There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

National Institute of Standards and Technology における超伝導研究及び生活

An important open problem in the area of Traitor Tracing is designing a scheme with constant expansion of the size of keys (users' keys and the encryption key) and of the size of ciphertexts with respect to the size of the plaintext. This problem is known from the introduction of Traitor Tracing by Chor, Fiat and Naor. We refer to such schemes as traitor tracing with constant transmission rate. Here we present a general methodology and two protocol constructions that result in the first two public-key traitor tracing schemes with constant transmission rate in settings where plaintexts can be calibrated to be sufficiently large. Our starting point is the notion of copyrighted function which was presented by Naccache, Shamir and Stern. We first solve the open problem of discrete-log-based and public-key-based copyrighted function. Then, we observe the simple yet crucial relation between (public-key) copyrighted encryption and (public-key) traitor tracing, which we exploit by introducing a generic design paradigm for designing constant transmission rate traitor tracing schemes based on copyrighted encryption functions. Our first scheme achieves the same expansion efficiency as regular ElGamal encryption. The second scheme introduces only a slightly larger (constant) overhead, however, it additionally achieves efficient black-box traitor tracing (against any pirate construction).

Traitor Tracing with constant transmission rate

RFID security is currently one of the major challenges cryptography has to face, often solved by protocols assuming that an ontag hash function is available. In this article we present the PHOTON lightweight hash-function family, available in many different flavors and suitable for extremely constrained devices such as passive RFID tags. Our proposal uses a sponge-like construction as domain extension algorithm and an AES-like primitive as internal unkeyed permutation. This allows us to obtain the most compact hash function known so far (about 1120 GE for 64-bit collision resistance security), reaching areas very close to the theoretical optimum (derived from the minimal internal state memory size). Moreover, the speed achieved by PHOTON also compares quite favorably to its competitors. This is mostly due to the fact that unlike for previously proposed schemes, our proposal is very simple to analyze and one can derive tight AES-like bounds on the number of active Sboxes. This kind of AES-like primitive is usually not well suited for ultra constrained environments, but we describe in this paper a new method for generating the column mixing layer in a serial way, lowering drastically the area required. Finally, we slightly extend the sponge framework in order to offer interesting trade-offs between speed and preimage security for small messages, the classical use-case in hardware.

/pdf/the-photon-family-of-lightweight-hash-functions-3uam81b18v.pdf

The PHOTON family of lightweight Hash functions

Suppose we are given a perfect n+ c-to-nbit compression function fand we want to construct a larger m+ s-to-sbit compression function Hinstead. What level of security, in particular collision resistance, can we expect from Hif it makes rcalls to f? We conjecture that typically collisions can be found in 2(nr+ cri¾? m)/(r+ 1)queries. This bound is also relevant for building a m+ s-to-sbit compression function based on a blockcipher with k-bit keys and n-bit blocks: simply set c= k, or c= 0 in case of fixed keys.

We also exhibit a number of (conceptual) compression functions whose collision resistance is close to this bound. In particular, we consider the following four scenarios: 1 A 2n-to-nbit compression function making two calls to an n-to-nbit primitive, providing collision resistance up to 2n/3/nqueries. This beats a recent bound by Rogaway and Steinberger that 2n/4queries to the underlying random n-to-nbit function suffice to find collisions in any rate-1/2 compression function. In particular, this shows that Rogaway and Steinberger's recent bound of 2(nri¾? mi¾? s/2)/r)queries (for c= 0) crucially relies upon a uniformity assumption; a blanket generalization to arbitrary compression functions would be incorrect.
 1 A 3n-to-2nbit compression function making a single call to a 3n-to-nbit primitive, providing collision resistance up to 2nqueries.
 1 A 3n-to-2nbit compression function making two calls to a 2n-to-nbit primitive, providing collision resistance up to 2nqueries.
 1 A single call compression function with parameters satisfying m≤ n+ c, n≤ s, c≤ m. This result provides a tradeoff between how many bits you can compress for what level of security given a single call to an n+ c-to-nbit random function.

