Secure multiparty computation (MPC) over Z2kis more efficient than computations over fields, and studying MPC protocols under malicious security has practical application value. Malicious security with a dishonest majority over rings remains challenging. The most popular approach is SPDZ2k, however, this is a specific protocol that does not support the transformation of any existing semi-honest MPC protocols into malicious security protocols. The zero knowledge proof (ZKP)-based compiler satisfies this requirement. Existing state-of-the-art protocols have logarithmic online communication overhead in terms of the circuit size |C|, and their direct application to rings is nontrivial as they were originally designed for finite fields. In this work, we investigate the communication overhead to develop malicious security protocols. We bridge the gap between malicious security with abort and semi-honest security, by constructing a “GMW-style” verification protocol to achieve malicious security in a dishonest majority setting. This approach incurs a constant online communication overhead by enhancing the machinery of zero-knowledge fully linear interactive oracle proof (zk-FLIOP). Additionally, we extend the zk-FLIOP to work over any ring by invoking reverse multiplication friendly embeddings (RMFEs). Our results show that the online communication complexity of the verification process depends on only the security parameter, the number of parties, and the ring size. Furthermore, for small-scale circuits over Z2, we designed a distributed lookup table argument where both the total communication complexity and the computational cost are independent of the circuit size but of the input wires.

In the field of machine learning, PCA based face recognition is widely applied in identity authentication and access control. Due to limited storage and computational capabilities, the client often needs to outsources face recognition tasks to cloud servers, which brings privacy leakage risks. Existing privacy-preserving schemes calculate the inner product of encrypted vectors to perform face matching, but they involve complex operations, making efficient recognition challenging and lacking in automatic verification of computational integrity. In this paper, we propose a blockchain-aided privacy-preserving PCA based face recognition scheme. Our approach uses sparse matrices to construct keys, reducing the number of non-zero elements in matrix operations. The scheme also introduces a blockchainaided verification and payment mechanism based on hash commitments to verify the integrity of computation tasks. This mechanism allows encrypted face images and face recognition results to be uploaded to the blockchain, effectively reducing the number of interactions between the client and the cloud server. Experimental results demonstrate that this scheme reduces the overall execution time by 43% without compromising recognition accuracy, achieving a recognition accuracy rate of 99.35%.

For the huge amount of data from the Internet of Things (IoT) devices, multiple kernel learning is a widely concerned issue in data analyzing, among which the multiple kernel fuzzy clustering (MKFC) algorithm is an effective approach for extracting linear features in high-dimensional space. For a time-consuming multiple kernel clustering task, it is meaningful to find a secure and efficient outsourcing scheme in the edge-end collaborative architecture, which utilizes edge computing resources while resisting untrusted edge servers. However, existing secure outsourcing schemes cannot align well with the distributed and real-time characteristics of edge computing due to their complex encryption processes. In this article, we propose a secure MKFC outsourcing scheme based on a novel matrix blinding method. The proposed novel matrix blinding method conducts two related encryption operations with disturbance terms, which avoids specific disturbance elimination computations, to reduce the computational burdens in the decryption phase. Additionally, we introduce a sampling verification method to detect the server’s deceptive behaviors. The theoretical analysis demonstrates that our scheme guarantees data privacy and has the capability to verify incorrect results. The experimental results indicate that our scheme is 6.73% superior to other schemes on average when conducting matrix outsourcing computation and enhances the efficiency of conducting the MKFC algorithm by 10.44% to 55.70% on different datasets.

Multi-party private set intersection (PSI) enables multiple parties to compute the common items of private sets without disclosing any other information beyond the result; thus, it has gained significant importance in various distributed computation scenarios. As the number of participants increases, the performance of multi-party PSI protocols is significantly influenced, primarily by the number of interaction rounds needed. In this study, we propose two novel multi-party PSI protocols: the first one is 1MPSI, and the second is 2MPSI. The 1MPSI appears as a wheel structure where the parties need only one round of interactive communication online. 1MPSI is based on the Ring version of Oblivious Linear-function Evaluation (OLE). Benefiting from the wheel structure, 1MPSI supports parallel computation and achieves competitive efficiency between the leader and the other participants (OLE receivers) after input-independent precomputation. The 2MPSI adopts a dual-core star structure and introduces Oblivious Key-Value Store (OKVS), which results in better performance when handling larger set sizes and more participants. Our protocols are designed with simplicity and ease of implementation in mind. Experimental evaluations demonstrate the superiority of our protocols over current open-source multi-party PSI protocols as the set size increases from 212to 220when involving 10 and 16 parties. In a test with 16 parties each inputting 220elements, 2MPSI achieves a runtime of only 65 seconds.

