DOCSLIB.ORG

Foundation of Cryptography, Introduction Adminstration + Introduction

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Foundation of Cryptography, Introduction Adminstration + Introduction Foundation of Cryptography, Introduction Adminstration + Introduction Benny Applebaum & Iftach Haitner, Tel Aviv University (Slightly edited by Ronen Shaltiel, all errors are by Ronen Shaltiel) University of Haifa. 2018 Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 1 / 16 Part I Administration and Course Overview Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 2 / 16 Section 1 Administration Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 3 / 16 2. Course website: Can be reached from Ronen’s homepage. Important Details 1. There will be a final exam. Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 4 / 16 Important Details 1. There will be a final exam. 2. Course website: Can be reached from Ronen’s homepage. Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 4 / 16 Course Prerequisites 1. Computational Models 2. Probability theory. Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 5 / 16 Course Material 1. Books: 1.1 Oded Goldreich. Foundations of Cryptography. 1.2 Jonathan Katz and Yehuda Lindell. An Introduction to Modern Cryptography. 2. Lecture notes 2.1 Ran Canetti www.cs.tau.ac.il/~canetti/f08.html 2.2 Yehuda Lindell u.cs.biu.ac.il/~lindell/89-856/main-89-856.html 2.3 Luca Trevisan www.cs.berkeley.edu/~daw/cs276/ 2.4 Salil Vadhan people.seas.harvard.edu/~salil/cs120/ 2.5 Benny Applebaum and Iftach Haitner http://moodle.tau.ac. il/2016/course/view.php?id=368416201 Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 6 / 16 Section 2 Course Topics Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 7 / 16 Course Topics Basic primitives in cryptography (i.e., one-way functions, pseudorandom generators and zero-knowledge proofs). I Focus on formal definitions and rigorous proofs. I The goal is not studying some list, but to understand cryptography. I Start with “what is security?” I Only then do we ask how to achieve it. I Start from the bottom and work our way up. Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 8 / 16 Part II Foundation of Cryptography Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 9 / 16 Some stories and motivation I Encryption (symmetric and public-key). I Coin tossing over the phone (impossible information theoretically, but possible against poly-time adversaries). Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 10 / 16 Section 3 Cryptography and Computational Hardness Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 11 / 16 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 2. Hardness assumptions, why do we need them? 3. Does P6 = NP suffice? 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 3. Does P6 = NP suffice? 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? 2. Hardness assumptions, why do we need them? Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? 2. Hardness assumptions, why do we need them? 3. Does P6 = NP suffice? Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? 2. Hardness assumptions, why do we need them? 3. Does P6 = NP suffice? NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? 2. Hardness assumptions, why do we need them? 3. Does P6 = NP suffice? NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? 2. Hardness assumptions, why do we need them? 3. Does P6 = NP suffice? NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 polynomial-time algorithms: an algorithmA runs in polynomial-time, if 9p 2 poly such that the running time of A(x) is bounded by p(jxj) for any x 2 f0; 1g∗ 4. Problems: hard on the average. No known solution 5. One-way functions: an efficiently computable function that no efficient algorithm can invert. Cryptography and Computational Hardness 1. What is Cryptography? 2. Hardness assumptions, why do we need them? 3. Does P6 = NP suffice? NP: all (languages) L ⊂ f0; 1g∗ for which there exists a polynomial-time algorithmV and (a polynomial) p 2 poly such that the following hold: 3.1 V (x; w) = 0 for any x 2= L and w 2 f0; 1g∗ 3.2 for any x 2 L, 9w 2 f0; 1g∗ with jwj ≤ p(jxj) and V (x; w) = 1 P6 = NP: i.e., 9L 2NP , such that for any polynomial-time ∗ algorithmA, 9x 2 f0; 1g withA (x) 6= 1L(x) Benny Applebaum & Iftach Haitner (TAU) Foundation of Cryptography 2018 12 / 16 4.
