Certain applications of fully homomorphic encryption (such as transciphering, universal thresholdizers, and PIR) require randomness while operating over encrypted data. This randomness has to be obliviously generated in the encrypted domain and remain encrypted throughout the computation. Moreover, it should be guaranteed that independent-looking random coins can be obliviously generated for different computations.

Privacy-preserving aggregation protocols allow an untrusted aggregator to evaluate certain statistics over a population of individuals without learning each individual’s privately owned data. In this note, we show that a recent protocol for computing an aggregate sum due to Jung, Li, and Wan (IEEE Transactions on Dependable and Secure Computing, 2015) is universally breakable, that is, anyone is able to recover each individual’s private data from the corresponding ciphertext. We also describe an alternate collusion attack against their companion product protocol.

Aggregator-oblivious encryption is a useful notion put forward by Shi et al. in 2011 that allows an untrusted aggregator to periodically compute an aggregate value over encrypted data contributed by a set of users. Such encryption schemes find numerous applications, particularly in the context of privacy-preserving smart metering. This article presents a general framework for constructing privacy-preserving aggregator-oblivious encryption schemes using a variant of Cramer-Shoup’s paradigm of smooth projective hashing. This abstraction leads to new schemes based on a variety of complexity assumptions. It also improves upon existing constructions, providing schemes with shorter ciphertexts and better encryption times.

Abstract: This paper presents a key-private public-key cryptosystem. More specifically, in addition to confidentiality, it provides privacy. Informally, ciphertexts yield no information whatsoever about its recipient (beyond what is publicly known). The presented cryptosystem also features a very fast key generation: the key generation boils down to a mere squaring modulo an RSA modulus. Further, it comes with strong security guarantees: it is proved to be semantically secure and key-private under the standard quadratic residuosity assumption. 1

Threshold cryptography is a fundamental distributed computational paradigm for enhancing the availability and the security of cryptographic public-key schemes. It does it by dividing private keys into n shares handed out to distinct servers. In threshold signature schemes, a set of at least t+1 ≤ n servers is needed to produce a valid digital signature. Availability is assured by the fact that any subset of t+1 servers can produce a signature when authorized. At the same time, the scheme should remain robust (in the fault tolerance sense) and unforgeable (cryptographically) against up to t corrupted servers; i.e., it adds quorum control to traditional cryptographic services and introduces redundancy. Originally, most practical threshold signatures have a number of demerits: They have been analyzed in a static corruption model (where the set of corrupted servers is fixed at the very beginning of the attack), they require interaction, they assume a trusted dealer in the key generation phase (so that the system is not fully distributed), or they suffer from certain overheads in terms of storage (large share sizes). In this paper, we construct practical fully distributed (the private key is born distributed), non-interactive schemes --- where the servers can compute their partial signatures without communication with other servers--- with adaptive security (i.e., the adversary corrupts servers dynamically based on its full view of the history of the system). Our schemes are very efficient in terms of computation, communication, and scalable storage (with private key shares of size O(1), where certain solutions incur O(n) storage costs at each server). Unlike other adaptively secure schemes, our schemes are erasure-free (reliable erasure is a hard to assure and hard to administer property in actual systems).

Recommender systems typically require users to reveal their ratings to a recommender service, which subsequently uses them to provide relevant recommendations. Revealing ratings has been shown to make users susceptible to a broad set of inference attacks, allowing the recommender to learn private user attributes, such as gender, age, etc. In this work, we show that a recommender can profile items without ever learning the ratings users provide, or even which items they have rated. We show this by designing a system that performs matrix factorization, a popular method used in a variety of modern recommendation systems, through a cryptographic technique known as garbled circuits. Our design uses oblivious sorting networks in a novel way to leverage sparsity in the data. This yields an efficient implementation, whose running time is O(Mlog^2M) in the number of ratings M. Crucially, our design is also highly parallelizable, giving a linear speedup with the number of available processors. We further fully implement our system, and demonstrate that even on commodity hardware with 16 cores, our privacy-preserving implementation can factorize a matrix with 10K ratings within a few hours.

Elliptic curve cryptography was introduced in the mid 1980s as a promising alternative for cryptographic protocols based on the discrete logarithm problem in the multiplicative group of a finite field (e.g., Diffie-Hellman key exchange or ElGamal encryption/signature). The security of elliptic curve cryptosystems relies on the hardness of solving the elliptic curve discrete logarithm problem (ECDLP). However, there is no need to make use of strong cryptographic techniques if they are poorly implemented. This talk surveys various fault attacks against elliptic curve cryptosystems. It also presents a number of countermeasures developed so far as well as new ones by exploiting the rich underlying mathematical structure. Finally, several research problems are listed.

Ridge regression is an algorithm that takes as input a large number of data points and finds the best-fit linear curve through these points. The algorithm is a building block for many machine-learning operations. We present a system for privacy-preserving ridge regression. The system outputs the best-fit curve in the clear, but exposes no other information about the input data. Our approach combines both homomorphic encryption and Yao garbled circuits, where each is used in a different part of the algorithm to obtain the best performance. We implement the complete system and experiment with it on real data-sets, and show that it significantly outperforms pure implementations based only on homomorphic encryption or Yao circuits.

