Oblivious RAM (ORAM) is a cryptographic primitive for hiding access patterns in cloud environments. Though the ordinary security definition of ORAM guarantees indistinguishability between access sequences of the same length, it cannot be guaranteed for access sequences of different lengths. Hence, ORAM cannot hide access timings or frequency. In this paper, we propose an ORAM scheme that can hide access timings. First, we extend the ordinary security definition. We formulate the hiding property of access timings by defining indistinguishability between access sequences of different lengths. Furthermore, we introduce a new ORAM scheme by adapting the dummy access technique. We prove that our scheme is secure in the proposed definition.

Verifiable delegated private set intersection, VD-PSI, is a kind of secure function evaluation protocol to compute the set intersection between clients datasets which are stored in the cloud in encrypted form without leaking any information. In VD-PSI, clients can verify validity of the computation result returned from the cloud. At FC 2016, Abadi et al. proposed a VD-PSI scheme based on a homomorphic encryption. However, their scheme has several problems in a practical sense; First, their scheme requires that clients must establish a secure channel between them in advance. Next, costs for clients are not fair because computational and communication costs for a client are much heavier than the peer. In this paper, we introduce an improved VD-PSI scheme. Our scheme has two main advantages: First, no secure channel is required even between clients; and thus, clients do not need to negotiate with each other in advance. The other advantage is efficiency and complexity fairness of clients because communication costs for clients are balanced, and total costs for clients are about 62% of the previous scheme.

Password-based Authenticated Key Exchange (PAKE) allows a server to authenticate a user and to establish a session key shared between the server and the user just by having memorable passwords. In PAKE, conventionally the server is assumed to have the authentication functionality and also provide on-line services simultaneously. However, in the real-life applications, this may not be the case, and the authentication server may be separate from on-line service providers. In such a case, there is a problem that a malicious service provider with no authentication functionality may be able to guess the passwords by interacting with other participants repeatedly. Abdalla et al. put forward a notion of the server password protection security to deal with this problem. However, their proposed schemes turned out to be vulnerable to Undetectable On-line Dictionary Attack (UDonDA). To cope with this situation, we propose the Gateway Threshold PAKE provably secure against this password guessing attack by also taking the corruption of authentication servers into consideration.

This paper discusses how to realize practical post-quantum authenticated key exchange (AKE) with strong security, i.e., CK+ security (Krawczyk, CRYPTO 2005). It is known that strongly secure post-quantum AKE protocols exist on a generic construction from IND-CCA secure key encapsulation mechanisms (KEMs) in the standard model.

Though anonymity of ring signature schemes has been studied in many literatures for a long time, these papers showed different definitions and there is no consensus. Recently, Bender et al. proposed two new anonymity definitions of ring signature which is stronger than the traditional definition, that are called anonymity against attribution attacks/full key exposure. Also, ring signature schemes have two levels of unforgeability definitions, i.e., existential un-forgeability (eUF) and strong existential unforgeability (sUF). In this paper, we will redefine anonymity and unforgeability definitions from the standpoint of universally composable (UC) security framework. First, we will formulate new ideal functionalities of ring signature schemes for each security levels separately. Next, we will show relations between cryptographic security definitions and our UC definitions. Finally, we will give another proof of the Bender et al.'s ring signature scheme following the UC secure definition by constructing a simulator to an adversary of sUF, which can be adaptable to the case of sUF under the assumption of a standard single sUF signature scheme.