Load more

Recommended publications
  • Universally Composable Security: a New Paradigm for Cryptographic Protocols∗
    Universally Composable Security: A New Paradigm for Cryptographic Protocols∗ Ran Canettiy February 11, 2020 Abstract We present a general framework for describing cryptographic protocols and analyzing their security. The framework allows specifying the security requirements of practically any crypto- graphic task in a unified and systematic way. Furthermore, in this framework the security of protocols is preserved under a general composition operation, called universal composition. The proposed framework with its security-preserving composition operation allows for mod- ular design and analysis of complex cryptographic protocols from simpler building blocks. More- over, within this framework, protocols are guaranteed to maintain their security in any context, even in the presence of an unbounded number of arbitrary protocol sessions that run concur- rently in an adversarially controlled manner. This is a useful guarantee, which allows arguing about the security of cryptographic protocols in complex and unpredictable environments such as modern communication networks. Keywords: cryptographic protocols, security analysis, protocol composition, universal composi- tion. ∗An extended abstract of this work appears in the proceedings of the 42nd Foundations of Computer Science conference, 2001. This is an updated version. While the overall spirit and the structure of the definitions and results in this paper has remained the same, many important details have changed. We point out and motivate the main differences as we go along. Earlier versions of this work appeared in December 2018, July 2013, Decem- ber and January 2005, and October 2001, under the same title, and in December 2000 under the title \A unified framework for analyzing security of protocols". These earlier versions can be found at the ECCC archive, TR 01-16 (http://eccc.uni-trier.de/eccc-reports/2001/TR01-016); however they are not needed for understanding this work and have only historic significance.
    [Show full text]
  • 2011, Velopment of Software Platforms Techniques
    Winter 2010/11 TEL AVIV UNIVERSITY REVIEW Science and the Sacred Explosives Detection Digitizing Architectural Design Israel-India Ties Information Overload 9 New faculty member Prof. Ronitt Rubinfeld uses advanced math- ematical techniques Cover story: to make sense of the The Science of data deluge. Judaism 2 From digitizing the Cairo Geniza to studying biblical weather, TAU Honing Israel’s scholars are offering fresh scientif- Security Edge 10 ic perspectives on Jewish culture The Yuval Ne’eman Workshop in and religion. Science, Technology and Security influences Israel’s national security policy. Closing a Circle 14 A community TEL AVIV UNIVERSITY REVIEW outreach program Winter 2010/11 Winter helps children cope with the loss of a relative from cancer. Issued by the Strategic Communications Dept. Development and Public Affairs Division Tel Aviv University Ramat Aviv 69978 Tel Aviv, Israel Prizes 37 TAU physicist Prof. Yakir Aharonov Tel: +972 3 6408249 sections Fax: + 972 3 6407080 receives the US National Medal of Science from President Barack E-mail: [email protected] Obama www.tau.ac.il innovations 16 Editor: Louise Shalev Contributors: Rava Eleasari, Pauline Reich, Ruti Ziv, Michal Alexander, Sarah Lubelski, Gil Zohar leadership 20 Graphic Design: TAU Graphic Design Studio/ Michal Semo-Kovetz; Dalit Pessach Dio’olamot Photography: Development and Public Affairs Division initiatives Photography Department/Michal Roche Ben Ami, 24 Michal Kidron Additional Photography: Ryan K Morris Photography and the National Science & Technology Medals associations 26 Foundation; Yaron Hershkovic; Avraham Hay, from the Wolfe Family Collection, courtesy of the Bible Lands Museum, Jerusalem; Yoram Reshef digest 34 Administrative Coordinator: Pauline Reich Administrative Assistant: Shay Bramson Translation Services: Sagir Translations, Offiservice newsmakers Printing: Eli Meir Printing 39 Officers of Tel Aviv University a Harvey M.