This paper considers the problem of converting an encryption scheme into a scheme in which there is one encryption process but several decryption processes. Each decryption process is made available as a protected software implementation (decoder). So, when some digital content is encrypted, a legitimate user can recover the content in clear using its own private software implementation. Moreover, it is possible to trace a decoder in a black-box fashion in case it is suspected to be an illegal copy. Our conversions assume software tamper-resistance.

This paper presents a generic and simple transformation that adds traceability to an anonymous encryption scheme. We focus on the case of honest senders, which finds applications in many real-life scenarios. Advantageously, our transformation can be applied to already deployed public-key infrastructures. Two concrete implementations are provided.

Fault attacks constitute a major threat toward cryptographic products supporting RSA-based technologies. Most often, the public exponent is unknown, turning resistance to fault attacks into an intricate problem. Over the past few years, several techniques for secure implementations have been published, but none of them is fully satisfactory. We propose a completely different approach by embedding the public exponent into [the description of] the private key. As a result, we obtain a very efficient countermeasure with a 100% fault detection.

Content distribution systems enable the secure distribution of multimedia content. At the same time, and sometimes more importantly, they should also disable the illegal [re-]distribution of multimedia content. This paper identifies different types of attacks on current systems: laundering attacks and repackaging attacks. The attacks are described generically so that they may apply to most systems used for distributing protected content to set of users. First hints to prevent such attacks are also discussed.

Implementation attacks are a major threat for cryptographic applications. Recently, Baek and Vasyltsov (ISPEC 2007) proposed a unified countermeasure for protecting elliptic curve implementations against a variety of implementation attacks, including differential power attacks and fault attacks. This paper studies the security of this countermeasure. In particular, it shows that the fault coverage is less than what was anticipated. Further security weaknesses are also pointed out.

In this paper, we study the security of an image scrambling algorithm based on space-filling curves (SFC). A random SFC is a pixel permutation that changes the scanning order without changing pixels values. Few attacks were reported in the literature. A ciphertext-only attack when a different scan is generated for each frame in the video was proposed. The success of this attack heavily depends on the statistics of the plain frame. In addition, scanning each frame with a different SFC is not adapted to compression as many compression algorithms exploit temporal redundancy. We revisit the security properties of this scrambling technique and propose an efficient and low-cost chosen-plaintext attack when the same SFC is used for each frame in the video.

Differential fault attacks become a threat of increasing importance against cryptographic devices. One of the most efficient hardware countermeasures for block ciphers to prevent such attacks relies on duplication. Novel techniques to implement a duplication scheme for the AES are proposed. Remarkably, the proposed techniques do not impact on the throughput/area ratio and better withstand a large variety of known fault attacks.

We introduce simple methods to convert a cryptographic algorithm into an algorithm protected against simple side-channel attacks. Contrary to previously known solutions, the proposed techniques are not at the expense of the execution time. Moreover, they are generic and apply to virtually any algorithm. In particular, we present several novel exponentiation algorithms, namely, a protected square-and-multiply algorithm, its right-to-left counterpart, and several protected sliding-window algorithms. We also illustrate our methodology applied to point multiplication on elliptic curves. All these algorithms share the common feature that the complexity is globally unchanged compared to the corresponding unprotected implementations.

This paper describes new methods for producing optimal binary signed-digit representations. This can be useful in the fast computation of exponentiations. Contrary to existing algorithms, the digits are scanned from left to right (i.e., from the most significant position to the least significant position). This may lead to better performances in both hardware and software.

In order to avoid fault-based attacks on cryptographic security modules (e.g., smart-cards), some authors suggest that the computation results should be checked for faults before being transmitted. In this paper, we describe a potential fault-based attack where key bits leak only through the information whether the device produces a correct answer after a temporary fault or not. This information is available to the adversary even if a check is performed before output.

Article On the importance of securing your bins: the garbage-man-in-the-middle attack Share on Authors: Marc Joye UCL Crypto Group, Dép. de Math., Université de Louvain, Belgium UCL Crypto Group, Dép. de Math., Université de Louvain, BelgiumView Profile , Jean-Jacques Quisquater UCL Crypto Group, Dép. d'Électricité, Université de Louvain, Belgium UCL Crypto Group, Dép. d'Électricité, Université de Louvain, BelgiumView Profile Authors Info & Claims CCS '97: Proceedings of the 4th ACM conference on Computer and communications securityApril 1997 Pages 135–141https://doi.org/10.1145/266420.266449Online:01 April 1997Publication History 7citation635DownloadsMetricsTotal Citations7Total Downloads635Last 12 Months11Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

This paper presents an interesting application of the Tillich–Zémor function TZ . In particular, we emphasize the concatenation property of this one-way hash function. i.e., TZ ( S | T ) = TZ ( S ) TZ ( T ) where S and T are two binary strings. This