Management of secret keys for digital signatures is one of the most critical issues in decentralized applications. Since there is no administrator, losing a secret key can result in losing all assets or rights. To address this problem, fuzzy extractors and fuzzy signatures, which generate private keys directly from biometric information, have been considered in addition to conventional biometric authentication. However, these methods using biometric secret keys do not support group signatures. Therefore, it is not applicable to use cases that require consensus building by a specific community (group), such as DAO and DeFi.In this paper, we propose a new scheme for converting existing fuzzy signatures to group signatures using zero-knowledge proofs to address this problem. More precisely, we first define an anonymizable signature that is a generalization of a group signature and then convert a fuzzy signature into an anonymizable signature using an ordinary (classical) zero-knowledge proof. In addition, the signature data size is optimized to a constant size using zk-SNARK. Our implementation experiments show that our schemes achieve practical signature generation and verification times and signature sizes even for a group of up to 100,000 people. This paper’s results can be used to prevent the loss of secret keys and enable flexible DApps use cases.

In recent years, the zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) have drawn significant attention as privacy-enhancing technologies in various domains. A post-quantum designated verifier type zk-SNARK for Boolean circuits was proposed by Gennaro et al. in ACM CCS '18. However, this scheme does not include arithmetic circuits and they claim that a construction of post zk-SNARKs for arithmetic circuits as open problem. In this paper we give answers to this problem. Our first proposal is based on the data structure used in Pinocchio, a previous study, and can be easily implemented using the existing Pinocchio-based systems. In our second proposal, which also employs QAPs, the zero-knowledge proof comprises three learning with errors (LWE) ciphertexts, and the size of the proof is smaller compared with that of the first proposal. Our second proposal is also more efficient than the first one or all other known post-quantum zk-SNARKs.

To bound information leakage in outputs of protocols, it is important to construct secure multiparty computation protocols which output differentially private values perturbed by the addition of noise. However, previous noise generation protocols have round and communication complexity growing with differential privacy budgets, or require parties to locally generate non-uniform noise, which makes it difficult to guarantee differential privacy against active adversaries. We propose three kinds of protocols for generating noise drawn from certain distributions providing differential privacy. The two of them generate noise from finite-range variants of the discrete Laplace distribution. For$(\epsilon,\delta )$-differential privacy, they only need constant numbers of rounds independent of$\epsilon,\delta$while the previous protocol needs the number of rounds depending on$\delta$. The two protocols are incomparable as they make a trade-off between round and communication complexity. Our third protocol non-interactively generate shares of noise from the binomial distribution by predistributing keys for a pseudorandom function. It achieves communication complexity independent of$\epsilon$or$\delta$for the computational analogue of$(\epsilon,\delta )$-differential privacy while the previous protocols require communication complexity depending on$\epsilon$. We also prove that our protocols can be extended so that they provide differential privacy in the active setting.

A multiple assignment scheme (MAS) is a method to construct secret sharing schemes (SSSs) for general access structures. There are MASs using threshold and ramp SSSs. The paper proposes new MASs using ideal SSSs realizing compartmented access structures and those using SSSs realizing multi-level access structures. Since the ideal SSSs realizing compartmented access structures and SSSs realizing multi-level access structures are natural generalizations of threshold and ramp SSSs, respectively, the new MASs cannot be less efficient than those using threshold or ramp SSSs.

A secret sharing scheme (SSS) is a cryptographic tool to protect a secret from loss and leakage by dividing it into shares. A ramp SSS can improve the efficiency in terms of the sizes of shares by allowing partial information about the secret to leak out. In order to prevent the partial information from being recovered explicitly, the notion of the strong security has been introduced. However, there have been proposed few methods to construct strongly secure ramp SSSs for general access structures and they are not always sufficient. In this paper, we show that any linear ramp SSS can be transformed into a strongly secure scheme with the same access structure preserving the information ratio.

When large-scale quantum computers are implemented, several cryptosystems based on the hardness of factoring and discrete logarithm problems will be broken. Hence, it is desirable to construct quantum-resistant cryptographic protocols. Although several candidates are introduced for hard problem, the computational hardness of finding isogenies between two supersingular elliptic curves (supersingular isogenies) is promising among them. It is strongly believed that the computation of supersingular isogenies requires exponential time even in the quantum computers. In this paper, we propose quantum-resistant multi-party key exchange protocols. First, we introduce several assumptions related to supersingular isogenies, which includes a generalization of supersingular isogeny decisional Diffie-Hellman (SSDDH) assumption which is called GSSDDH assumption. We present a construction of the n-party key exchange protocol based on the GSSDDH assumption. It is n - 1-round protocol and can be considered as a natural extension of 2-party 1-round supersingular isogeny Diffie-Hellman (SIDH) protocol, and we call it generalized SIDH (GSIDH) protocol. We then propose an n-party 2-round key exchange protocol by combining SIDH with the idea of Burmester-Desmedt (BD) key exchange, which significantly reduces the number of rounds. This protocol is called SIBD protocol and is based on the SSDDH assumption.

