DOCSLIB.ORG

Security of Cryptographic Tasks

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Security of Cryptographic Tasks Studies in the Efficiency and (versus) Security of Cryptographic Tasks Mohammad Mahmoody-Ghidary A Dissertation Presented to the Faculty of Princeton University in Candidacy for the Degree of Doctor of Philosophy Recommended for Acceptance by the Department of Computer Science Advisers: Boaz Barak September 2010 c Copyright by Mohammad Mahmoody-Ghidary, 2010. All Rights Reserved Abstract In this thesis, we deal with the following questions: (1) How efficient a cryptographic algo- rithm can be while achieving a desired level of security? (2) Since mathematical conjectures like P 6= NP are necessary for the possibility of secure cryptographic primitives in the standard models of computation: (a) Can we base cryptography solely based on the widely believed assumption of P 6= NP, or do we need stronger assumptions? (b) Which alternative nonstandard models offer us provable security unconditionally, while being implementable in real life? First we study the question of security vs. efficiency in public-key cryptography and prove tight bounds on the efficiency of black-box constructions of key-agreement and (public-key) digital signatures that achieve a desired level of security using \random-like" functions. Namely, we prove that any key-agreement protocol in the random oracle model where the parties ask at most n oracle queries can be broken by an adversary who asks at most O(n2) oracle queries and finds the key with high probability. This improves upon the previous Oe(n6)-query attack of Impagliazzo and Rudich [98] and proves that a simple key-agreement protocol due to Merkle [118] is optimal. We also prove that any signature scheme in the random oracle model where the parties ask at most q oracle queries can be broken by an adversary who forges a signature by asking at most 2O(q) oracle queries. This implies that a simple (one-time secure) signature scheme of Lamport [112] is optimal. Next, we study the possibility of basing the security of cryptographic tasks on the (neces- sary) assumption that NP 6= BPP. We show that any (black-box) reduction for basing the security of a one-way function on (worst-case) hardness of NP implies that SAT is check- able. Whether SAT is checkable or not has been open for more than two decades since the notion of checkability was introduced by Blum and Kannan [23]. Then we study the possi- bility of basing the security of specific cryptographic tasks/primitive on the hardness of NP. We show that doing so for the tasks of collision resistant hashing (or other primitives such as constant-round statistical commitment) implies that co-NP has a (single-prover) proof system with prover complexity BPPNP (which implies the checkability of SAT). Finally, we study the possibility of achieving statistical security (without relying on com- putational assumptions) through the alternative model of interaction in which parties can exchange tamper-proof hardware tokens. We focus on the case where the tokens only en- capsulate efficient circuits (and does not need to keep any state). The stateless property of the tokens gives advantage to the protocol both from a security perspective and also at the implementation level. We show that using stateless tokens one can not perform statisti- cally secure oblivious transfer, but it is possible to achieve statistically hiding and binding commitment schemes and statistically secure zero-knowledge proof systems for NP with an efficient prover. Our protocols are secure even against malicious parties who might use stateful tokens during the execution of the protocol. iii Acknowledgements I would like to start by thanking my wonderful adviser Boaz Barak whose support and guidance has always been with me during my five years of PhD at Princeton. I learnt immensely from talking to and working with Boaz who not only did tell me where exactly to look/read to find what I was searching for, but also taught me how to attack a problem from all directions till finally taming it. I thank the computer science department of Princeton and in particular the faculties and students of the theory group there who provided a friendly environment for my research and life in Princeton. I also thank the members of my thesis committee: Sanjeev Arora, Moses Charikar, Bernard Chazelle, and Russell Impagliazzo. I was lucky to be at Princeton while David Xiao was also there and some of our enjoyable discussions led to some of the work here. I also thank Iftach Haitner for great discussions and our work together. I would like to thank Yuval Ishai, Amit Sahai and Vipul Goyal for the great time I spend during the spring of 2009 in their fascinating crypto group at UCLA which among others led to some of the results presented here. I thank Avi Wigderson for insightful discussions, specially at the early stages of my PhD studies. I thank Amin Shokrollahi for great discussions and a lovely summer in Lausanne. I also thank Thomas