1,454 research outputs found
A Framework for Efficient Adaptively Secure Composable Oblivious Transfer in the ROM
Oblivious Transfer (OT) is a fundamental cryptographic protocol that finds a
number of applications, in particular, as an essential building block for
two-party and multi-party computation. We construct a round-optimal (2 rounds)
universally composable (UC) protocol for oblivious transfer secure against
active adaptive adversaries from any OW-CPA secure public-key encryption scheme
with certain properties in the random oracle model (ROM). In terms of
computation, our protocol only requires the generation of a public/secret-key
pair, two encryption operations and one decryption operation, apart from a few
calls to the random oracle. In~terms of communication, our protocol only
requires the transfer of one public-key, two ciphertexts, and three binary
strings of roughly the same size as the message. Next, we show how to
instantiate our construction under the low noise LPN, McEliece, QC-MDPC, LWE,
and CDH assumptions. Our instantiations based on the low noise LPN, McEliece,
and QC-MDPC assumptions are the first UC-secure OT protocols based on coding
assumptions to achieve: 1) adaptive security, 2) optimal round complexity, 3)
low communication and computational complexities. Previous results in this
setting only achieved static security and used costly cut-and-choose
techniques.Our instantiation based on CDH achieves adaptive security at the
small cost of communicating only two more group elements as compared to the
gap-DH based Simplest OT protocol of Chou and Orlandi (Latincrypt 15), which
only achieves static security in the ROM
Quantum Cryptography Beyond Quantum Key Distribution
Quantum cryptography is the art and science of exploiting quantum mechanical
effects in order to perform cryptographic tasks. While the most well-known
example of this discipline is quantum key distribution (QKD), there exist many
other applications such as quantum money, randomness generation, secure two-
and multi-party computation and delegated quantum computation. Quantum
cryptography also studies the limitations and challenges resulting from quantum
adversaries---including the impossibility of quantum bit commitment, the
difficulty of quantum rewinding and the definition of quantum security models
for classical primitives. In this review article, aimed primarily at
cryptographers unfamiliar with the quantum world, we survey the area of
theoretical quantum cryptography, with an emphasis on the constructions and
limitations beyond the realm of QKD.Comment: 45 pages, over 245 reference
CryptoMaze: Atomic Off-Chain Payments in Payment Channel Network
Payment protocols developed to realize off-chain transactions in Payment
channel network (PCN) assumes the underlying routing algorithm transfers the
payment via a single path. However, a path may not have sufficient capacity to
route a transaction. It is inevitable to split the payment across multiple
paths. If we run independent instances of the protocol on each path, the
execution may fail in some of the paths, leading to partial transfer of funds.
A payer has to reattempt the entire process for the residual amount. We propose
a secure and privacy-preserving payment protocol, CryptoMaze. Instead of
independent paths, the funds are transferred from sender to receiver across
several payment channels responsible for routing, in a breadth-first fashion.
Payments are resolved faster at reduced setup cost, compared to existing
state-of-the-art. Correlation among the partial payments is captured,
guaranteeing atomicity. Further, two party ECDSA signature is used for
establishing scriptless locks among parties involved in the payment. It reduces
space overhead by leveraging on core Bitcoin scripts. We provide a formal model
in the Universal Composability framework and state the privacy goals achieved
by CryptoMaze. We compare the performance of our protocol with the existing
single path based payment protocol, Multi-hop HTLC, applied iteratively on one
path at a time on several instances. It is observed that CryptoMaze requires
less communication overhead and low execution time, demonstrating efficiency
and scalability.Comment: 30 pages, 9 figures, 1 tabl
Understanding Android Obfuscation Techniques: A Large-Scale Investigation in the Wild
In this paper, we seek to better understand Android obfuscation and depict a
holistic view of the usage of obfuscation through a large-scale investigation
in the wild. In particular, we focus on four popular obfuscation approaches:
identifier renaming, string encryption, Java reflection, and packing. To obtain
the meaningful statistical results, we designed efficient and lightweight
detection models for each obfuscation technique and applied them to our massive
APK datasets (collected from Google Play, multiple third-party markets, and
malware databases). We have learned several interesting facts from the result.