In recent years, Bitcoin, Ethereum and other cryptocurrencies have attracted a great deal of attention from the whole industry including the financial as a new settlement system. Transaction information of these cryptocurrencies is stored in a distribution ledger called Blockchain on the P2P network through processing such as PoW. Meanwhile, since PoW requires a large amount of computer resources, researches on private / consortium type blockchain that do not need PoW. In this paper, we propose a decentralized netting protocol using a consortium type block chain that has the channel function. On a system that implements the proposed protocol, netting settlement can be performed on P2P hiding information of the sender and receiver name of transaction, amount of money, calculation butt of netting, and without setting up a specific central organization such as a central server.

Let us consider a scenario that a data holder (e.g., a hospital) encrypts a data (e.g., a medical record) which relates a keyword (e.g., a disease name), and sends its ciphertext to a server. We here suppose not only the data but also the keyword should be kept private. A receiver sends a query to the server (e.g., average of body weights of cancer patients). Then, the server performs the homomorphic operation to the ciphertexts of the corresponding medical records, and returns the resultant ciphertext. In this scenario, the server should NOT be allowed to perform the homomorphic operation against ciphertexts associated with different keywords. If such a mis-operation happens, then medical records of different diseases are unexpectedly mixed. However, in the conventional homomorphic encryption, there is no way to prevent such an unexpected homomorphic operation, and this fact may become visible after decrypting a ciphertext, or as the most serious case it might be never detected. To circumvent this problem, in this paper, we propose mis-operation resistant homomorphic encryption, where even if one performs the homomorphic operations against ciphertexts associated with keywords ω' and ω, where ω -ω', the evaluation algorithm detects this fact. Moreover, even if one (intentionally or accidentally) performs the homomorphic operations against such ciphertexts, a ciphertext associated with a random keyword is generated, and the decryption algorithm rejects it. So, the receiver can recognize such a mis-operation happens in the evaluation phase. In addition to mis-operation resistance, we additionally adopt secure search functionality for keywords since it is desirable when one would like to delegate homomorphic operations to a third party. So, we call the proposed primitive mis-operation resistant searchable homomorphic encryption (MR-SHE). We also give our implementation result of inner products of encrypted vectors. In the case when both vectors are encrypted, the running time of the receiver is millisecond order for relatively small-dimensional (e.g., 26) vectors. In the case when one vector is encrypted, the running time of the receiver is approximately 5 msec even for relatively high-dimensional (e.g., 213) vectors.

Abstract In this paper, we discuss security of public‐key cryptographic primitives in the case that the public key is fixed. In the standard argument, security of cryptographic primitives are evaluated by estimating the average probability of being successfully attacked where keys are treated as random variables. In contrast to this, in practice, a user is mostly interested in the security under his specific public key, which has been already fixed. However, it is obvious that such security cannot be mathematically guaranteed because for any given public key, there always potentially exists an adversary, which breaks its security. Therefore, the best what we can do is just to use a public key such that its effective adversary is not likely to be constructed in the real life and, thus, it is desired to provide a method for evaluating this possibility. The motivation of this work is to investigate (in)feasibility of predicting whether for a given fixed public key, its successful adversary will actually appear in the real life or not. As our main result, we prove that for any digital signature scheme or public key encryption scheme, it is impossible to reduce any fixed key adversary in any weaker security notion than the de facto ones (i.e., existential unforgery against adaptive chosen message attacks or indistinguishability against adaptive chosen ciphertext attacks) to fixed key adversaries in the de facto security notion in a black‐box manner. This result means that, for example, for any digital signature scheme, impossibility of extracting the secret key from a fixed public key will never imply existential unforgery against chosen message attacks under the same key as long as we consider only black‐box analysis. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract A booming cloud service has made it possible to consider a third‐party server as private storage. When storage is used as a document archive, it is useful to provide functionality that allows users to find documents containing a specified string as a substring. The current method for providing such functionality while keeping the contents of the documents secret, either has linear complexity in the total size of the documents or needs to extract keywords when the documents are stored. Therefore, no method exists for efficiently searching for an arbitrary string that has not been extracted as a keyword. We propose the first encryption scheme that enables efficient searching for an arbitrary string. Although our scheme leaks some information for the sake of efficiency, all information leaked is derived from the precise leakage profile we have defined. © 2016 The Authors Security and Communication Networks Published by John Wiley & Sons Ltd

The sanitizable signature attracts much attention since it allows to modify the original document for hiding partial information with keeping the validity of the signature and the integrity of unmodified parts of the document. The sanitizable signature is quite useful in governmental or military offices where there is a dilemma between is closure laws for public documents and privacy or diplomatic secrets. This paper proposes two new sanitizable signature schemes from bilinear maps with a new structure.

This paper proposes a new algorithm for evaluating the number of chaining variable conditions(CVCs) in the selecting step of a distrubance vector (DV) for the analysis of SHA-1 collision attack. The algorithm is constructed by combining the following four strategies, Strict Bit Compression, DV expansion, Precise Counting Rules in Every Step and Differential Path Confirmation for Rounds 2 to 4, that can evaluate the number of CVCs morestrictly compared with the previous approach.

We discuss the security of the MR schemes and especially point out the vulnerability of the MR3 scheme. The probabilistic deposit mechanism utilized in the MR3 scheme contributes to the reduction of the bank's processing cost. However, as shown in our paper, it also decreases the security of the entire scheme.