary or secondary content that may be located elsewhere in the network. The mobile, wireless device can download a copy of portions or all of the content depending on the terms specified in the voucher.

Digital rights management in a mobile communications environment

Data such as a musical track is stored as a secure portable track (SPT) which can be bound to one or more players and can be bound to a particular storage medium, restricting playback of the SPT to the specific players and ensuring that playback is only from the original storage medium. The SPT is bound to a player by encrypting data of the SPT using a storage key which is unique to the player, is difficult to change, and is held in strict secrecy by the player. The SPT is bound to a particular storage medium by including data uniquely identifying the storage medium in a tamper-resistant form, e.g., cryptographically signed. The SPT can also be bound to the storage medium by embedding cryptographic logic circuitry, e.g., integrate circuitry, in the packaging of the storage medium. The SPT is bound by encrypting an encryption key using the embedded logic. By using unique cryptographic logic, only that particular storage medium can decrypt the encryption key and, therefore, the data of the SPT encrypted with the encryption key. To allow a user to playback the SPT on a number of players, players can share storage keys with one another. Such key sharing is done in a cryptographically secure manner. Before downloading an SPT to a particular external player, the ability of the external player to enforce restrictions placed upon the SPT is verified.

Copy security for portable music players

We introduce the notion of key stretching, a mechanism to convert short s-bit keys into longer keys, such that the complexity required to brute-force search a s + t-bit keyspace is the same as the time required to brute-force search a s-bit key stretched by t bits.

Secure applications of low-entropy keys

We evaluate constructions for building pseudo-random functions (PRFs) from pseudo-random permutations (PRPs). We present two constructions: a slower construction which preserves the security of the PRP and a faster construction which has less security. One application of our construction is to build a wider block cipher given a block cipher as a building tool. We do not require any additional constructions—e.g. pseudo-random generators—to create the wider block cipher. The security of the resulting cipher will be as strong as the original block cipher.

/pdf/building-prfs-from-prps-30hihqurzx.pdf

Building PRFs from PRPs

We develop a new generic long-message second preimage attack, based on combining the techniques in the second preimage attacks of Dean [8] and Kelsey and Schneier [16] with the herding attack of Kelsey and Kohno [15]. We show that these generic attacks apply to hash functions using the Merkle-Damgard construction with only slightly more work than the previously known attack, but allow enormously more control of the contents of the second preimage found. Additionally, we show that our new attack applies to several hash function constructions which are not vulnerable to the previously known attack, including the dithered hash proposal of Rivest [25], Shoup's UOWHF[26] and the ROX hash construction [2].We analyze the properties of the dithering sequence used in [25], and develop a time-memory tradeoff which allows us to apply our second preimage attack to a wide range of dithering sequences, including sequences which are much stronger than those in Rivest's proposals. Finally, we show that both the existing second preimage attacks [8,16] and our new attack can be applied even more efficiently to multiple target messages; in general, given a set of many target messages with a total of 2R message blocks, these second preimage attacks can find a second preimage for one of those target messages with no more work than would be necessary to find a second preimage for a single target message of 2R message blocks.

/pdf/second-preimage-attacks-on-dithered-hash-functions-4r455lf63f.pdf

Second preimage attacks on dithered hash functions

/pdf/secure-applications-of-low-entropy-keys-4rhb2nc6wh.pdf

John Kelsey

Papers

Copy security for portable music players

Secure applications of low-entropy keys

Building PRFs from PRPs

Second preimage attacks on dithered hash functions

Secure Applications of Low-Entropy Keys