    [Show full text]
  • The Impossibility of Obfuscation with Auxiliary Input Or a Universal Simulator
    The Impossibility of Obfuscation with Auxiliary Input or a Universal Simulator Nir Bitansky∗ Ran Canettiy Henry Cohnz Shafi Goldwasserx Yael Tauman Kalai{ Omer Panethk Alon Rosen∗∗ February 9, 2014 Abstract In this paper we show that the existence of general indistinguishability obfuscators conjectured in a few recent works implies, somewhat counterintuitively, strong impossibility results for virtual black box obfuscation. In particular, we show that indistinguishability obfuscation for all circuits implies: • The impossibility of average-case virtual black box obfuscation with auxiliary input for any circuit family with super-polynomial pseudo-entropy. Such circuit families include all pseudo-random function families, and all families of encryption algorithms and randomized digital signatures that generate their required coin flips pseudo-randomly. Impossibility holds even when the auxiliary input depends only on the public circuit family, and not the specific circuit in the family being obfuscated. • The impossibility of average-case virtual black box obfuscation with a universal simulator (with or without any auxiliary input) for any circuit family with super-polynomial pseudo-entropy. These bounds significantly strengthen the impossibility results of Goldwasser and Kalai (STOC 2005). arXiv:1401.0348v3 [cs.CR] 13 Feb 2014 ∗Tel Aviv University, [email protected]. Supported by an IBM Ph.D. Fellowship, and the Check Point Institute for Information Security. yBoston University and Tel Aviv University, [email protected]. Supported by the Check Point Institute for Information Security, an NSF EAGER grant, and an NSF Algorithmic Foundations grant 1218461. zMicrosoft Research, One Memorial Drive, Cambridge, MA 02142, [email protected]. xMIT and the Weizmann Institute of Science, [email protected].
    [Show full text]
  • The Random Oracle Methodology, Revisited∗
    The Random Oracle Methodology, Revisited∗ Ran Canettiy Oded Goldreichz Shai Halevix August 6, 2002 Abstract We take a critical look at the relationship between the security of cryptographic schemes in the Random Oracle Model, and the security of the schemes that result from implementing the random oracle by so called \cryptographic hash functions". The main result of this paper is a negative one: There exist signature and encryption schemes that are secure in the Random Oracle Model, but for which any implementation of the random oracle results in insecure schemes. In the process of devising the above schemes, we consider possible definitions for the notion of a \good implementation" of a random oracle, pointing out limitations and challenges. Keywords: Correlation Intractability, • Cryptography (Encryption and Signature Schemes, The Random Oracle model); • Complexity Theory (diagonalization, application of CS-Proofs). ∗Extended abstract has appeared in the Proc. of the 30th ACM Symp. on Theory of Computing (STOC), pages 209{218, 1998. yIBM Watson, P.O. Box 704, Yorktown Height, NY 10598, USA. E-mail: [email protected] zDepartment of Computer Science, Weizmann Institute of Science, Rehovot, Israel. E-mail: [email protected]. Work done while visiting LCS, MIT. Partially supported by DARPA grant DABT63- 96-C-0018. xIBM Watson, P.O. Box 704, Yorktown Height, NY 10598, USA. E-mail: [email protected] 1 Contents 1 Introduction 2 1.1 The Setting . 2 1.1.1 The Random Oracle Model . 3 1.1.2 Implementing an ideal system . 3 1.2 Our Results . 5 1.2.1 Correlation intractability .
    [Show full text]
  • Curriculum Vitae
    Curriculum Vitae Oded Goldreich January 1, 2021 Current Position: Professor of Computer Science, Weizmann Institute of Science, Rehovot, Israel. Incumbent of the Meyer W. Weisgal Professorial Chair. Personal Data: Born in Israel on February 4th, 1957. Married to Dana Ron. Citizenship: Israeli. Passport number 20663357. Research Interests and Expertise: • Main current focus: Randomness and Computation. In particular, Property Testing, Pseudorandomness, and Probabilistic Proof Systems. • Additional interest: Complexity Theory. • Past expertise: Foundations of Cryptography. • Additional past interest: Distributed Computation. Degrees B.A. in Computer Science (Cum Laude), Technion, Israel. October 1977 through June 1980. M.Sc. in Computer Science, Technion, Israel. October 1980 through February 1982. Thesis ad- viser: Prof. S. Even. Thesis Title: \On the Complexity of Some Edge Testing Problems". D.Sc. in Computer Science, Technion, Israel. March 1982 through June 1983. Thesis adviser: Prof. S. Even. Thesis Title: \On the Security of Cryptographic Protocols and Cryptosystems". i Contents 1 Research Contributions 1 2 Expository Contributions 21 2.1 Books and Lecture Notes . 21 2.2 Survey articles . 23 3 Graduate Student Supervision 26 3.1 Graduate students who completed D.Sc./Ph.D. 26 3.2 Graduate students who completed M.Sc. 28 3.3 Mentoring . 30 4 Postdoctoral fellows hosted 30 5 Teaching Experience 30 5.1 Undergraduate Courses . 30 5.2 Graduate Courses . 31 5.3 Short Courses and Lecture Series . 31 6 Positions 31 7 Fellowships and Honors 32 8 Short Visits 33 9 Special Invitations 34 9.1 Invited Speaker at Conferences . 34 9.2 Participation in Workshops (by invitation) . 34 9.3 Speaker in Special Colloquiums .