Holenstein, Benny Applebaum, and Mahdi Cheraghchi, which discussions with whom affected my work presented here directly or indirectly. I thank Salil Vadhan for very insightful comments and suggestions during the development of some of the work presented here. Finally, I thankfully acknowledge Princeton's Wu prize and NSF grants CNS-0627526, CCF-0426582 and CCF-0832797 for supporting my research. iv Contents Abstract......................................... iii Acknowledgements................................... iv 1 Introduction and Preliminaries1 1.1 Introduction....................................1 1.1.1 Security vs. Efficiency in Public-Key Cryptography..........1 1.1.2 NP-Hard Cryptography.........................2 1.1.3 Unconditional Security by Exchanging Stateless Hardware......3 1.2 Previous Publications...............................4 1.3 Preliminaries...................................5 1.3.1 Basics about Probability.........................5 1.3.2 Interactive Algorithms..........................6 1.3.3 AM Languages..............................6 I Security vs. Efficiency in Public-Key Cryptography8 2 Merkel's Key-Agreement Protocol is Optimal9 2.1 Introduction....................................9 2.1.1 Our Result................................ 11 2.2 Our Techniques.................................. 12 2.2.1 Comparison with Previous Work of Impagliazzo and Rudich..... 12 2.2.2 The Issue of Independence........................ 13 2.2.3 Our Approach............................... 14 2.3 Our Attacker................................... 16 2.3.1 Attacking Algorithm........................... 16 2.4 Analysis of Attack: Proof of Theorem 2.3.1................... 18 2.4.1 Success of Attack: Proof of Lemma 2.4.1................ 19 2.4.2 Efficiency of Attack: Proof of Lemma 2.4.2............... 22 2.5 Completing the Proof............................... 24 2.5.1 Removing the Normal Form Assumption................ 24 2.5.2 Finding the Secret............................ 26 v 3 Lamport's Signature Scheme is Optimal 28 3.1 Introduction.................................... 28 3.1.1 Our Results................................ 29 3.1.2 Prior Work................................ 32 3.2 Our Techniques.................................. 32 3.2.1 Defining the Usefulness Condition.................... 34 3.3 Signature Schemes in Oracle Models...................... 35 3.4 Proof of the Main Result............................. 37 3.4.1 Proof of Lemma 3.4.3........................... 39 3.4.2 Proof of Claims 3.4.4 to 3.4.7...................... 40 3.5 A One-Time Signature Scheme......................... 43 3.6 Extensions..................................... 45 3.6.1 Handling Imperfect Completeness.................... 50 3.7 Lower-Bounds on Black-Box Constructions................... 53 3.8 Conclusions and Open Questions........................ 57 II NP-Hard Cryptography 58 4 Sampling with Size and Applications to NP-Hard Cryptography 59 4.1 Introduction.................................... 59 4.1.1 Application to Basing Cryptography on NP-Hardness......... 61 4.1.2 Main Tool|A New Sampling Protocol................. 61 4.1.3 Related Work............................... 62 4.1.4 SamO(1) vs. Sam2 ............................. 65 4.1.5 Contrast to Previous Work........................ 65 4.2 Our Techniques.................................. 66 4.2.1 The Case of Sam2 ............................. 66 4.2.2 The Case of SamO(1) ........................... 67 4.2.3 Histograms................................ 70 4.3 Preliminaries................................... 73 4.3.1 Notation.................................. 73 4.3.2 The Histogram of a Function...................... 73 4.3.3 Metrics over Distributions........................ 74 4.3.4 Efficient Provers for AM Protocols................... 77 4.3.5 Set Size Estimation and Sampling Protocols.............. 79 4.4 Sampling with Size and Verifying The Histogram............... 83 4.4.1 Proving Supporting Lemmas....................... 95 4.5 Applications.................................... 102 4.5.1 Lower-Bounds on Statistically Hiding Commitments.......... 105 vi 5 More on NP-hard Cryptography, Randomized Reductions, and Checkabil- ity of SAT 109 5.1 Introduction.................................... 109 5.1.1 Difficulties with Randomized Reductions................ 110 5.1.2 Complexity of Real-Valued Functions Verifiable in AM ........ 112 5.1.3 Randomized Reductions, Checkability, and Testability......... 114 5.1.4 Randomized vs. Deterministic Reductions............... 117 5.2 Preliminaries................................... 117 5.2.1 Promise Problems and Relations..................... 117 5.2.2
Load more

Recommended publications
  • On the Efficiency of the Lamport Signature Scheme