Abstract Lattice-based online/offline signature is attractive for the merit of resisting quantum attacks besides the short online response time. Prior to this work, the hash-sign-switch paradigm lattice-based online/offline signatures usually increase the length of each signature, and the Fiat–Shamir candidates are highly inefficient due to multiple aborts in online signing phase. In this work we mainly address its efficient issue and propose a new paradigm of its construction in the perspective of abort. In this paradigm, one tries to remove one or more aborts from online to offline signing phase by $\Gamma $-transformation. Specifically, this work proposes an efficient lattice-based online/offline signature scheme with fewer online aborts and thus allows the signer to obtain a valid signature by fewer online repetitions. Through this way, the resulting scheme can reduce much online signing time with the same signature size. The performance evaluation shows that our scheme is efficient and practical.

Private aggregation of teacher ensembles (PATE), a general machine learning framework based on knowledge distillation, can provide a privacy guarantee for training data sets. However, this framework poses a number of security risks. First, PATE mainly focuses on the privacy of teachers' training data and fails to protect the privacy of their students' data. Second, PATE relies heavily on a trusted aggregator to count teachers' votes, which is not convincing enough to assume a third party would never leak teachers' votes during the knowledge transfer process. To address the abovementioned issues, we improve the original PATE framework and present a new one that combines secret sharing with Intel Software Guard Extensions in a novel way. In the proposed framework, teachers are trained locally, then uploaded and stored in two computing servers in the form of secret shares. In the knowledge transfer phase, the two computing servers receive shares of private inputs from students before collaboratively performing secure predictions. Thus neither teachers nor students expose sensitive information. During the aggregation process, we propose an effective masking technique suitable for the setting to keep the prediction results private and prevent the votes from being leaked to the aggregation server. Besides, we optimize the aggregation mechanism and add noise perturbations adaptively based on the posterior entropy of the prediction results. Finally, we evaluate the performance of the new framework on multiple data sets and experimentally demonstrate that the new framework allows highly efficient, accurate, and secure predictions.

Federated learning (FL), as a prospective way to process and analyze the massive data from the Internet of Things (IoT) devices, has attracted increasing attention from academia and industry. However, considering the unreliable nature of IoT devices, ensuring the efficiency of FL while protecting the privacy of devices’ input data is a challenging task. To address these issues, we propose a secure aggregation protocol based on efficient additive secret sharing in the fog-computing (FC) setting. As the secure aggregation is performed frequently in the training process of FL, the protocol should have low communication and computation overhead. First, we use a fog node (FN) as an intermediate processing unit to provide local services which can assist the cloud server aggregated the sum during the training process. Second, we design a light Request-then-Broadcast method to ensure our protocol has the robustness to dropped-out clients. Our protocol also provides two simple new client selection methods. The security and performance of our protocol are analyzed and compared with existed schemes. We conduct experiments on high-dimensional inputs, and our experimental results demonstrate about 24–$168\times $improvement in computation overhead and 87–$287\times $improvement in communication overhead compared to Google’s secure aggregation protocol (Bonwatiwz et al. CCS17).

Data security and privacy have become an important problem while big data systems are growing dramatically fast in various application fields. Paillier additive homomorphic cryptosystem is widely used in information security fields such as big data security, communication security, cloud computing security, and artificial intelligence security. However, how to improve its computational performance is one of the most critical problems in practice. In this paper, we propose two modifications to improve the performance of the Paillier cryptosystem. Firstly, we introduce a key generation method to generate the private key with low Hamming weight, and this can be used to accelerate the decryption computation of the Paillier cryptosystem. Secondly, we propose an acceleration method based on Hensel lifting in the Paillier cryptosystem. This method can obtain a faster and improved decryption process by showing the mathematical analysis of the decryption algorithm.

We propose postquantum universal composable (UC) cut-and-choose oblivious transfer (CCOT) protocol under the malicious adversary model. In secure two-party computation, we construct s copies’ garbled circuits, including half check circuit and half evaluation circuit. The sender can transfer the key to the receiver by CCOT protocol. Compared to PVW-OT [6] framework, we invoke WQ-OT [35] framework with reusability of common random string ( crs ) and better security. Relying on LWE’s assumption and the property of the Rounding function, we construct an UC-CCOT protocol, which can resist quantum attack in secure two-party computation.

