Anonymous credentials encourage online communication without fear of surveillance, but may invite misbehavior like hate speech. Previous updatable anonymous credentials keep a chronological queue of authenticated sessions and a global pointer to the last chunk of judged sessions. This design allows efficient authentication for proving over only a subset of sessions. However, complications in subjective evaluation often introduce hard-to-judge sessions, which halt all users since sessions that come after the global pointer cannot be redeemed, eventually exceeding the queue size that limits the creation of bad sessions. Such a global-halting loophole may also make judgments overly harsh and hasty.We propose SMART (slack management of anonymous reputation traits), maintaining multiple queues so the server could issue interim judgments many times before finalization. Such slackness removes the binary judgment of old methods and mitigates the global-halting issue. Prior schemes only allow score upgrades (WPES ’14) or require proving against a global session list since the last checkpoint (S&P ’22). Our authentication time is linear in the number of queues or sessions in a designated queue for immediate revocation.

Edwards-curve digital signature algorithm (EdDSA) is a highly efficient scheme with a short key size. It is derived from the threshold-friendly Schnorr signatures and is covered by the NIST standardization efforts of threshold cryptographic primitives. Nevertheless, extending its deterministic nonce generation to the threshold setting requires heavyweight cryptographic techniques, even when the hash function is replaced with one optimized for secure multi-party computation. Indeed, an efficient extension to the threshold setting is considered a major challenge by NIST and academia.

Private set intersection (PSI) is a secure two-party computation ($2$PC) protocol that reveals only the intersection of two private sets. Driven by different applications, various works devise specific protocols for private computation on the intersection (PCI), e.g., summation of the values labeled with each element in the intersection. Upgrading a PSI protocol to PCI for generic computations while maintaining efficiency and preventing leakage is known to be not straightforward (e.g., the intersection set size could be leaked).

Zero-error single-channel source coding has been studied extensively over the past decades. Its natural multi-channel generalization is however seldom investigated. While the special case with multiple symmetric-alphabet channels was studied a decade ago, codes in such setting have no advantage over single-channel codes in data compression, making them worthless in most applications. With essentially no development since the last decade, in this paper, we break the stalemate by showing that it is possible to beat single-channel source codes in terms of compression assuming asymmetric-alphabet channels. We present the multi-channel analogs of several classical results in single-channel source coding, e.g., a multi-channel Huffman code is an optimal tree-decodable code. We also show evidences that finding an efficient construction of multi-channel Huffman codes may be hard. Nevertheless, we propose a construction whose redundancy is guaranteed to be no larger than that of an optimal single-channel source code.

Privacy-preserving deep neural network (DNN) inference remains an intriguing problem even after the rapid developments of different communities. One challenge is that cryptographic techniques such as homomorphic encryption (HE) do not natively support non-linear computations (e.g., sigmoid). A recent work, BAYHENN (Xie et al., IJCAI'19), considers HE over the Bayesian neural network (BNN). The novelty lies in "meta-prediction" over a few noisy DNNs. The claim was that the clients can get intermediate outputs (to apply non-linear function) but are still prevented from learning the exact model parameters, which was justified via the widely-used learning-with-error (LWE) assumption (with Gaussian noises as the error). This paper refutes the security claim of BAYHENN via both theoretical and empirical analyses. We formally define a security game with different oracle queries capturing two realistic threat models. Our attack assuming a semi-honest adversary reveals all the parameters of single-layer BAYHENN, which generalizes to recovering the whole model that is "as good as" the BNN approximation of the original DNN, either under the malicious adversary model or with an increased number of oracle queries. This shows the need for rigorous security analysis ("the noise introduced by BNN can obfuscate the model" fails -- it is beyond what LWE guarantees) and calls for the collaboration between cryptographers and machine-learning experts to devise practical yet provably-secure solutions.