In the secure two-party computation (2PC), an adversary is often categorized as semi-honest or malicious, depending on whether it follows the protocol specifications. Covert security (Aumann and Lindell, 2010) first looks into the “middle ground”, such that an active adversary who cheats will be caught with a predefined probability. Other security notions, such as publicly auditable security (Baum et al., 2014) and (robust) accountability family (Küsters et al., 2010; Graf et al., 2023; Rivinius et al., 2022), achieve public verifiability as a stronger security guarantee by relying on heavy offline and online constructions with zero knowledge proofs and (or) a bulletin board functionality. In this work, we propose a new security notion called honorific security, where an external arbiter can identify the cheater without a bulletin board. Specifically, we delay and outsource the verification steps to the arbiter, so that the original online computation is thus accelerated. We show that a maliciously secure garbled circuit (GC) (Yao, 1986) protocol can be constructed with only slightly more overhead than a passively secure protocol. Our construction performs up to 2.37 times and 13.30 times as fast as the state-of-the-art protocols with covert and malicious security, respectively.

Abstract In practice, there are numerous settings where mutually distrusting parties need to perform distributed computations on their private inputs. For instance, participants in a first-price sealed-bid online auction do not want their bids to be disclosed. This problem can be addressed using secure multi-party computation (MPC), where parties can evaluate a publicly known function on their private inputs by executing a specific protocol that only reveals the correct output, but nothing else about the private inputs. Such distributed computations performed over the Internet are susceptible to remote hacks that may take place during the computation. As a consequence, sensitive data such as private bids may leak. All existing MPC protocols do not provide any protection against the consequences of such remote hacks. We present the first MPC protocols that protect the remotely hacked parties’ inputs and outputs from leaking. More specifically, unless the remote hack takes place before the party received its input or all parties are corrupted, a hacker is unable to learn the parties’ inputs and outputs, and is also unable to modify them. We achieve these strong (privacy) guarantees by utilizing the fact that in practice parties may not be susceptible to remote attacks at every point in time, but only while they are online, i.e. able to receive messages. To this end, we model communication via explicit channels. In particular, we introduce channels with an airgap switch (disconnect-able by the party in control of the switch), and unidirectional data diodes. These channels and their isolation properties, together with very few, similarly simple and plausibly remotely unhackable hardware modules serve as the main ingredient for attaining such strong security guarantees. In order to formalize these strong guarantees, we propose the UC with Fortified Security (UC#) framework, a variant of the Universal Composability (UC) framework.

With the advent of cheap sensor technology, multisensor data fusion algorithms have been becoming a key enabler for efficient in-network processing of sensor data. The information filter, in particular, has proven useful due to its simple additive structure of the measurement update equations. In order to exploit this structure for an efficient in-network processing, each node in the network is supposed to locally process and combine data from its neighboring nodes. The aspired in-network processing, at first glance, prohibits efficient privacy-preserving communication protocols, and encryption schemes that allow for algebraic manipulations are often computationally too expensive. Partially homomorphic encryption schemes constitute far more practical solutions but are restricted to a single algebraic operation on the corresponding ciphertexts. In this paper, an additive-homomorphic encryption scheme is used to derive a privacy-preserving implementation of the information filter where additive operations are sufficient to distribute the workload among the sensor nodes. However, the encryption scheme requires the floating-point data to be quantized, which impairs the estimation quality. The proposed filter and the implications of the necessary quantization are analyzed in a simulated multisensor tracking scenario.

We consider the task of extending a given coin toss. By this, we mean the two-party task of using a single instance of a given coin toss protocol in order to interactively generate more random coins. A bit more formally, our goal is to generate n common random coins from a single use of an ideal functionality that gives $$m

Reliable authentication requires the devices and channels involved in the process to be trustworthy, otherwise authentication secrets can easily be compromised. Given the unceasing efforts of attackers worldwide such trustworthiness is increasingly not a given. A variety of technical solutions, such as utilising multiple devices/channels and verification protocols, has the potential to mitigate the threat of untrusted communications to a certain extent. Yet such technical solutions make two assumptions: (1) users have access to multiple devices and (2) attackers will not resort to hacking the human, using social engineering techniques. In this paper, we propose and explore the potential of using human-based computation instead of solely technical solutions to mitigate the threat of untrusted devices and channels. ZeTA (Zero Trust Authentication on untrusted channels) has the potential to allow people to authenticate despite compromised channels or communications and easily observed usage. Our contributions are threefold: (1) We propose the ZeTA protocol with a formal definition and security analysis that utilises semantics and human-based computation to ameliorate the problem of untrusted devices and channels. (2) We outline a security analysis to assess the envisaged performance of the proposed authentication protocol. (3) We report on a usability study that explores the viability of relying on human computation in this context.