For example, malware authors use string encryption more frequently, and more
apps on third-party markets than Google Play are packed. We are also interested
in the explanation of each finding. Therefore we carry out in-depth code
analysis on some Android apps after sampling. We believe our study will help
developers select the most suitable obfuscation approach, and in the meantime
help researchers improve code analysis systems in the right direction
Universally Composable Quantum Multi-Party Computation
The Universal Composability model (UC) by Canetti (FOCS 2001) allows for
secure composition of arbitrary protocols. We present a quantum version of the
UC model which enjoys the same compositionality guarantees. We prove that in
this model statistically secure oblivious transfer protocols can be constructed
from commitments. Furthermore, we show that every statistically classically UC
secure protocol is also statistically quantum UC secure. Such implications are
not known for other quantum security definitions. As a corollary, we get that
quantum UC secure protocols for general multi-party computation can be
constructed from commitments
Confidential Boosting with Random Linear Classifiers for Outsourced User-generated Data
User-generated data is crucial to predictive modeling in many applications.
With a web/mobile/wearable interface, a data owner can continuously record data
generated by distributed users and build various predictive models from the
data to improve their operations, services, and revenue. Due to the large size
and evolving nature of users data, data owners may rely on public cloud service
providers (Cloud) for storage and computation scalability. Exposing sensitive
user-generated data and advanced analytic models to Cloud raises privacy
concerns. We present a confidential learning framework, SecureBoost, for data
owners that want to learn predictive models from aggregated user-generated data
but offload the storage and computational burden to Cloud without having to
worry about protecting the sensitive data. SecureBoost allows users to submit
encrypted or randomly masked data to designated Cloud directly. Our framework
utilizes random linear classifiers (RLCs) as the base classifiers in the
boosting framework to dramatically simplify the design of the proposed
confidential boosting protocols, yet still preserve the model quality. A
Cryptographic Service Provider (CSP) is used to assist the Cloud's processing,
reducing the complexity of the protocol constructions. We present two
constructions of SecureBoost: HE+GC and SecSh+GC, using combinations of
homomorphic encryption, garbled circuits, and random masking to achieve both
security and efficiency. For a boosted model, Cloud learns only the RLCs and
the CSP learns only the weights of the RLCs. Finally, the data owner collects
the two parts to get the complete model. We conduct extensive experiments to
understand the quality of the RLC-based boosting and the cost distribution of
the constructions. Our results show that SecureBoost can efficiently learn
high-quality boosting models from protected user-generated data
Callisto: a cryptographic approach to detecting serial perpetrators of sexual misconduct
Sexual misconduct is prevalent in workplace and education settings
but stigma and risk of further damage deter many victims from
seeking justice. Callisto, a non-profit that has created an online sexual assault reporting platform for college campuses, is expanding its
work to combat sexual assault and harassment in other industries.
In this new product, users will be invited to an online "matching
escrow" that will detect repeat perpetrators and create pathways
to support for victims. Users submit encrypted data about their
perpetrator, and this data can only be decrypted by the Callisto
Options Counselor (a lawyer), when another user enters the identity of the same perpetrator. If the perpetrator identities match,
both users will be put in touch independently with the Options
Counselor, who will connect them to each other (if appropriate) and
help them determine their best path towards justice. The client relationships with the Options Counselors are structured so that any
client-counselor communications would be privileged. A combination of client-side encryption, encrypted communication channels,
oblivious pseudo-random functions, key federation, and Shamir
Secret Sharing keep data confidential in transit, at rest, and during
the matching process with the guarantee that only the lawyer ever
has access to user submitted data, and even then only when a match
is identified.Accepted manuscrip
- …