    Technical Sciences 275 ON THE EFFICIENCY OF THE LAMPORT SIGNATURE SCHEME Daniel ZENTAI Óbuda University, Budapest, Hungary [email protected] ABSTRACT Post-quantum (or quantum-resistant) cryptography refers to a set of cryptographic algorithms that are thought to remain secure even in the world of quantum computers. These algorithms are usually considered to be inefficient because of their big keys, or their running time. However, if quantum computers became a reality, security professionals will not have any other choice, but to use these algorithms. Lamport signature is a hash based one-time digital signature algorithm that is thought to be quantum-resistant. In this paper we will describe some simulation results related to the efficiency of the Lamport signature. KEYWORDS: digital signature, post-quantum cryptography, hash functions 1. Introduction This paper is organized as follows. Although reasonable sized quantum After this introduction, in chapter 2 we computers do not exist yet, post quantum describe some basic concepts and definition cryptography (Bernstein, 2009) became an related to the security of hash functions. important research field recently. Indeed, Also, we describe the Lamport one-time we have to discover the properties of these signature algorithm. In chapter 3 we algorithms before quantum computers expound our simulation results related to become a reality, namely suppose that we the efficiency of the Lamport signature. use the current cryptographic algorithms for The last chapter summarizes our work. x more years, we need y years to change the most widely used algorithms and update 2. Preliminaries our standards, and we need z years to build In this chapter the basic concepts and a quantum-computer.
    [Show full text]
  • Outline One-Time Signatures One-Time Signatures Lamport's
    Advanced Security Outline § One-Time Signatures Constructions • Lamport’s signature and Key Management • Improved signature constructions • Merkle-Winternitz Signature § Efficient Authenticators (amortize signature) Class 16 • One-way chains (self-authenticating values) • Chained hashes • Merkle Hash Trees § Applications • Efficient short-lived certificates, S/Key • Untrusted external storage • Stream signatures (Gennaro, Rohatgi) § Zhou & Haas’s key distribution One-Time Signatures One-Time Signatures § Use one -way functions without trapdoor § Challenge: digital signatures expensive § Efficient for signature generation and for generation and verification verification § Caveat: can only use one time § Goal: amortize digital signature § Example: 1-bit one-time signature • P0, P1 are public values (public key) • S0, S1 are private values (private key) S0 P0 S0 S0’ P S1 P1 S1 S1’ Lamport’s One-Time Signature Improved Construction I § Uses 1-bit signature construction to sign multiple bits § Uses 1-bit signature construction to sign multiple bits Sign 0 S0 S0’ S0’’ S0* Private values S0 S0’ S0’’ S0* c0 c0’ c0* P0 P0’ P0’’ P0* … … … Public values P0 P0’ P0’’ P0* p0 p0’ p0* P1 P1’ P1’’ P1* Bit 0 Bit 1 Bit 2 Bit n Bit 0 Bit 1 Bit log(n) Sign 1 S1 S1’ S1’’ S1* Private values Sign message Checksum bits: encode Bit 0 Bit 1 Bit 2 Bit n # of signature bits = 0 1 Improved Construction II Merkle-Winternitz Construction § Intuition: encode sum of checksum chain § Lamport signature has high overhead Signature S0 S1 S2 S3 § Goal: reduce size of public
    [Show full text]
  • A Survey on Post-Quantum Cryptography for Constrained Devices
    International Journal of Applied Engineering Research ISSN 0973-4562 Volume 14, Number 11 (2019) pp. 2608-2615 © Research India Publications. http://www.ripublication.com A Survey on Post-Quantum Cryptography for Constrained Devices Kumar Sekhar Roy and Hemanta Kumar Kalita Abstract Quantum Computer” [1]. Shor’s algorithm can solve integer The rise of Quantum computers in the recent years have given factorization problem as well as discrete logarithm problem a major setback to classical and widely used cryptography used by RSA as well as ECC respectively in polynomial time schemes such as RSA(Rivest-Shamir-Adleman) Algorithm using a sufficiently large Quantum Computer. Thus making the and ECC (Elliptic Curve Cryptography). RSA and ECC use of cryptosystems based on integer factorization problem as depends on integer factorization problem and discrete well as discrete logarithm problem obsolete. This current logarithm problem respectively, which can be easily solved by advances has raised a genuine need for development of Quantum Computers of sufficiently large size running the cryptosystems which could serve as viable replacement for infamous Shor’s Algorithm. Therefore cryptography schemes traditionally used cryptosystems which are vulnerable to which are difficult to solve in both traditional as well as quantum computer based attacks. Since the arrival of IoT, the Quantum Computers need to be evaluated. In our paper we Cyber security scenario has entirely shifted towards security provide a rigorous survey on Post-Quantum Cryptography schemes which are lightweight in terms of computational schemes and emphasize on their applicability to provide complexity, power consumption, memory consumption etc. security in constrained devices. We provide a detailed insight This schemes also need to be secure against all known attacks.
