Cryptosystems I.- On Ideal Lattices and Learning with Errors over Rings.- Fully Homomorphic Encryption over the Integers.- Converting Pairing-Based Cryptosystems from Composite-Order Groups to Prime-Order Groups.- Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption.- Obfuscation and Side Channel Security.- Secure Obfuscation for Encrypted Signatures.- Public-Key Encryption in the Bounded-Retrieval Model.- Protecting Circuits from Leakage: the Computationally-Bounded and Noisy Cases.- 2-Party Protocols.- Partial Fairness in Secure Two-Party Computation.- Secure Message Transmission with Small Public Discussion.- On the Impossibility of Three-Move Blind Signature Schemes.- Efficient Device-Independent Quantum Key Distribution.- Cryptanalysis.- New Generic Algorithms for Hard Knapsacks.- Lattice Enumeration Using Extreme Pruning.- Algebraic Cryptanalysis of McEliece Variants with Compact Keys.- Key Recovery Attacks of Practical Complexity on AES-256 Variants with up to 10 Rounds.- IACR Distinguished Lecture.- Cryptography between Wonderland and Underland.- Automated Tools and Formal Methods.- Automatic Search for Related-Key Differential Characteristics in Byte-Oriented Block Ciphers: Application to AES, Camellia, Khazad and Others.- Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR.- Computational Soundness, Co-induction, and Encryption Cycles.- Models and Proofs.- Encryption Schemes Secure against Chosen-Ciphertext Selective Opening Attacks.- Cryptographic Agility and Its Relation to Circular Encryption.- Bounded Key-Dependent Message Security.- Multiparty Protocols.- Perfectly Secure Multiparty Computation and the Computational Overhead of Cryptography.- Adaptively Secure Broadcast.- Universally Composable Quantum Multi-party Computation.- Cryptosystems II.- A Simple BGN-Type Cryptosystem from LWE.- Bonsai Trees, or How to Delegate a Lattice Basis.- Efficient Lattice (H)IBE in the Standard Model.- Hash and MAC.- Multi-property-preserving Domain Extension Using Polynomial-Based Modes of Operation.- Stam's Collision Resistance Conjecture.- Universal One-Way Hash Functions via Inaccessible Entropy.- Foundational Primitives.- Constant-Round Non-malleable Commitments from Sub-exponential One-Way Functions.- Constructing Verifiable Random Functions with Large Input Spaces.- Adaptive Trapdoor Functions and Chosen-Ciphertext Security.

Advances in cryptology -- EUROCRYPT 2010 : 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30-June 3, 2010 : proceedings

We propose the TWEAKEY framework with goal to unify the design of tweakable block ciphers and of block ciphers resistant to related-key attacks. Our framework is simple, extends the key-alternating construction, and allows to build a primitive with arbitrary tweak and key sizes, given the public round permutation (for instance, the AES round). Increasing the sizes renders the security analysis very difficult and thus we identify a subclass of TWEAKEY, that we name STK, which solves the size issue by the use of finite field multiplications on low hamming weight constants. Overall, this construction allows a significant increase of security of well-known authenticated encryptions mode like ΘCB3 from birthday-bound security to full security, where a regular block cipher was used as a black box to build a tweakable block cipher. Our work can also be seen as advances on the topic of secure key schedule design.

