Visions of Cryptography

Total Page：16

File Type：pdf, Size：1020Kb

Celebration of the work of Shafi Goldwasser and Silvio Micali Visions of Cryptography December 11th-12th, 2013 The David Lopatie Conference Centre, Weizmann Institute of Science, Israel Wednesday December 11th Thursday, December 12th 10:00 Opening Notes, Oded Goldreich 10:00 Re-Opening Notes: Oded Goldreich Session 1 Chair: Moni Naor Session 4 Chair: Phil Rogaway 10:05-11:05 Daniele Micciancio and Chris Peikert 10:05-10:50 Benny Applebaum Lattices - from complexity to cryptography Recent advances in garbling circuits 11:20-12:20 Shai Halevi 11:10-12:00 Rafail Ostrovsky and Daniel Wichs Multilinear maps Private RAM Computation Lunch Lunch Session 2 Chair: Ivan Damgard Session 5 Chair: Ran Canetti 14:00-14:45 Stefano Tessaro 13:45-14:30 Iftach Haitner Ideal Models in Symmetric Cryptography Coin Flipping Implies One-Way Functions 15:00-15:10 Krzysztof Pietrzak 14:50-15:50 Abhishek Jain and Huijia (Rachel) Lin Nesting Hybrids Concurrent Security - A Survey 15:15-15:30 Vipul Goyal Coffee Break Non-Black Box Simulation in Fully Concurrent Setting Session 6 Chair: Eyal Kushilevitz 15:35-15:45 Jesper Buus Nielsen Limits on the Power of Cryptographic Cheap Talk 16:20-16:35 Yevgeniy Dodis Key derivation without entropy waste Coffee Break 16:40-17:40 Amit Sahai and Brent Waters Session 3 Chair: Zvika Brakerski The Cryptographic Lens, General-Purpose Obfuscation and its Applications 16:15-17:05 Nir Bitansky Extractable Functions: Fiction or Reality? 17:50-18:20 Panel discussion on Future Directions Ivan Damgard, Yuval Ishai, Tal Malkin, 17:15-18:15 Panel discussion on Assumptions Daniele Micciancio, and Amit Sahai Boaz Barak, Ran Canetti, Craig Gentry, Eike Kiltz, Moni Naor, and Rafael Pass 18:25 A closing note: Oded Goldreich 18:20 A mid-way note: Oded Goldreich Dinner (in Jaffa, provided incl transportation) Dinner An open problem / rump session, organized x is true! by Tal Rabin x ?? !! Supported by the I- CORE program of the planning and budgeting committee and the Israel science foundation.

Copy Link

Recommended publications

Secure Merge with O(N Log Log N) Secure Operations
Secure Merge with O(n log log n) Secure Operations Brett Hemenway Falk # University of Pennsylvania, Philadelphia, PA, USA Rafail Ostrovsky # University of California, Los Angeles, CA, USA Abstract Data-oblivious algorithms are a key component of many secure computation protocols. In this work, we show that advances in secure multiparty shuffling algorithms can be used to increase the efficiency of several key cryptographic tools. The key observation is that many secure computation protocols rely heavily on secure shuffles. The best data-oblivious shuffling algorithms require O(n log n), operations, but in the two-party or multiparty setting, secure shuffling can be achieved with only O(n) communication. Leveraging the efficiency of secure multiparty shuffling, we give novel, information-theoretic algorithms that improve the efficiency of securely sorting sparse lists, secure stable compaction, and securely merging two sorted lists. Securely sorting private lists is a key component of many larger secure computation protocols. The best data-oblivious sorting algorithms for sorting a list of n elements require O(n log n) comparisons. Using black-box access to a linear-communication secure shuffle, we give a secure algorithm for sorting a list of length n with t ≪ n nonzero elements with communication O(t log2 n + n), which beats the best oblivious algorithms when the number of nonzero elements, t, satisfies t < n/ log2 n. Secure compaction is the problem of removing dummy elements from a list, and is essentially equivalent to sorting on 1-bit keys. The best oblivious compaction algorithms run in O(n)-time, but they are unstable, i.e., the order of the remaining elements is not preserved.