    [Show full text]
  • Studies in Secure Multiparty Computation and Applications
    Studies in Secure Multiparty Computation and Applications Thesis for the Degree of DOCTOR of PHILOSOPHY by Ran Canetti Department of Computer Science and Applied Mathematics The Weizmann Institute of Science Submitted to the Scientic Council of The Weizmann Institute of Science Rehovot Israel June Revised March i Acknowledgements First a very sp ecial thanks is due to Oded Goldreich my advisor On top of b eing an exp ert on exp erts and a dear friend he is a devoted advisor far b eyond the ordinary Oded has the sp ecial prop erty of always searching for the crux of any matter and disgustedly ridding himself of the rest Once he sets his mind to a particular goal he is thoroughly and uncompromisingly dedicated This together with his sharpness his p eculiar sense of humor and his natural go o dheartedness make him a remarkable p erson indeed My interaction with Oded deeply aected my approach to research and to life in general Time and again his unconventional approach rst lo oks o dd and after some thought it b ecomes clear that his is the direct simple and natural approach It also b ecomes totally unclear how I ever thought otherwise His colorful and creative feedback on my writing style has made each one of my drafts a museum piece His feedback also spiced up my fearful anticipation of their return which has happ ened at an amazing sp eed I am also thankful for the practical training I received in the art of do dging ying sho es During my years of study I have made some sp ecial acquaintances from whom I have learned a lot Among these
    [Show full text]
  • Lecture Notes in Computer Science 9563
    Lecture Notes in Computer Science 9563 Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen Editorial Board David Hutchison Lancaster University, Lancaster, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Friedemann Mattern ETH Zurich, Zürich, Switzerland John C. Mitchell Stanford University, Stanford, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen TU Dortmund University, Dortmund, Germany Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Gerhard Weikum Max Planck Institute for Informatics, Saarbrücken, Germany More information about this series at http://www.springer.com/series/7410 Eyal Kushilevitz • Tal Malkin (Eds.) Theory of Cryptography 13th International Conference, TCC 2016-A, Tel Aviv, Israel, January 10–13, 2016 Proceedings, Part II 123 Editors Eyal Kushilevitz Tal Malkin Department of Computer Science Department of Computer Science Technion Columbia University Haifa New York, NY Israel USA ISSN 0302-9743 ISSN 1611-3349 (electronic) Lecture Notes in Computer Science ISBN 978-3-662-49098-3 ISBN 978-3-662-49099-0 (eBook) DOI 10.1007/978-3-662-49099-0 Library of Congress Control Number: 2015957796 LNCS Sublibrary: SL4 – Security and Cryptology © International Association for Cryptologic Research 2016 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.
    [Show full text]
  • Program Obfuscation with Leaky Hardware
    Program Obfuscation with Leaky Hardware The MIT Faculty has made this article openly available. Please share how this access benefits you. Your story matters. Citation Bitansky, Nir, Ran Canetti, Shafi Goldwasser, Shai Halevi, Yael Tauman Kalai, and Guy N. Rothblum. “Program Obfuscation with Leaky Hardware.” Advances in Cryptology – ASIACRYPT 2011 (Lecture Notes in Computer Science; volume 7073) (2011): 722–739. As Published http://dx.doi.org/10.1007/978-3-642-25385-0_39 Publisher Springer-Verlag Berlin Heidelberg Version Author's final manuscript Citable link http://hdl.handle.net/1721.1/86914 Terms of Use Creative Commons Attribution-Noncommercial-Share Alike Detailed Terms http://creativecommons.org/licenses/by-nc-sa/4.0/ Program Obfuscation with Leaky Hardware∗ Nir Bitanskyy Ran Canetti∗ Shafi Goldwasserz Shai Halevix Yael Tauman Kalai{ Guy N. Rothblumk December 6, 2011 Abstract We consider general program obfuscation mechanisms using \somewhat trusted" hardware devices, with the goal of minimizing the usage of the hardware, its complexity, and the required trust. Specifically, our solution has the following properties: (i) The obfuscation remains secure even if all the hardware devices in use are leaky. That is, the adversary can obtain the result of evaluating any function on the local state of the device, as long as this function has short output. In addition the adversary also controls the communication between the devices. (ii) The number of hardware devices used in an obfuscation and the amount of work they perform are polynomial in the security parameter independently of the obfuscated function's complexity. (iii) A(universal) set of hardware components, owned by the user, is initialized only once and from that point on can be used with multiple \software-based" obfuscations sent by different vendors.