    [Show full text]
  • Applications of SKREM-Like Symmetric Key Ciphers
    Applications of SKREM-like symmetric key ciphers Mircea-Adrian Digulescu1;2 February 2021 1Individual Researcher, Worldwide 2Formerly: Department of Computer Science, Faculty of Mathematics and Computer Science, University of Bucharest, Romania [email protected], [email protected], [email protected] Abstract In a prior paper we introduced a new symmetric key encryption scheme called Short Key Random Encryption Machine (SKREM), for which we claimed excellent security guarantees. In this paper we present and briey discuss some of its applications outside conventional data encryption. These are Secure Coin Flipping, Cryptographic Hashing, Zero-Leaked-Knowledge Authentication and Autho- rization and a Digital Signature scheme which can be employed on a block-chain. We also briey recap SKREM-like ciphers and the assumptions on which their security are based. The above appli- cations are novel because they do not involve public key cryptography. Furthermore, the security of SKREM-like ciphers is not based on hardness of some algebraic operations, thus not opening them up to specic quantum computing attacks. Keywords: Symmetric Key Encryption, Provable Security, One Time Pad, Zero Knowledge, Cryptographic Commit Protocol, Secure Coin Flipping, Authentication, Authorization, Cryptographic Hash, Digital Signature, Chaos Machine 1 Introduction So far, most encryption schemes able to serve Secure Coin Flipping, Zero-Knowledge Authentication and Digital Signatures, have relied on public key cryptography, which in turn relies on the hardness of prime factorization or some algebraic operation in general. Prime Factorization, in turn, has been shown to be vulnerable to attacks by a quantum computer (see [1]). In [2] we introduced a novel symmetric key encryption scheme, which does not rely on hardness of algebraic operations for its security guarantees.
    [Show full text]
  • Speeding-Up Verification of Digital Signatures Abdul Rahman Taleb, Damien Vergnaud
    Speeding-Up Verification of Digital Signatures Abdul Rahman Taleb, Damien Vergnaud To cite this version: Abdul Rahman Taleb, Damien Vergnaud. Speeding-Up Verification of Digital Signatures. Journal of Computer and System Sciences, Elsevier, 2021, 116, pp.22-39. 10.1016/j.jcss.2020.08.005. hal- 02934136 HAL Id: hal-02934136 https://hal.archives-ouvertes.fr/hal-02934136 Submitted on 27 Sep 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Speeding-Up Verification of Digital Signatures Abdul Rahman Taleb1, Damien Vergnaud2, Abstract In 2003, Fischlin introduced the concept of progressive verification in cryptog- raphy to relate the error probability of a cryptographic verification procedure to its running time. It ensures that the verifier confidence in the validity of a verification procedure grows with the work it invests in the computation. Le, Kelkar and Kate recently revisited this approach for digital signatures and pro- posed a similar framework under the name of flexible signatures. We propose efficient probabilistic verification procedures for popular signature schemes in which the error probability of a verifier decreases exponentially with the ver- ifier running time. We propose theoretical schemes for the RSA and ECDSA signatures based on some elegant idea proposed by Bernstein in 2000 and some additional tricks.