/pdf/tweaks-and-keys-for-block-ciphers-the-tweakey-framework-pxe5ue8b59.pdf

Tweaks and Keys for Block Ciphers: The TWEAKEY Framework

Hash Function Cryptanalysis.- Security of MD5 Challenge and Response: Extension of APOP Password Recovery Attack.- Cryptanalysis of a Hash Function Based on Quasi-cyclic Codes.- Linear-XOR and Additive Checksums Don't Protect Damgard-Merkle Hashes from Generic Attacks.- Cryptographic Building Blocks.- Efficient Fully-Simulatable Oblivious Transfer.- Separation Results on the "One-More" Computational Problems.- Fairness in Secure Computation.- An Efficient Protocol for Fair Secure Two-Party Computation.- Efficient Optimistic Fair Exchange Secure in the Multi-user Setting and Chosen-Key Model without Random Oracles.- Legally-Enforceable Fairness in Secure Two-Party Computation.- Message Authentication Codes.- Security of NMAC and HMAC Based on Non-malleability.- Aggregate Message Authentication Codes.- Improved AES Implementations.- Boosting AES Performance on a Tiny Processor Core.- A Fast and Cache-Timing Resistant Implementation of the AES.- Public Key Encryption with Special Properties.- Identity-Based Threshold Key-Insulated Encryption without Random Oracles.- CCA2 Secure IBE: Standard Model Efficiency through Authenticated Symmetric Encryption.- Public-Key Encryption with Non-interactive Opening.- Side Channel Cryptanalysis.- A Vulnerability in RSA Implementations Due to Instruction Cache Analysis and Its Demonstration on OpenSSL.- Fault Analysis Study of IDEA.- Susceptibility of UHF RFID Tags to Electromagnetic Analysis.- Cryptography for Limited Devices.- Online/Offline Signature Schemes for Devices with Limited Computing Capabilities.- RFID Security: Tradeoffs between Security and Efficiency.- Invited Talk.- Program Obfuscation and One-Time Programs.- Key Exchange.- Efficient Two-Party Password-Based Key Exchange Protocols in the UC Framework.- Beyond Secret Handshakes: Affiliation-Hiding Authenticated Key Exchange.- Cryptanalysis.- Improving the Efficiency of Impossible Differential Cryptanalysis of Reduced Camellia and MISTY1.- Small Secret Key Attack on a Variant of RSA (Due to Takagi).- Cryptographic Protocols.- Super-Efficient Verification of Dynamic Outsourced Databases.- A Latency-Free Election Scheme.

Topics in Cryptology - CT-RSA 2008 : the Cryptographers' Track at the RSA Conference 2008 San Fancisco, CA, USA, April 8-11, 2008 : proceedings

Impossible differential cryptanalysis has shown to be a very powerful form of cryptanalysis against block ciphers. These attacks, even if extensively used, remain not fully understood because of their high technicality. Indeed, numerous are the applications where mistakes have been discovered or where the attacks lack optimality. This paper aims in a first step at formalizing and improving this type of attacks and in a second step at applying our work to block ciphers based on the Feistel construction. In this context, we derive generic complexity analysis formulas for mounting such attacks and develop new ideas for optimizing impossible differential cryptanalysis. These ideas include for example the testing of parts of the internal state for reducing the number of involved key bits. We also develop in a more general way the concept of using multiple differential paths, an idea introduced before in a more restrained context. These advances lead to the improvement of previous attacks against well known ciphers such as CLEFIA-128 and Camellia, while also to new attacks against 23-round LBlock and all members of the Simon family.

/pdf/scrutinizing-and-improving-impossible-differential-attacks-5aukigi9sa.pdf

Scrutinizing and Improving Impossible Differential Attacks: Applications to CLEFIA, Camellia, LBlock and Simon

/pdf/scrutinizing-and-improving-impossible-differential-attacks-zrkoz5x75b.pdf

Scrutinizing and Improving Impossible Differential Attacks: Applications to CLEFIA, Camellia, LBlock and Simon (Full Version)

This paper focuses on key-recovery attacks on 9-round AES-192 and AES-256 under single-key model with the framework of the meet-in-the-middle attack. A new technique named key-dependent sieve is introduced to further reduce the size of lookup table of the attack, and the 9-round AES-192 is broken with \(2^{121}\) chosen plaintexts, \(2^{187.5}\) 9-round encryptions and \(2^{185}\) 128-bit words of memory. If the attack starts from the third round, the complexities would be further reduced by a factor of 16. Moreover, the whole attack is split up into a series of weak-key attacks. Then the memory complexity of the attack is saved significantly when we execute these weak attacks in streaming mode. This method is also applied to reduce the memory complexity of the attack on 9-round AES-256.