[Show full text]
Universally Composable Security: a New Paradigm for Cryptographic Protocols∗
Universally Composable Security: A New Paradigm for Cryptographic Protocols∗ Ran Canettiy February 11, 2020 Abstract We present a general framework for describing cryptographic protocols and analyzing their security. The framework allows specifying the security requirements of practically any crypto- graphic task in a unified and systematic way. Furthermore, in this framework the security of protocols is preserved under a general composition operation, called universal composition. The proposed framework with its security-preserving composition operation allows for mod- ular design and analysis of complex cryptographic protocols from simpler building blocks. More- over, within this framework, protocols are guaranteed to maintain their security in any context, even in the presence of an unbounded number of arbitrary protocol sessions that run concur- rently in an adversarially controlled manner. This is a useful guarantee, which allows arguing about the security of cryptographic protocols in complex and unpredictable environments such as modern communication networks. Keywords: cryptographic protocols, security analysis, protocol composition, universal composi- tion. ∗An extended abstract of this work appears in the proceedings of the 42nd Foundations of Computer Science conference, 2001. This is an updated version. While the overall spirit and the structure of the definitions and results in this paper has remained the same, many important details have changed. We point out and motivate the main differences as we go along. Earlier versions of this work appeared in December 2018, July 2013, Decem- ber and January 2005, and October 2001, under the same title, and in December 2000 under the title \A unified framework for analyzing security of protocols". These earlier versions can be found at the ECCC archive, TR 01-16 (http://eccc.uni-trier.de/eccc-reports/2001/TR01-016); however they are not needed for understanding this work and have only historic significance.
[Show full text]
Magic Adversaries Versus Individual Reduction: Science Wins Either Way ?
Magic Adversaries Versus Individual Reduction: Science Wins Either Way ? Yi Deng1;2 1 SKLOIS, Institute of Information Engineering, CAS, Beijing, P.R.China 2 State Key Laboratory of Cryptology, P. O. Box 5159, Beijing ,100878,China [email protected] Abstract. We prove that, assuming there exists an injective one-way function f, at least one of the following statements is true: – (Infinitely-often) Non-uniform public-key encryption and key agreement exist; – The Feige-Shamir protocol instantiated with f is distributional concurrent zero knowledge for a large class of distributions over any OR NP-relations with small distinguishability gap. The questions of whether we can achieve these goals are known to be subject to black-box lim- itations. Our win-win result also establishes an unexpected connection between the complexity of public-key encryption and the round-complexity of concurrent zero knowledge. As the main technical contribution, we introduce a dissection procedure for concurrent ad- versaries, which enables us to transform a magic concurrent adversary that breaks the distribu- tional concurrent zero knowledge of the Feige-Shamir protocol into non-black-box construc- tions of (infinitely-often) public-key encryption and key agreement. This dissection of complex algorithms gives insight into the fundamental gap between the known universal security reductions/simulations, in which a single reduction algorithm or simu- lator works for all adversaries, and the natural security definitions (that are sufficient for almost all cryptographic primitives/protocols), which switch the order of qualifiers and only require that for every adversary there exists an individual reduction or simulator. 1 Introduction The seminal work of Impagliazzo and Rudich [IR89] provides a methodology for studying the lim- itations of black-box reductions.
[Show full text]
CHURP: Dynamic-Committee Proactive Secret Sharing
CHURP: Dynamic-Committee Proactive Secret Sharing Sai Krishna Deepak Maram∗† Cornell Tech Fan Zhang∗† Lun Wang∗ Andrew Low∗ Cornell Tech UC Berkeley UC Berkeley Yupeng Zhang∗ Ari Juels∗ Dawn Song∗ Texas A&M Cornell Tech UC Berkeley ABSTRACT most important resources—money, identities [6], etc. Their loss has We introduce CHURP (CHUrn-Robust Proactive secret sharing). serious and often irreversible consequences. CHURP enables secure secret-sharing in dynamic settings, where the An estimated four million Bitcoin (today worth $14+ Billion) have committee of nodes storing a secret changes over time. Designed for vanished forever due to lost keys [69]. Many users thus store their blockchains, CHURP has lower communication complexity than pre- cryptocurrency with exchanges such as Coinbase, which holds at vious schemes: O¹nº on-chain and O¹n2º off-chain in the optimistic least 10% of all circulating Bitcoin [9]. Such centralized key storage case of no node failures. is also undesirable: It erodes the very decentralization that defines CHURP includes several technical innovations: An efficient new blockchain systems. proactivization scheme of independent interest, a technique (using An attractive alternative is secret sharing. In ¹t;nº-secret sharing, asymmetric bivariate polynomials) for efficiently changing secret- a committee of n nodes holds shares of a secret s—usually encoded sharing thresholds, and a hedge against setup failures in an efficient as P¹0º of a polynomial P¹xº [73]. An adversary must compromise polynomial commitment scheme. We also introduce a general new at least t +1 players to steal s, and at least n−t shares must be lost technique for inexpensive off-chain communication across the peer- to render s unrecoverable.