When designing an electronic voting scheme it is notoriously difficult to guarantee the secrecy of the vote as well as the correctness of the tally, even in the presence of a malicious adversary. Research in (offline) cryptographic voting schemes has largely relied on a trusted voting machine for guaranteeing security. We alleviate part of this trust requirement. Our scheme ensures the confidentiality of the vote even in the presence of an honest-but-curious voting machine. We improve on Bohli et al.’s Bingo Voting scheme (Bohli et al., 2007). Bingo Voting already guarantees the correctness and public verifiability of the election in spite of a malicious voting machine. The voting machine learns the voter’s input however, and is trusted not to violate ballot secrecy. Our novel construction’s output is identical to that of Bingo Voting. We devise an electro-mechanical Physical Oblivious Transfer (pOT) device to remove that trust requirement by hiding the voter’s choice from the voting machine. The pOT device is realised in such a way that the voter merely operates a button to express her choice. Our construction is thus particularly user-friendly.

The McEliece public-key encryption scheme has become an interesting alternative to cryptosystems based on number-theoretical problems. Different from RSA and ElGamal, McEliece PKC is not known to be broken by a quantum computer. Moreover, even though McEliece PKC has a relatively big key size, encryption and decryption operations are rather efficient. In spite of all the recent results in coding-theory-based cryptosystems, to the date, there are no constructions secure against chosen ciphertext attacks in the standard model-the de facto security notion for public-key cryptosystems. In this paper, we show the first construction of a McEliece-based public-key cryptosystem secure against chosen ciphertext attacks in the standard model. Our construction is inspired by a recently proposed technique by Rosen and Segev.

We elaborate on the problem of polynomial runtime in simulatability definitions for multi-party computation. First, the need for a new definition is demonstrated by showing which problems occur with common definitions of polynomial runtime. Then, we give a definition which captures in an intuitive manner what it means for a protocol or an adversary to have polynomial runtime. We show that this notion is suitable for simulatability definitions for multi-party computation. In particular, a composition theorem is shown for this notion.

The main purpose of cryptographic voting schemes is to provide transparency while protecting ballot secrecy and to enable a fast tally. In this paper, we address three major issues of cryptographic voting schemes. First we discuss the problem of secrecy and coercion resistance in the situation of a corrupted voting machine. While hard to obtain in general, we propose and analyze a novel approach that uses encapsulated design and minimizes the information that can compromise ballot secrecy. The second issue we address is the assumption that an adversary does not know which receipts are checked and the problem of receipt stealing. Many voting schemes with receipts share this vulnerability. We provide a solution that increases protection of each vote and which can be generalized for voting schemes that use computers to form the receipt. The last issue discussed in this paper is the question of how an election can be contested. For this, an error or a manipulation must not only be detected but also proven. While the problems and solutions are described for Bingo Voting, we argue that the problems are shared by many cryptographic voting schemes and that the solutions presented in this work give insight in the prerequisites needed for a secure election.

We elaborate on the problem of polynomial runtime in simulatability definitions for multiparty computation. First, the need for a new definition is demonstrated by showing which problems occur with common definitions of polynomial runtime. Then, we give a definition which captures in an intuitive manner what it means for a protocol or an adversary to have polynomial runtime. We show that this notion is suitable for simulatability definitions for multiparty computation. In particular, a composition theorem is shown for this notion.

This paper studies the optimisation of the channel with cryptographic primitives such as coin tossing and oblivious transfer by committing to a set of strings. The main contribution of this paper is that the commitment is possible from any nontrivial correlation at rates when the sender is Alice and Bob, those rates are optimal. Also the coin tossing capacity is infinite for every channel having a positive bit commitment rate.

For original article see G. Drolet, ibid., vol. 47, no. 9, p. 938-946, (Sept 1998). We characterize the smallest n with GF(2)[X]/(X/sup n/ + 1) containing an isomorphic copy of GF(2/sup m/). This characterization shows that the representation of finite fields described in a previous issue of the IEEE Transactions on Computers is not "optimal" as claimed. The representation considered there can often be improved significantly.

The behaviour of two field extensions with respect to each other can be described by the notions of linear disjointness and freeness. This paper gives methods for effectively deciding linear disjointness and freeness for fields lying under a finitely generated field k(X) = Quot(k[X1 ; : : : ; Xs ]=I(X)). Furthermore the methods developed can be used to decide for two given fields if there exists a field over which they are linear disjoint. This field (if it exists) is always the intersection of the two fields given. Thus we are able to compute the intersection of finitely generated fields which are linear disjoint. All methods used rely on a correspondence from (pairs of) fields to ideals namely the ideal of syzygies of the generators of one field which have coefficients lying in the other field. We thereby generalize existing correspondences associating single fields or field extensions to ideals. Our contribution concludes with an outlook to the problem of computing the intersectio...