Elliptic curve cryptosystem has been widely applied in a lot of fields, such as finance, E-commerce and E-government. In this paper, we propose an optimized FPGA implementation of elliptic curve cryptosystem over 256-bit prime fields, which has high computational performance and low resource consumption. Specifically, we design a novel modular multiplier supporting four-level pipelining, which only needs 7 clock cycles to complete a single modular multiplication. It can process 4 modular multiplication operations (4 MMPO) simultaneously. We further design, on the basis of 4MMPO, a parallel architecture to efficiently implement point doubling and point addition operation. Finally, we testify the validity of our ECC processor on Xilinx's Virtex-7 FPGA platform. The result shows that it takes only 0.15ms for an elliptic curve point multiplication, the maximum frequency of the processor is about 123.27Mhz and the resource only needs 22938 look-up tables (LUTs).

In this paper, we design a new lattice-based linearly homomorphic signature scheme over F 2 . The existing schemes are all constructed based on hash-and-sign lattice-based signature framework, where the implementation of preimage sampling function is Gaussian sampling, and the use of trapdoor basis needs a larger dimension m ≥ 5 n log q . Hence, they cannot resist potential side-channel attacks and have larger sizes of public key and signature. Under Fiat–Shamir with aborting signature framework and general SIS problem restricted condition m ≥ n log q , we use uniform sampling of filtering technology to design the scheme, and then, our scheme has a smaller public key size and signature size than the existing schemes and it can resist side-channel attacks.

Oblivious transfer (OT) is a cryptographic primitive originally used to transfer a collection of messages from the sender to the receiver in an oblivious manner. OT extension protocol reduces expensive asymmetric operations by running a small number of OT instances first and then cheap symmetric operations. While most earlier works discussed security model or communication and computation complexity of OT in general case, we focus on concrete application scenarios, especially where the sender in the OT protocol is a database with less computation and limited interaction capability. In this paper, we propose a generic outsourced OT extension protocol ( O Tex ) that outsources all the asymmetric operations of the sender to a semihonest server so as to adapt to specific scenarios above. We give O Tex a standard security definition, and the proposed protocol is proven secure in the semihonest model. In O Tex , the sender works on the fly and performs only symmetric operations locally. Whatever the number of rounds OT to be executed and the length of messages in OT to be sent, our protocol realizes optimal complexity. Besides, O Tex can be used to construct high-level protocols, such as private membership test (PMT) and private set intersection (PSI). We believe our O Tex construction may be a building block in other applications as well.

Recently, several practical attacks raised serious concerns over the security of searchable encryption. The attacks have brought emphasis on forward privacy, which is the key concept behind solutions to the adaptive leakage-exploiting attacks, and will very likely to become a must-have property of all new searchable encryption schemes. For a long time, forward privacy implies inefficiency and thus most existing searchable encryption schemes do not support it. Very recently, Bost (CCS 2016) showed that forward privacy can be obtained without inducing a large communication overhead. However, Bost's scheme is constructed with a relatively inefficient public key cryptographic primitive, and has poor I/O performance. Both of the deficiencies significantly hinder the practical efficiency of the scheme, and prevent it from scaling to large data settings. To address the problems, we first present FAST, which achieves forward privacy and the same communication efficiency as Bost's scheme, but uses only symmetric cryptographic primitives. We then present FASTIO, which retains all good properties of FAST, and further improves I/O efficiency. We implemented the two schemes and compared their performance with Bost's scheme. The experiment results show that both our schemes are highly efficient.

In this paper, we propose an ID-based strong designated verifier signature (SDVS) over R - SIS assumption in the random model. We remove pre-image sampling function and Bonsai trees such complex structures used in previous lattice-based SDVS schemes. We only utilize simple rejection sampling to protect the security of our scheme. Hence, we will show our design has the shortest signature size comparing with existing lattice-based ID-based SDVS schemes. In addition, our scheme satisfies anonymity (privacy of signer’s identity) proved in existing schemes rarely, and it can resist side-channel attacks with uniform sampling.