    [Show full text]
  • Improved Correlation Attacks on SOSEMANUK and SOBER-128
    Improved Correlation Attacks on SOSEMANUK and SOBER-128 Joo Yeon Cho Helsinki University of Technology Department of Information and Computer Science, Espoo, Finland 24th March 2009 1 / 35 SOSEMANUK Attack Approximations SOBER-128 Outline SOSEMANUK Attack Method Searching Linear Approximations SOBER-128 2 / 35 SOSEMANUK Attack Approximations SOBER-128 SOSEMANUK (from Wiki) • A software-oriented stream cipher designed by Come Berbain, Olivier Billet, Anne Canteaut, Nicolas Courtois, Henri Gilbert, Louis Goubin, Aline Gouget, Louis Granboulan, Cedric` Lauradoux, Marine Minier, Thomas Pornin and Herve` Sibert. • One of the final four Profile 1 (software) ciphers selected for the eSTREAM Portfolio, along with HC-128, Rabbit, and Salsa20/12. • Influenced by the stream cipher SNOW and the block cipher Serpent. • The cipher key length can vary between 128 and 256 bits, but the guaranteed security is only 128 bits. • The name means ”snow snake” in the Cree Indian language because it depends both on SNOW and Serpent. 3 / 35 SOSEMANUK Attack Approximations SOBER-128 Overview 4 / 35 SOSEMANUK Attack Approximations SOBER-128 Structure 1. The states of LFSR : s0,..., s9 (320 bits) −1 st+10 = st+9 ⊕ α st+3 ⊕ αst, t ≥ 1 where α is a root of the primitive polynomial. 2. The Finite State Machine (FSM) : R1 and R2 R1t+1 = R2t ¢ (rtst+9 ⊕ st+2) R2t+1 = Trans(R1t) ft = (st+9 ¢ R1t) ⊕ R2t where rt denotes the least significant bit of R1t. F 3. The trans function Trans on 232 : 32 Trans(R1t) = (R1t × 0x54655307 mod 2 )≪7 4. The output of the FSM : (zt+3, zt+2, zt+1, zt)= Serpent1(ft+3, ft+2, ft+1, ft)⊕(st+3, st+2, st+1, st) 5 / 35 SOSEMANUK Attack Approximations SOBER-128 Previous Attacks • Authors state that ”No linear relation holds after applying Serpent1 and there are too many unknown bits...”.
    [Show full text]
  • A History of Syntax Isaac Quinn Dupont Facult
    Proceedings of the 2011 Great Lakes Connections Conference—Full Papers Email: A History of Syntax Isaac Quinn DuPont Faculty of Information University of Toronto [email protected] Abstract the arrangement of word tokens in an appropriate Email is important. Email has been and remains a (orderly) manner for processing by computers. Per- “killer app” for personal and corporate correspond- haps “computers” refers to syntactical processing, ence. To date, no academic or exhaustive history of making my definition circular. So be it, I will hide email exists, and likewise, very few authors have behind the engineer’s keystone of pragmatism. Email attempted to understand critical issues of email. This systems work (usually), because syntax is arranged paper explores the history of email syntax: from its such that messages can be passed. origins in time-sharing computers through Request This paper demonstrates the centrality of for Comments (RFCs) standardization. In this histori- syntax to the history of email, and investigates inter- cal capacity, this paper addresses several prevalent esting socio–technical issues that arise from the par- historical mistakes, but does not attempt an exhaus- ticular development of email syntax. Syntax is an tive historiography. Further, as part of the rejection important constraint for contemporary computers, of “mainstream” historiographical methodologies this perhaps even a definitional quality. Additionally, as paper explores a critical theory of email syntax. It is machines, computers are physically constructed. argued that the ontology of email syntax is material, Thus, email syntax is material. This is a radical view but contingent and obligatory—and in a techno– for the academy, but (I believe), unproblematic for social assemblage.