    [Show full text]
  • Curriculum Vitae
    CURRICULUM VITAE Ran Canetti February 15, 2013 Address: Department of computer Science, Boston University 111 Cummington St., Boston, MA 02215 Email: [email protected] Education: Postdoctoral Training: Lab of Computer Science, MIT, 1995-6. Supervisor: Prof. Shafi Gold- wasser. Ph.D.: The Weizmann Institute, Rehovot, Israel, 1995. The thesis is entitled \Studies in Secure Multiparty Computation and Applications", under the supervision of Prof. Oded Goldreich. M.Sc.: Technion, Haifa, Israel, 1991. The thesis is entitled \Tradeoffs between Randomness and Communication Complexity", under the supervision of Prof. Oded Goldreich. B.A.: Technion, Haifa, Israel. B.A. in Physics, cum laude, 1990. B.A. in Computer Science, cum laude, 1989. Positions Held: Associate Director for Research of the Center for Reliable Information Systems and Cyber Security (RISCS) at Boston University, since September 2011. Professor, Department of Computer Science, Boston University, since July 2011. Director, The Check Point Institute for Information Security, since 2008 (on leave). Associate Professor, School of Computer Science, Tel Aviv University, since 2008 (on leave). Researcher, Department of Network Security and Cryptography, IBM T.J. Watson Research Center, 1996-2008. Visiting Scientist, Computer Science and Artificial Intelligence Laboratory, MIT, 2004-2008. 1 Research Interests: Foundations of cryptography, network and system security, distributed algorithms and systems. Professional Activity: Journal Editorship: Editorial Board Member, Information and Computation, since 2007. Associate Editor, Journal of Cryptology, since 2002. Conference Program Committees: Program Committee co-chair, Crypto, 2012 and 2013. Program Committee Chair, TCC (Theoretical Cryptography Conference), 2008. PC member for Crypto'00, PODC'01, Crypto'01, NDSS'03, FMCS'03, FOCS'03, TCC'04, FMCS'04, SCN'04, ACNS'05, CSFW'05, FOCS'05, DCC'06, CSFW'06, WATC'07, TCC'07, ICALP'07, STOC'09, FCC'09, Eurocrypt'10.
    [Show full text]
  • Visions of Cryptography
    Celebration of the work of Shafi Goldwasser and Silvio Micali Visions of Cryptography December 11th-12th, 2013 The David Lopatie Conference Centre, Weizmann Institute of Science, Israel Wednesday December 11th Thursday, December 12th 10:00 Opening Notes, Oded Goldreich 10:00 Re-Opening Notes: Oded Goldreich Session 1 Chair: Moni Naor Session 4 Chair: Phil Rogaway 10:05-11:05 Daniele Micciancio and Chris Peikert 10:05-10:50 Benny Applebaum Lattices - from complexity to cryptography Recent advances in garbling circuits 11:20-12:20 Shai Halevi 11:10-12:00 Rafail Ostrovsky and Daniel Wichs Multilinear maps Private RAM Computation Lunch Lunch Session 2 Chair: Ivan Damgard Session 5 Chair: Ran Canetti 14:00-14:45 Stefano Tessaro 13:45-14:30 Iftach Haitner Ideal Models in Symmetric Cryptography Coin Flipping Implies One-Way Functions 15:00-15:10 Krzysztof Pietrzak 14:50-15:50 Abhishek Jain and Huijia (Rachel) Lin Nesting Hybrids Concurrent Security - A Survey 15:15-15:30 Vipul Goyal Coffee Break Non-Black Box Simulation in Fully Concurrent Setting Session 6 Chair: Eyal Kushilevitz 15:35-15:45 Jesper Buus Nielsen Limits on the Power of Cryptographic Cheap Talk 16:20-16:35 Yevgeniy Dodis Key derivation without entropy waste Coffee Break 16:40-17:40 Amit Sahai and Brent Waters Session 3 Chair: Zvika Brakerski The Cryptographic Lens, General-Purpose Obfuscation and its Applications 16:15-17:05 Nir Bitansky Extractable Functions: Fiction or Reality? 17:50-18:20 Panel discussion on Future Directions Ivan Damgard, Yuval Ishai, Tal Malkin, 17:15-18:15 Panel discussion on Assumptions Daniele Micciancio, and Amit Sahai Boaz Barak, Ran Canetti, Craig Gentry, Eike Kiltz, Moni Naor, and Rafael Pass 18:25 A closing note: Oded Goldreich 18:20 A mid-way note: Oded Goldreich Dinner (in Jaffa, provided incl transportation) Dinner An open problem / rump session, organized x is true! by Tal Rabin x ?? !! Supported by the I- CORE program of the planning and budgeting committee and the Israel science foundation.