Outsourcing the decryption of attribute-based encryption (ABE) ciphertext is a promising way to tackle the question of how users can perform decryption efficiently. However, existing solutions require the type of the target ciphertext to be determined at the setup of the outsourcing scheme. As such, making the target cryptosystems (or the clients) to be versatile becomes an issue that warrants investigations. In this paper, the problem we wish to tackle is to transform an ABE ciphertext to any client who is using the same, or possibly different, public-key encryption (PKE) system with the sender. The problem is of practical interest since it is hard to require all clients to use the same PKE, especially in the case of remote and cross-system data sharing. In addition, we also consider whether robust client-side decryption scheme can be adopted. This feature is not supported in the existing ABE with outsourcing.

There exist some inappropriate citations and typos in our paper ‘Social Rational Secure Multi-party Computation’, Vol. 26, No. 5 (2014), Pages: 1067–1083. We would like to use this corrigendum to point out these places so that the readers can understand the context of this paper in a better way. We are sorry for the unexpected inconvenience we brought for ‘Concurrency and Computation: Practice and Experience’ and the authors of the reference [27] cited in our paper, as well as the readers of our paper. The following corrections should be included.

Abstract Continual memory attacks, inspired by recent realistic physical attacks, have broken many cryptographic schemes that were considered secure in traditional cryptography model. In this paper, we consider the continual memory leakage resilience in public‐key encryption with keyword search scheme (PEKS). We give the definition of continual memory leakage resilience security for PEKS, which allows continual secret key leakage in the trapdoor generation algorithm rather than leakage of trapdoor itself. We believe that the definition is more suitable for practical PEKS scenario. To construct a concrete PEKS scheme secure against continual memory attacks, we firstly obtain a continual master‐key leakage‐resilient anonymous identity‐based encryption (IBE) scheme by applying the generic tool provided by Lewko et al. to a fully secure anonymous IBE scheme that comes from the fully secure anonymous hierarchical identity‐based encryption (HIBE) scheme of De Caro and colleagues. Then, we transform our continual master‐key leakage‐resilient anonymous IBE scheme to a PEKS scheme using the generic Anonymous IBE‐to‐PEKS transformation and prove its continual leakage‐resilient security. Copyright © 2016 John Wiley & Sons, Ltd.

There exist some inappropriate citations and typos in our paper “New Rational Parties Relying on Reputation”, Vol. 7, No. 7 (2014), Pages: 1128–1137 1. We would like to use this corrigendum to point out these places so that the readers can understand the context of this paper in a better way. We are sorry for the unexpected inconvenience we brought for “Security and Communication Networks” and the authors of the reference [13] cited in our paper, as well as the readers of our paper. The following corrections should be included.

To tackle with physical attacks to real world cryptosystems, leakage resilient cryptography was developed. In this setting, the adversary is allowed to have access to the internal state of a cryptographic system, thus violates the black-box reduction used in cryptography. Especially when considering continual memory leakage (CML), i.e., there is no predetermined bound on the leakage of the internal information, the task is extremely tough. In this paper, we solve this problem by introducing a new primitive called updatable hash proof system (UHPS). A UHPS can be viewed as a special Hash proof system (HPS), which served as a fundamental tool in constructing public key encryption (PKE) schemes in both leakage-free and leaky settings. A remarkable property of UHPS is that by simply substituting the HPS component with a UHPS component in a PKE scheme, one obtains a new PKE scheme secure in the CML setting. Moreover, the resulting PKE scheme enjoys the same advantage of the original HPS-based PKE, for instance, still “compatible” with known transforms [ 8 , 20 , 24 , 32 ]. We then give instantiations of UHPS from widely-accepted assumptions, including the symmetric external Diffie-Hellman assumption and the d-linear assumption. Interestingly, we notice that when instantiated with concrete assumptions, the resulting chosen-ciphertext secure PKE scheme is by far the most efficient.

Oblivious transfer is a fundamental tool in modern cryptography. In the past few years, many studies concentrate on oblivious transfer variants with more powerful functions. In this paper, the authors propose several variants of oblivious transfer in cut-and-choose scenario, providing multiple ways of transferring data in an oblivious manner. In addition, based on homomorphic encryption, the authors construct instantiations of these primitives, which can be proven secure in malicious model under ideal/real simulation paradigm and achieve the highest security level in the real world.

