National Institute of Standards and Technology における超伝導研究及び生活

Smart grids equipped with bi-directional communication flow are expected to provide more sophisticated consumption monitoring and energy trading. However, the issues related to the security and privacy of consumption and trading data present serious challenges. In this paper we address the problem of providing transaction security in decentralized smart grid energy trading without reliance on trusted third parties. We have implemented a proof-of-concept for decentralized energy trading system using blockchain technology, multi-signatures, and anonymous encrypted messaging streams, enabling peers to anonymously negotiate energy prices and securely perform trading transactions. We conducted case studies to perform security analysis and performance evaluation within the context of the elicited security and privacy requirements.

Security and Privacy in Decentralized Energy Trading Through Multi-Signatures, Blockchain and Anonymous Messaging Streams

An Introduction to Probability Theory and its Applications, Volume I

Along with the rapid development and wide application of information technology, human society is entering the information era. In this era, people live and work in cyberspace, which is a collection of all infor-mation systems, and the information environment for human survival. Therefore, ensuring cyberspace security is necessary. This paper provides a comprehensive introduction to the research and development, existing prob-lems, and some popular research topics on the cyberspace concept, cyberspace security discipline, cryptography, network security, information system security, and information content security.

Survey on cyberspace security

In this paper, we improve the recent rebound and start-from-the-middle attacks on AES-like permutations. Our new cryptanalysis technique uses the fact that one can view two rounds of such permutations as a layer of big Sboxes preceded and followed by simple affine transformations. The big Sboxes encountered in this alternative representation are named Super-Sboxes. We apply this method to two second-round SHA-3 candidates Grostl and ECHO, and obtain improvements over the previous cryptanalysis results for these two schemes. Moreover, we improve the best distinguisher for the AES block cipher in the known-key setting, reaching 8 rounds for the 128-bit version.

/pdf/super-sbox-cryptanalysis-improved-attacks-for-aes-like-1k7vnzhy4x.pdf

Super-Sbox cryptanalysis: improved attacks for AES-like permutations

In this article, we provide the first third-party security analysis of the PRINCE lightweight block cipher, and the underlying \(\mathtt{PRINCE}_{core}\). First, while no claim was made by the authors regarding related-key attacks, we show that one can attack the full cipher with only a single pair of related keys, and then reuse the same idea to derive an attack in the single-key model for the full \(\mathtt{PRINCE}_{core}\) for several instances of the \(\alpha \) parameter (yet not the one randomly chosen by the designers). We also show how to exploit the structural linear relations that exist for PRINCE in order to obtain a key recovery attack that slightly breaks the security claims for the full cipher. We analyze the application of integral attacks to get the best known key-recovery attack on a reduced version of the PRINCE cipher. Finally, we provide time-memory-data tradeoffs that require only known plaintext-ciphertext data and that can be applied to full PRINCE.

/pdf/security-analysis-of-prince-2bb33m23u1.pdf

Security Analysis of PRINCE

In this paper we present known-plaintext single-key and chosen-key attacks on round-reduced LED-64 and LED-128. We show that with an application of the recently proposed slidex attacks (5), one imme- diately improves the complexity of the previous single-key 4-step attack on LED-128. Further, we explore the possibility of multicollisions and show single-key attacks on 6 steps of LED-128. A generalization of our multicollision attack leads to the statement that no 6-round cipher with two subkeys that alternate, or 2-round cipher with linearly dependent subkeys, is secure in the single-key model. Next, we exploit the possibil- ity of finding pairs of inputs that follow a certain differential rather than a differential characteristic, and obtain chosen-key differential distinguish- ers for 5-step LED-64 ,a s well as 8-step and 9-stepLED-128. We provide examples of inputs that follow the 8-step differential, i.e. we are able to practically confirm our results on 2/3 of the steps of LED-128 .W e intro- duce a new type of chosen-key differential distinguisher, called random- difference distinguisher, and successfully penetrate 10 of the total 12 steps of LED-128. We show that this type of attack is generic in the chosen-key model, and can be applied to any 10-round cipher with two alternating subkeys.

/pdf/cryptanalysis-of-round-reduced-led-1ifuk44h2y.pdf

Cryptanalysis of Round-Reduced LED

In this paper, improved cryptanalyses for the ISO standard hash function Whirlpool are presented with respect to the fundamental security notions. While a subspace distinguisher was presented on full version (10 rounds) of the compression function, its impact to the security of the hash function seems limited. In this paper, we discuss the (second) preimage and collision attacks for the hash function and the compression function of Whirlpool. Regarding the preimage attack, 6 rounds of the hash function are attacked with 2481 computations while the previous best attack is for 5 rounds with 2481.5 computations. Regarding the collision attack, 8 rounds of the compression function are attacked with 2120 computations, while the previous best attack is for 7 rounds with 2184 computations. To verify the correctness, especially for the rebound attack on the Sbox with an unbalanced Differential Distribution Table (DDT), the attack is partially implemented, and the differences from attacking the Sbox with balanced DDT are reported.

/pdf/investigating-fundamental-security-requirements-on-whirlpool-3gkrcqnktj.pdf

Investigating fundamental security requirements on whirlpool: improved preimage and collision attacks

The Grostl hash function is one of the 5 final round candidates of the SHA-3 competition hosted by NIST. In this paper, we study the preimage resistance of the Grostl hash function. We propose pseudo preimage attacks on Grostl hash function for both 256-bit and 512-bit versions, i.e., we need to choose the initial value in order to invert the hash function. Pseudo preimage attack on 5(out of 10)-round Grostl-256 has a complexity of (2244.85,2230.13) (in time and memory) and pseudo preimage attack on 8(out of 14)-round Grostl-512 has a complexity of (2507.32,2507.00). To the best of our knowledge, our attacks are the first (pseudo) preimage attacks on round-reduced Grostl hash function, including its compression function and output transformation. These results are obtained by a variant of meet-in-the-middle preimage attack framework by Aoki and Sasaki. We also improve the time complexities of the preimage attacks against 5-round Whirlpool and 7-round AES hashes by Sasaki in FSE 2011.

/pdf/pseudo-preimage-attack-on-round-reduced-grostl-hash-function-3wxwqd7w6y.pdf

(Pseudo) preimage attack on round-reduced grøstl hash function and others

In this paper, we propose a new lightweight hash function supporting three different digest sizes: 80, 96 and 128 bits, providing preimage security from 64 to 120 bits, second preimage and collision security from 40 to 60 bits LHash requires about 817 GE and 1028 GE with a serialized implementation In faster implementations based on function \(T\), LHash requires 989 GE and 1200 GE with 54 and 72 cycles per block, respectively Furthermore, its energy consumption evaluated by energy per bit is also remarkable LHash allows to make trade-offs among security, speed, energy consumption and implementation costs by adjusting parameters The design of LHash employs a kind of Feistel-PG structure in the internal permutation, and this structure can utilize permutation layers on nibbles to improve the diffusion speed The adaptability of LHash in different environments is good, since different versions of LHash share the same basic computing module The low-area implementation comes from the hardware-friendly S-box and linear diffusion layer We evaluate the resistance of LHash against known attacks and confirm that LHash provides a good security margin

Shuang Wu

Papers

Security Analysis of PRINCE

Cryptanalysis of Round-Reduced LED

Investigating fundamental security requirements on whirlpool: improved preimage and collision attacks

(Pseudo) preimage attack on round-reduced grøstl hash function and others

LHash: A Lightweight Hash Function