    [Show full text]
  • Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World∗
    Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World∗ Dan Boneh Mark Zhandry Stanford University fdabo,[email protected] Abstract We initiate the study of quantum-secure digital signatures and quantum chosen ciphertext security. In the case of signatures, we enhance the standard chosen message query model by allowing the adversary to issue quantum chosen message queries: given a superposition of messages, the adversary receives a superposition of signatures on those messages. Similarly, for encryption, we allow the adversary to issue quantum chosen ciphertext queries: given a superposition of ciphertexts, the adversary receives a superposition of their decryptions. These adversaries model a natural ubiquitous quantum computing environment where end-users sign messages and decrypt ciphertexts on a personal quantum computer. We construct classical systems that remain secure when exposed to such quantum queries. For signatures, we construct two compilers that convert classically secure signatures into signatures secure in the quantum setting and apply these compilers to existing post-quantum signatures. We also show that standard constructions such as Lamport one-time signatures and Merkle signatures remain secure under quantum chosen message attacks, thus giving signatures whose quantum security is based on generic assumptions. For encryption, we define security under quantum chosen ciphertext attacks and present both public-key and symmetric-key constructions. Keywords: Quantum computing, signatures, encryption, quantum security 1 Introduction Recent progress in building quantum computers [IBM12] gives hope for their eventual feasibility. Consequently, there is a growing need for quantum-secure cryptosystems, namely classical systems that remain secure against quantum computers. Post-quantum cryptography generally studies the settings where the adversary is armed with a quantum computer, but users only have classical machines.
    [Show full text]
  • On Distinguishing Attack Against the Reduced Version of the Cipher Nlsv2
    Ø Ñ ÅØÑØÐ ÈÙ ÐØÓÒ× DOI: 10.2478/v10127-012-0037-5 Tatra Mt. Math. Publ. 53 (2012), 21–32 ON DISTINGUISHING ATTACK AGAINST THE REDUCED VERSION OF THE CIPHER NLSV2 Michal Braˇsko — Jaroslav Boor ABSTRACT. The Australian stream cipher NLSv2 [Hawkes, P.—Paddon, M.– –Rose, G. G.—De Vries, M. W.: Primitive specification for NLSv2, Project eSTREAM web page, 2007, 1–25] is a 32-bit word oriented stream cipher that was quite successful in the stream ciphers competition—the project eSTREAM. The cipher achieved Phase 3 and successfully accomplished one of the main require- ments for candidates in Profile 1 (software oriented proposals)—to have a better performance than AES in counter mode. However the cipher was not chosen into the final portfolio [Babbage, S.–De Canni`ere, Ch.–Canteaut, A.–Cid, C.– –Gilbert, H.–Johansson, T.–Parker, M.–Preneel, B.–Rijmen, V.–Robshaw, M.: The eSTREAM Portfolio, Project eSTREAM web page, 2008], because its per- formance was not so perfect when comparing with other finalist. Also there is a security issue with a high correlation in the used S-Box, which some effective distinguishers exploit. In this paper, a practical demonstration of the distinguish- ing attack against the smaller version of the cipher is introduced. In our experi- ments, we have at disposal a machine with four cores (IntelR CoreTM Quad @ 2.66 GHz) and single attack lasts about 6 days. We performed successful practi- cal experiments and our results demonstrate that the distingushing attack against the smaller version is working. 1. Introduction The cipher NLSv2 is a synchronous, word-oriented stream cipher developed by Australian researchers P h i l i p H a w k e s, C a m e r o n M c D o n a l d, M i - chael Paddon,Gregory G.Rose andMiriam Wiggers de Vreis in 2007 [6].
    [Show full text]
  • Lecture 17 March 28, 2019
    Outline Lamport Signatures Merkle Signatures Passwords CPSC 367: Cryptography and Security Michael J. Fischer Lecture 17 March 28, 2019 CPSC 367, Lecture 17 1/23 Outline Lamport Signatures Merkle Signatures Passwords Lamport One-Time Signatures Merkle Signatures Authentication Using Passwords Authentication problem Passwords authentication schemes CPSC 367, Lecture 17 2/23 Outline Lamport Signatures Merkle Signatures Passwords Lamport One-Time Signatures CPSC 367, Lecture 17 3/23 Outline Lamport Signatures Merkle Signatures Passwords Overview of Lamport signatures Leslie Lamport devised a digital signature scheme based on hash functions rather than on public key cryptography. Its drawback is that each key pair can be used to sign only one message. We describe how Alice uses it to sign a 256-bit message. As wtih other signature schemes, it suffices to sign the hash of the actual message. CPSC 367, Lecture 17 4/23 Outline Lamport Signatures Merkle Signatures Passwords How signing works The private signing key consists of a sequence r = (r 1;:::; r 256) of k k pairs( r0 ; r1 ) of random numbers,1 ≤ k ≤ 256. th Let m be a 256-bit message. Denote by mk the k bit of m. The signature of m is the sequence of numbers s = (s1;:::; s256), where sk = r k : mk k k Thus, one element from the pair( r0 ; r1 ) is used to sign mk , so k k k k s = r0 if mk = 0 and s = r1 if mk = 1. CPSC 367, Lecture 17 5/23 Outline Lamport Signatures Merkle Signatures Passwords How verification works The public verification key consists of the sequence 1 256 k k k k v = (v ;:::; v ) of pairs( v0 ; v1 ), where vj = H(rj ), and H is any one-way function (such as a cryptographically strong hash function).
