In this work, we introduce a lightweight secure aggregation protocol that guarantees liveness (i.e., guaranteed output delivery), robust against faulty inputs and security against malicious clients. First, we improve upon prior works in the “star”-like topology network with a central coordinating (also output) party, Bonawitz et al. (ACM CCS 2017) and Bell et al. (ACM CCS 2020), which are not robust against faulty inputs. Recent works, RoFL (Burkhalter et al.) and (concurrent work) ACORN (Bell et al.) show how to rely on zero-knowledge proofs to address such attacks at expense of significantly high computation costs. We also compare our protocol against the PRIO system by Gibbs and Boneh (USENIX 2017) which achieves the same task in an incomparable security model. We benchmark our protocol with implementation and demonstrate its concrete efficiency. Our solution scales to 1000s of clients, requires only a constant number of rounds, outperforms prior work in computational cost, and has competitive communication cost.

One of the most challenging aspects in secure computation is offering protection against active adversaries, who may arbitrarily alter the behavior of corrupted parties. A powerful paradigm due to Goldreich, Micali, and Wigderson (GMW), is to follow a two-step approach: (1) design a passively secure protocol π for the task at hand; (2) apply a general compiler to convert π into an actively secure protocol π' for the same task.

Abstract PRESENT and MIBS are two lightweight block ciphers that are suitable for low resource devices such as radio‐frequency identification tags. In this paper, we present the first biclique cryptanalysis of MIBS block cipher and a new biclique cryptanalysis of PRESENT block cipher. These attacks are performed on full‐round MIBS‐80 and full‐round PRESENT‐80. Using matching without matrix technique in the attack on MIBS and choosing a sub‐key space of an internal round for key division eventuate to reduce the security of this cipher by 1bit, while the data complexity of attack is 252 chosen plaintext. The attack on PRESENT‐80 has a data complexity of at most 222 chosen plaintext and computational complexity of 279.34 encryption that both complexities are lower than of other cryptanalyses of full‐round PRESENT‐80 so far. Also, in this paper, we use early abort technique to efficiently filter out wrong keys in matching phase of biclique attack of PRESENT‐80. Copyright © 2015 John Wiley & Sons, Ltd.