    [Show full text]
  • Studies in Program Obfuscation Mayank Varia
    Studies in Program Obfuscation by Mayank Varia B.S.E., Duke University, 2005 Submitted to the Department of Mathematics in partial fulfillment of the requirements for the degree of Doctor of Philosophy at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY September 2010 c 2010 Mayank Varia. All rights reserved. The author hereby grants to MIT permission to reproduce and to distribute publicly paper and electronic copies of this thesis document in whole or in part in any medium now known or hereafter created. Author................................................................................... Department of Mathematics August 6, 2010 Certified by............................................................................... Ran Canetti Associate Professor, School of Computer Science, Tel Aviv University Thesis Supervisor Accepted by.............................................................................. Michel Goemans Chairman, Applied Mathematics Committee 2 Studies in Program Obfuscation by Mayank Varia Submitted to the Department of Mathematics on August 6, 2010, in partial fulfillment of the requirements for the degree of Doctor of Philosophy Abstract Program obfuscation is the software analog to the problem of tamper-proofing hardware. The goal of program obfuscation is to construct a compiler, called an \obfuscator," that garbles the code of a computer program while maintaining its functionality. Commercial products exist to perform this procedure, but they do not provide a rigorous se- curity guarantee. Over the past decade, program obfuscation has been studied by the theoretical cryptography community, where rigorous definitions of security have been proposed and obfuscators have been constructed for some families of programs. This thesis presents three contributions based on the virtual black-box security definition of Barak et al [10]. First, we show tight connections between obfuscation and symmetric-key encryption. Specifi- cally, obfuscation can be used to construct an encryption scheme with strong leakage resilience and key-dependent message security.
    [Show full text]
  • Composable Formal Security Analysis: Juggling Soundness, Simplicity and Efficiency
    Composable Formal Security Analysis: Juggling Soundness, Simplicity and Efficiency Ran Canetti? IBM Research Abstract. A security property of a protocol is composable if it remains intact even when the protocol runs alongside other protocols in the same system. We describe a method for asserting composable security prop- erties, and demonstrate its usefulness. In particular, we show how this method can be used to provide security analysis that is formal, relatively simple, and still does not make unjustified abstractions of the underlying cryptographic algorithms in use. It can also greatly enhance the feasibil- ity of automated security analysis of systems of realistic size. 1 Introduction Security analysis of protocols is a slippery business. On the one hand, we want to capture all \feasible attacks". On the other hand, we want to allow those protocols that do not succumb to attacks. Indeed, time and again attacks are found against protocols that were thoroughly analyzed and sometime even de- ployed and standardized (see e.g. [Ble98,Low96]). The situation is particularly tricky when the analyzed protocol uses \cryptographic primitives", namely algo- rithms that guarantee certain behaviors only when the adversarial components of system are computationally bounded. A crucial first step in any rigorous security analysis is to devise an appropri- ate mathematical model for representing protocols and formulating the desired security properties. Indeed, the analysis can only be meaningful to the degree that the devised model and the formulated security requirements are meaningful. Many models for analyzing security of protocols have been proposed over the past few decades, each with its own advantages and drawbacks.
    [Show full text]