    [Show full text]
  • SAC 2006 Preliminary Program Wednesday August 16, 2006
    SAC 2006 Preliminary Program All events, except the Banquet, are held at the EV building (1515 St. Catherine W.) All the presentations will be held at EV2.260 The Wednesday reception will be held at EV2.184 The board meeting (open only to board members) will be held at EV9.221 Wednesday August 16, 2006 18:30-20:00 Light social reception (EV2.184) Thursday August 17, 2006 08:00 Registration and Morning Coffee 08:50-09:00 Welcome Remarks Block Cipher Cryptanalysis Chair: Bart Preneel 09:25-09:50 Improved DST Cryptanalysis of IDEA Eyup Serdar Ayaz, Ali Aydin Selcuk 09:50-10:15 Improved Related-Key Impossible Differential Attacks on Reduced-Round AES-192 Wentao Zhang, Wenling Wu, Lei Zhang, Dengguo Feng 09:00-09:25 Related-Key Rectangle Attack on the Full SHACAL-1 Orr Dunkelman, Nathan Keller, Jongsung Kim 10:15-10:45 Coffee Break Stream Cipher Cryptanalysis I Chair: Helena Handschuh 10:45-11:10 Cryptanalysis of Achterbahn-Version 2 Martin Hell, Thomas Johansson 11:10-11:35 Cryptanalysis of the Stream Cipher ABC v2 Hongjun Wu, Bart Preneel Invited Talk I: The Stafford Tavares Lecture Chair: Eli Biham 11:35-12:30 A Top View of Side Channels Adi Shamir 12:30-14:00 Lunch (EV2.184) Block and Stream Ciphers Chair: Orr Dunkelman 14:00-14:25 The Design of a Stream Cipher Lex Alex Biryukov 14:25-14:50 Dial C for Cipher Thomas Baignères, Matthieu Finiasz 14:50-15:15 Tweakable Block Cipher Revisited Kazuhiko Minematsu 15:15-15:45 Coffee Break Side-Channel Attacks Chair: Carlisle Adams 15:45-16:10 Extended Hidden Number Problem and its Cryptanalytic
    [Show full text]
  • Lecture 17 November 1, 2017
    Outline Hashed Data Structures Lamport Signatures Merkle Signatures Passwords CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 17 November 1, 2017 CPSC 467, Lecture 17 1/42 Outline Hashed Data Structures Lamport Signatures Merkle Signatures Passwords Hashed Data Structures Motivation: Peer-to-peer file sharing networks Hash lists Hash Trees Lamport One-Time Signatures Merkle Signatures Authentication Using Passwords Authentication problem Passwords authentication schemes Secure password storage Dictionary attacks CPSC 467, Lecture 17 2/42 Outline Hashed Data Structures Lamport Signatures Merkle Signatures Passwords Hashed Data Structures CPSC 467, Lecture 17 3/42 Outline Hashed Data Structures Lamport Signatures Merkle Signatures Passwords P2P Peer-to-peer networks One real-world application of hash functions is to peer-to-peer file-sharing networks. The goal of a P2P network is to improve throughput when sending large files to large numbers of clients. It operates by splitting the file into blocks and sending each block separately through the network along possibly different paths to the client. Rather than fetching each block from the master source, a block can be received from any node (peer) that happens to have the needed block. The problem is to validate blocks received from untrusted peers. CPSC 467, Lecture 17 4/42 Outline Hashed Data Structures Lamport Signatures Merkle Signatures Passwords P2P Integrity checking An obvious approach is for a trusted master node to send each client a hash of the entire file. When all blocks have been received, the client reassembles the file, computes its hash, and checks that it matches the hash received from the master.
    [Show full text]