[Show full text]
Improved Threshold Signatures, Proactive Secret Sharing, and Input Certification from LSS Isomorphisms
Improved Threshold Signatures, Proactive Secret Sharing, and Input Certification from LSS Isomorphisms Diego F. Aranha1, Anders Dalskov2, Daniel Escudero1, and Claudio Orlandi1 1 Aarhus University, Denmark 2 Partisia, Denmark Abstract. In this paper we present a series of applications steming from a formal treatment of linear secret-sharing isomorphisms, which are linear transformations between different secret-sharing schemes defined over vector spaces over a field F and allow for efficient multiparty conversion from one secret-sharing scheme to the other. This concept generalizes the folklore idea that moving from a secret-sharing scheme over Fp to a secret sharing \in the exponent" can be done non-interactively by multiplying the share unto a generator of e.g., an elliptic curve group. We generalize this idea and show that it can also be used to compute arbitrary bilinear maps and in particular pairings over elliptic curves. We include the following practical applications originating from our framework: First we show how to securely realize the Pointcheval-Sanders signature scheme (CT-RSA 2016) in MPC. Second we present a construc- tion for dynamic proactive secret-sharing which outperforms the current state of the art from CCS 2019. Third we present a construction for MPC input certification using digital signatures that we show experimentally to outperform the previous best solution in this area. 1 Introduction A(t; n)-secure secret-sharing scheme allows a secret to be distributed into n shares in such a way that any set of at most t shares are independent of the secret, but any set of at least t + 1 shares together can completely reconstruct the secret.
[Show full text]
A Decade of Lattice Cryptography
Full text available at: http://dx.doi.org/10.1561/0400000074 A Decade of Lattice Cryptography Chris Peikert Computer Science and Engineering University of Michigan, United States Boston — Delft Full text available at: http://dx.doi.org/10.1561/0400000074 Foundations and Trends R in Theoretical Computer Science Published, sold and distributed by: now Publishers Inc. PO Box 1024 Hanover, MA 02339 United States Tel. +1-781-985-4510 www.nowpublishers.com [email protected] Outside North America: now Publishers Inc. PO Box 179 2600 AD Delft The Netherlands Tel. +31-6-51115274 The preferred citation for this publication is C. Peikert. A Decade of Lattice Cryptography. Foundations and Trends R in Theoretical Computer Science, vol. 10, no. 4, pp. 283–424, 2014. R This Foundations and Trends issue was typeset in LATEX using a class ﬁle designed by Neal Parikh. Printed on acid-free paper. ISBN: 978-1-68083-113-9 c 2016 C. Peikert All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, mechanical, photocopying, recording or otherwise, without prior written permission of the publishers. Photocopying. In the USA: This journal is registered at the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923. Authorization to photocopy items for in- ternal or personal use, or the internal or personal use of speciﬁc clients, is granted by now Publishers Inc for users registered with the Copyright Clearance Center (CCC). The ‘services’ for users can be found on the internet at: www.copyright.com For those organizations that have been granted a photocopy license, a separate system of payment has been arranged.
[Show full text]
2011, Velopment of Software Platforms Techniques
Winter 2010/11 TEL AVIV UNIVERSITY REVIEW Science and the Sacred Explosives Detection Digitizing Architectural Design Israel-India Ties Information Overload 9 New faculty member Prof. Ronitt Rubinfeld uses advanced math- ematical techniques Cover story: to make sense of the The Science of data deluge. Judaism 2 From digitizing the Cairo Geniza to studying biblical weather, TAU Honing Israel’s scholars are offering fresh scientif- Security Edge 10 ic perspectives on Jewish culture The Yuval Ne’eman Workshop in and religion. Science, Technology and Security influences Israel’s national security policy. Closing a Circle 14 A community TEL AVIV UNIVERSITY REVIEW outreach program Winter 2010/11 Winter helps children cope with the loss of a relative from cancer. Issued by the Strategic Communications Dept. Development and Public Affairs Division Tel Aviv University Ramat Aviv 69978 Tel Aviv, Israel Prizes 37 TAU physicist Prof. Yakir Aharonov Tel: +972 3 6408249 sections Fax: + 972 3 6407080 receives the US National Medal of Science from President Barack E-mail: [email protected] Obama www.tau.ac.il innovations 16 Editor: Louise Shalev Contributors: Rava Eleasari, Pauline Reich, Ruti Ziv, Michal Alexander, Sarah Lubelski, Gil Zohar leadership 20 Graphic Design: TAU Graphic Design Studio/ Michal Semo-Kovetz; Dalit Pessach Dio’olamot Photography: Development and Public Affairs Division initiatives Photography Department/Michal Roche Ben Ami, 24 Michal Kidron Additional Photography: Ryan K Morris Photography and the National Science & Technology Medals associations 26 Foundation; Yaron Hershkovic; Avraham Hay, from the Wolfe Family Collection, courtesy of the Bible Lands Museum, Jerusalem; Yoram Reshef digest 34 Administrative Coordinator: Pauline Reich Administrative Assistant: Shay Bramson Translation Services: Sagir Translations, Offiservice newsmakers Printing: Eli Meir Printing 39 Officers of Tel Aviv University a Harvey M.