/pdf/improved-single-key-attacks-on-9-round-aes-192-256-1u1331grv2.pdf

Improved Single-Key Attacks on 9-Round AES-192/256

Camellia is one of the widely used block ciphers, which has been selected as an international standard by ISO/IEC. In this paper, by exploiting some interesting properties of the key-dependent layer, we improve previous results on impossible differential cryptanalysis of reduced-round Camellia and gain some new observations. First, we introduce some new 7-round impossible differentials of Camellia for weak keys. These weak keys that work for the impossible differential take 3/4 of the whole key space, therefore, we further get rid of the weak-key assumption and leverage the attacks on reduced-round Camellia to all keys by utilizing the multiplied method. Second, we build a set of differentials which contains at least one 8-round impossible differential of Camellia with two FL/FL−1 layers. Following this new result, we show that the key-dependent transformations inserted in Camellia cannot resist impossible differential cryptanalysis effectively. Based on this set of differentials, we present a new cryptanalytic strategy to mount impossible differential attacks on reduced-round Camellia.

/pdf/new-observations-on-impossible-differential-cryptanalysis-of-of959k5vui.pdf

New observations on impossible differential cryptanalysis of reduced-round camellia

Camellia is one of the most worldwide used block ciphers, which has been selected as a standard by ISO/IEC. In this paper, we propose several new 7-round impossible differentials of Camellia with 2 FL/FL−1 layers, which turn out to be the first 7-round impossible differentials with 2 FL/FL−1 layers. Combined with some basic techniques including the early abort approach and the key schedule consideration, we achieve the impossible differential attacks on 11-round Camellia-128, 11-round Camellia-192, 12-round Camellia-192, and 14-round Camellia-256, and the time complexity are 2123.8, 2121.7, 2171.4 and 2238.3 respectively. As far as we know, these are the best results against the reduced-round variants of Camellia. Especially, we give the first attack on 11-round Camellia-128 reduced version with FL/FL−1 layers.

New impossible differential attacks on camellia

This paper studies key-recovery attacks on AES-192 and PRINCE under single-key model by methodology of meet-in-the-middle attack. A new technique named key-dependent sieve is proposed to further reduce the memory complexity of Demirci et al.’s attack at EUROCRYPT 2013, which helps us to achieve 9-round attack on AES-192 by using a 5-round distinguisher; the data, time and memory complexities are 2 chosen plaintexts, 2 encryptions and 2 128bit memories, respectively. The new technique is also applied to attack block cipher PRINCE. Instead of 6-round results in the previous cryptanalysis, we first present attacks on 8-round (out of 12) PRINCEcore and PRINCE with about 2 and 2 encryptions, respectively. Furthermore, we construct an interesting 7-round distinguisher and extend the attack to 9-round PRINCE; the attack needs about 2 chosen plaintexts, 2 encryptions and 2 64-bit memories.

/pdf/improved-meet-in-the-middle-attacks-on-aes-192-and-prince-4rhjxk2uis.pdf

Improved Meet-in-the-Middle Attacks on AES-192 and PRINCE.

As one of the generalizations of differential cryptanalysis, the truncated differential cryptanalysis has become a powerful toolkit to evaluate the security of block ciphers. In this article, taking advantage of the meet-in-the-middle like technique, we introduce a new method to construct truncated differential characteristics of block ciphers. Based on the method, we propose 10-round and 8-round truncated differential characteristics for CLEFIA and Camellia, respectively, which are ISO standard block ciphers. Applying the 10-round truncated differential characteristic for CLEFIA, we launch attacks on 14/14/15-round CLEFIA-128/192/256 with \(2^{108}\), \(2^{135}\) and \(2^{203}\) encryptions, respectively. For Camellia, we utilize the 8-round truncated differential to attack 11/12-round Camellia-128/192 including the \(FL/FL^{-1}\) and whiten layers with \(2^{121.3}\) and \(2^{185.3}\) encryptions. As far as we know, most of the cases are the best results of these attacks on both ciphers.

/pdf/meet-in-the-middle-technique-for-truncated-differential-and-27tpl1vet7.pdf

Leibo Li

Papers

Improved Single-Key Attacks on 9-Round AES-192/256

New observations on impossible differential cryptanalysis of reduced-round camellia

New impossible differential attacks on camellia

Improved Meet-in-the-Middle Attacks on AES-192 and PRINCE.

Meet-in-the-Middle Technique for Truncated Differential and Its Applications to CLEFIA and Camellia