Abstract Wireless sensor networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic, and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8‐bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields as underlying algebraic structure and supports two different families of elliptic curves, namely, Weierstraß‐form and twisted Edwards‐form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.3·106clock cycles for a full 160‐bit scalar multiplication on an 8‐bit ATmega128 microcontroller, which is more than three times faster than the widely used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 17.34mJ when using a twisted Edwards curve over a 160‐bit Optimal Prime Field. This result further demonstrates the advantage of special family of elliptic curves for resource‐constrained environments. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract Fairness in secure two‐party computation ensures that either both of the communicating parties learn the output of some pre‐defined function or none of them does. Rational two‐party computation is an extension of two‐party computation that incorporates game theory into conventional two‐party (cryptographic) computation protocols for achieving fairness. From the standpoint of game theory, the strategies are designed for achieving equilibrium resulting in attaining fairness in rational two‐party computation protocols. Groce and Katz (Eurocrypt 2012) achieved fairness by computational Nash equilibrium under complete information. In this paper, protocols are considered in more practical scenarios of incomplete information, where fairness is achieved by sequential equilibrium. Our protocol has constant number of rounds as Groce and Katz do while achieving a stronger sequential equilibrium which also implies the computational Nash equilibrium. Copyright © 2015 John Wiley & Sons, Ltd.

ABSTRACT Rational secure two‐party computation (RSTPC) applies game theory to cryptographic protocols, where rational parties only care about how to maximize their utilities. Fairness can be achieved by assuming rational behavior in RSTPC. Previous RSTPC protocols achieve fairness under symmetric information, which seems quite strong and unnatural for rational parties. In this paper, we consider a general RSTPC protocol under asymmetric information where previous equilibriums are inadequate to guarantee fairness. Therefore, we propose a stronger equilibrium named computationally sequential equilibrium to guarantee fairness under asymmetric information. Furthermore, our protocol only requires small constant communication rounds. Copyright © 2014 John Wiley & Sons, Ltd.

SUMMARY Rational party is a new kind of parties who behave neither like honest parties nor like malicious adversaries. The crux point of rational party is the definition of the utility function, as rational parties only care about how to maximize their utility. In other words, rational parties choose the strategies, which can bring them the highest utilities. In rational secure two‐party computation protocol, the main task is how to boost mutual cooperation to complete the protocol. Social rational secure multi‐party computation (SRSMPC) means that in a social network, some distributed and rational parties with reputation properties want to jointly compute a functionality. The seemingly simple task becomes tough under three conditions. The first condition is that the network composed by parties may not be complete. That is, two parties may not be neighbors and they are connected through other parties. The second is that the network may be not secure. That is, messages may be tempered by malicious parties. The third condition is that parties may run the protocol under incomplete information scenario. That is, parties may have types and each type has a corresponding utility function. Under the first and second conditions, parties need to consider how to securely transmit messages between two parties who are not neighbors. Under the third condition, we propose the Tit‐for‐Tat strategy and prove that mutual cooperation is a sequential equilibrium between two parties. In this paper, we construct an SRSMPC protocol by using mechanism design under incomplete information to facilitate the implementation of the SRSMPC protocol within constant rounds. Meanwhile, newcomers are allowed to participate in the protocol. To the best of our knowledge, this is the first social rational secure computation protocol for multi‐party under an incomplete information scenario and an incomplete network. Copyright © 2013 John Wiley & Sons, Ltd.

In this paper, we redefine the utilities considering other parts such as reputation in order to give rational parties incentives to participate in the protocol and finally get the correct outputs. The most distinct contribution of this paper is the proposal of rational covert adversaries whose behaviors are combinations of rational parties and covert adversaries. Finally, given proper parameters, we prove that all parties have incentives to participate in the rational secure computation protocol. Copyright © 2013 John Wiley & Sons, Ltd.

Key agreement protocols are essential for secure communications in open and distributed environments. Identity-based cryptography has become extremely fashionable in the last few years for its special advantages. In this paper, we point out some flaw in the scheme proposed by Wang et al., then we present a two-party identity-based explicit authenticated key agreement protocol with key confirmation, which was inspired on a new identity-based encryption scheme first proposed by Gentry and can be used properly in the escrowless mode. The scheme captures the attributes of known-key secrecy, key-compromise impersonation resilience, unknown key-share resilience, perfect forward secrecy, and no-key control. Especially, the scheme captures the PKG forward secrecy property. The PKG still could not recover all the userspsila past session keys even he knows the long-term private keys of all users.