/pdf/beyond-uniformity-better-security-efficiency-tradeoffs-for-1tbtt7yeep.pdf

Beyond Uniformity: Better Security/Efficiency Tradeoffs for Compression Functions

This paper presents Gimli, a 384-bit permutation designed to achieve high security with high performance across a broad range of platforms, including 64-bit Intel/AMD server CPUs, 64-bit and 32-bit ARM smartphone CPUs, 32-bit ARM microcontrollers, 8-bit AVR microcontrollers, FPGAs, ASICs without side-channel protection, and ASICs with side-channel protection.

/pdf/gimli-a-cross-platform-permutation-g0kuljcz1k.pdf

Gimli : A Cross-Platform Permutation

We provide a proof of security for a huge class of double block length hash function that we will call Cyclic-DM . Using this result, we are able to give a collision resistance bound for Abreast-DM , one of the oldest and most well-known constructions for turning a block cipher with n -bit block length and 2n -bit key length into a 2n -bit cryptographic hash function. In particular, we show that when Abreast-DM is instantiated using a block cipher with 128-bit block length and 256-bit key length, any adversary that asks less than 2124.42 queries cannot find a collision with success probability greater than 1/2. Surprisingly, this about 15 years old construction is one of the few constructions that have the desirable feature of a near-optimal collision resistance guarantee.

We are also able to derive several DBL constructions that lead to compression functions offering an even higher security guarantee and more efficiency than Abreast-DM (e.g. share a common key). Furthermore we give a practical DBL construction that has the highest security guarantee of all DBL compression functions currently known in literature. We also provide a (relatively weak) analysis of preimage resistance for Cyclic-DM .

Security of Cyclic Double Block Length Hash Functions

We provide the first proof of security for Tandem-DM, one of the oldest and most well-known constructions for turning a block cipher with n-bit block length and 2n-bit key length into a 2n-bit cryptographic hash function. We prove, that when Tandem-DM is instantiated with AES-256, block length 128 bits and key length 256 bits, any adversary that asks less than 2120.4 queries cannot find a collision with success probability greater than 1/2. We also prove a bound for preimage resistance of Tandem-DM.

Interestingly, as there is only one practical construction known turning such an (n,2n) bit block cipher into a 2n-bit compression function that has provably birthday-type collision resistance (FSE'06, Hirose), Tandem-DM is one out of two constructions that has this desirable feature.

/pdf/on-the-security-of-tandem-dm-29hg1heclh.pdf

On the Security of Tandem-DM

This paper proposes a construction for collision resistant $2n$-bit hash functions, based on $n$-bit block ciphers with $2n$-bit keys. The construction is analysed in the ideal cipher model; for $n=128$ an adversary would need roughly $2^{122}$ units of time to find a collision. The construction employs ``combinatorial'' hashing as an underlying building block (like Universal Hashing for cryptographic
 message authentication by Wegman and Carter). The construction runs at rate~1, thus improving on a similar rate~1/2 approach by Hirose (FSE 2006).

A Collision-Resistant Rate-1 Double-Block-Length Hash Function

This paper studies the application of slide attacks to hash functions. Slide attacks have mostly been used for block cipher cryptanalysis. But, as shown in the current paper, they also form a potential threat for hash functions, namely for sponge-function like structures. As it turns out, certain constructions for hash-function-based MACs can be vulnerable to forgery and even to key recovery attacks. In other cases, we can at least distinguish a given hash function from a random oracle.

To illustrate our results, we describe attacks against the Grindahl -256 and Grindahl -512 hash functions. To the best of our knowledge, this is the first cryptanalytic result on Grindahl -512. Furthermore, we point out a slide-based distinguisher attack on a slightly modified version of RadioGatun . We finally discuss simple countermeasures as a defense against slide attacks.

/pdf/slide-attacks-on-a-class-of-hash-functions-507sp1e45l.pdf

Stefan Lucks

Papers

Gimli : A Cross-Platform Permutation

Security of Cyclic Double Block Length Hash Functions

On the Security of Tandem-DM

A Collision-Resistant Rate-1 Double-Block-Length Hash Function

Slide Attacks on a Class of Hash Functions