[Show full text]
Resettably Sound Zero-Knoweldge Arguments from Owfs - the (Semi) Black-Box Way
Resettably Sound Zero-Knoweldge Arguments from OWFs - the (semi) Black-Box way Rafail Ostrovsky Alessandra Scafuro Muthuramakrishnan UCLA, USA UCLA, USA Venkitasubramaniam University of Rochester, USA Abstract We construct a constant-round resettably-sound zero-knowledge argument of knowledge based on black-box use of any one-way function. Resettable-soundness was introduced by Barak, Goldreich, Goldwasser and Lindell [FOCS 01] and is a strengthening of the soundness requirement in interactive proofs demanding that soundness should hold even if the malicious prover is allowed to “reset” and “restart” the verifier. In their work they show that resettably-sound ZK arguments require non-black-box simula- tion techniques, and also provide the first construction based on the breakthrough simulation technique of Barak [FOCS 01]. All known implementations of Barak’s non-black-box technique required non-black-box use of a collision-resistance hash-function (CRHF). Very recently, Goyal, Ostrovsky, Scafuro and Visconti [STOC 14] showed an implementation of Barak’s technique that needs only black-box access to a collision-resistant hash-function while still having a non-black-box simulator. (Such a construction is referred to as semi black-box.) Plugging this implementation in the BGGL’s construction yields the first resettably-sound ZK arguments based on black-box use of CRHFs. However, from the work of Chung, Pass and Seth [STOC 13] and Bitansky and Paneth [STOC 13], we know that resettably-sound ZK arguments can be constructed from non-black-box use of any one-way function (OWF), which is the minimal assumption for ZK arguments. Hence, a natural question is whether it is possible to construct resettably-sound zero- knowledge arguments from black-box use of any OWF only.
[Show full text]
CURRICULUM VITAE Rafail Ostrovsky
last updated: December 26, 2020 CURRICULUM VITAE Rafail Ostrovsky Distinguished Professor of Computer Science and Mathematics, UCLA http://www.cs.ucla.edu/∼rafail/ mailing address: Contact information: UCLA Computer Science Department Phone: (310) 206-5283 475 ENGINEERING VI, E-mail: [email protected] Los Angeles, CA, 90095-1596 Research • Cryptography and Computer Security; Interests • Streaming Algorithms; Routing and Network Algorithms; • Search and Classiﬁcation Problems on High-Dimensional Data. Education NSF Mathematical Sciences Postdoctoral Research Fellow Conducted at U.C. Berkeley 1992-95. Host: Prof. Manuel Blum. Ph.D. in Computer Science, Massachusetts Institute of Technology, 1989-92. • Thesis titled: \Software Protection and Simulation on Oblivious RAMs", Ph.D. advisor: Prof. Silvio Micali. Final version appeared in Journal of ACM, 1996. Practical applications of thesis work appeared in U.S. Patent No.5,123,045. • Minor: \Management and Technology", M.I.T. Sloan School of Management. M.S. in Computer Science, Boston University, 1985-87. B.A. Magna Cum Laude in Mathematics, State University of New York at Buﬀalo, 1980-84. Department of Mathematics Graduation Honors: With highest distinction. Personal • U.S. citizen, naturalized in Boston, MA, 1986. Data Appointments UCLA Computer Science Department (2003 { present): Distinguished Professor of Computer Science. Recruited in 2003 as a Full Professor with Tenure. UCLA School of Engineering (2003 { present): Director, Center for Information and Computation Security. (See http://www.cs.ucla.edu/security/.) UCLA Department of Mathematics (2006 { present): Distinguished Professor of Mathematics (by courtesy). 1 Appointments Bell Communications Research (Bellcore) (cont.) (1999 { 2003): Senior Research Scientist; (1995 { 1999): Research Scientist, Mathematics and Cryptography Research Group, Applied Research.
[Show full text]
Multi-Input Functional Encryption with Unbounded-Message Security
Multi-Input Functional Encryption with Unbounded-Message Security Vipul Goyal ⇤ Aayush Jain † Adam O’ Neill‡ Abstract Multi-input functional encryption (MIFE) was introduced by Goldwasser et al. (EUROCRYPT 2014) as a compelling extension of functional encryption. In MIFE, a receiver is able to compute a joint function of multiple, independently encrypted plaintexts. Goldwasser et al. (EUROCRYPT 2014) show various applications of MIFE to running SQL queries over encrypted databases, computing over encrypted data streams, etc. The previous constructions of MIFE due to Goldwasser et al. (EUROCRYPT 2014) based on in- distinguishability obfuscation had a major shortcoming: it could only support encrypting an apriori bounded number of message. Once that bound is exceeded, security is no longer guaranteed to hold. In addition, it could only support selective-security,meaningthatthechallengemessagesandthesetof “corrupted” encryption keys had to be declared by the adversary up-front. In this work, we show how to remove these restrictions by relying instead on sub-exponentially secure indistinguishability obfuscation. This is done by carefully adapting an alternative MIFE scheme of Goldwasser et al. that previously overcame these shortcomings (except for selective security wrt. the set of “corrupted” encryption keys) by relying instead on diﬀering-inputs obfuscation, which is now seen as an implausible assumption. Our techniques are rather generic, and we hope they are useful in converting other constructions using diﬀering-inputs obfuscation to ones using sub-exponentially secure indistinguishability obfuscation instead. ⇤Microsoft Research, India. Email: [email protected]. †UCLA, USA. Email: [email protected]. Work done while at Microsoft Research, India. ‡Georgetown University, USA. Email: [email protected].
[Show full text]
Algorithms and Complexity Results for Learning and Big Data
Algorithms and Complexity Results for Learning and Big Data BY Ad´ am´ D. Lelkes B.Sc., Budapest University of Technology and Economics, 2012 M.S., University of Illinois at Chicago, 2014 THESIS Submitted as partial fulfillment of the requirements for the degree of Doctor of Philosophy in Mathematics in the Graduate College of the University of Illinois at Chicago, 2017 Chicago, Illinois Defense Committee: GyörgyTurán,Chair and Advisor Lev Reyzin, Advisor Shmuel Friedland Lisa Hellerstein, NYU Tandon School of Engineering Robert Sloan, Department of Computer Science To my parents and my grandmother / Szüleimnekésnagymamámnak ii Acknowledgments I had a very enjoyable and productive four years at UIC, which would not have been possible without my two amazing advisors, Lev Reyzin and György Turán. I would like to thank them for their guidance and support in every aspect of my graduate studies and research and for always being available when I had questions. Gyuri's humility, infinite patience, and meticulous attention to detail, as well as the breadth and depth of his knowledge, set an example for me to aspire to. Lev's energy and enthusiasm for research and his effectiveness at doing it always inspired me; the hours I spent in Lev's office were often the most productive hours of my week. Both Gyuri and Lev served as role models for me both as researchers and as people. Also, I would like to thank Gyuri and his wife Rózsafor their hospitality. They invited me to their home a countless number of times, which made time in Chicago much more pleasant.
[Show full text]
Cryptanalysis of Boyen's Attribute-Based Encryption Scheme
Cryptanalysis of Boyen’s Attribute-Based Encryption Scheme in TCC 2013 Shweta Agrawal1, Rajarshi Biswas1, Ryo Nishimaki2, Keita Xagawa2, Xiang Xie3, and Shota Yamada4 1 IIT Madras, Chennai, India [email protected], [email protected] 2 NTT Secure Platform Laboratories, Tokyo, Japan [ryo.nishimaki.zk,keita.xagawa.zv]@hco.ntt.co.jp 3 Shanghai Key Laboratory of Privacy-Preserving Computation, China [email protected] 4 National Institute of Advanced Industrial Science and Technology (AIST), Tokyo [email protected] Abstract. In TCC 2013, Boyen suggested the first lattice based con- struction of attribute based encryption (ABE) for the circuit class NC1. Unfortunately, soon after, a flaw was found in the security proof of the scheme. However, it remained unclear whether the scheme is actually insecure, and if so, whether it can be repaired. Meanwhile, the construc- tion has been heavily cited and continues to be extensively studied due to its technical novelty. In particular, this is the first lattice based ABE which uses linear secret sharing schemes (LSSS) as a crucial tool to en- force access control. In this work, we show that the scheme is in fact insecure. To do so, we provide a polynomial-time attack that completely breaks the security of the scheme. We suggest a route to fix the security of the scheme, via the notion of admissible linear secret sharing schemes (LSSS) and instantiate these for the class of DNFs. Subsequent to our work, Datta, Komargodski and Waters (Eurocrypt 2021) provided a construction of admissible LSSS for NC1 and resurrected Boyen’s claimed result.
[Show full text]