375 research outputs found
General Impossibility of Group Homomorphic Encryption in the Quantum World
Group homomorphic encryption represents one of the most important building
blocks in modern cryptography. It forms the basis of widely-used, more
sophisticated primitives, such as CCA2-secure encryption or secure multiparty
computation. Unfortunately, recent advances in quantum computation show that
many of the existing schemes completely break down once quantum computers reach
maturity (mainly due to Shor's algorithm). This leads to the challenge of
constructing quantum-resistant group homomorphic cryptosystems.
In this work, we prove the general impossibility of (abelian) group
homomorphic encryption in the presence of quantum adversaries, when assuming
the IND-CPA security notion as the minimal security requirement. To this end,
we prove a new result on the probability of sampling generating sets of finite
(sub-)groups if sampling is done with respect to an arbitrary, unknown
distribution. Finally, we provide a sufficient condition on homomorphic
encryption schemes for our quantum attack to work and discuss its
satisfiability in non-group homomorphic cases. The impact of our results on
recent fully homomorphic encryption schemes poses itself as an open question.Comment: 20 pages, 2 figures, conferenc
Kryptowochenende 2006 - Workshop ĂĽber Kryptographie
Das Kryptowochenende ist eine Aktivität der Fachgruppe Angewandte Kryptologie in der Gesellschaft für Informatik (GI) mit dem Ziel, Nachwuchswissenschaftlern, etablierten Forschern und Praktikern auf dem Gebiet der Kryptologie und Computersicherheit die Möglichkeit zu bieten, Kontakte über die eigene Universität hinaus zu knüpfen und sich mit Kollegen aus dem Fachgebiet auszutauschen. Die Vorträge decken ein breites Spektrum ab, von noch laufenden Projekten bis zu abgeschlossenen Forschungsarbeiten, die zeitnah auch auf Konferenzen publiziert wurden bzw. werden sollen. Das erste Kryptowochenende hat stattgefunden vom 01.-02. Juli 2006 im Tagungszentrum der Universität Mannheim im Kloster Bronnbach. Die Beiträge zu diesem Workshop sind im vorliegenden Tagungsband zusammengefasst
A formal definition and a new security mechanism of physical unclonable functions
The characteristic novelty of what is generally meant by a "physical
unclonable function" (PUF) is precisely defined, in order to supply a firm
basis for security evaluations and the proposal of new security mechanisms. A
PUF is defined as a hardware device which implements a physical function with
an output value that changes with its argument. A PUF can be clonable, but a
secure PUF must be unclonable. This proposed meaning of a PUF is cleanly
delineated from the closely related concepts of "conventional unclonable
function", "physically obfuscated key", "random-number generator", "controlled
PUF" and "strong PUF". The structure of a systematic security evaluation of a
PUF enabled by the proposed formal definition is outlined. Practically all
current and novel physical (but not conventional) unclonable physical functions
are PUFs by our definition. Thereby the proposed definition captures the
existing intuition about what is a PUF and remains flexible enough to encompass
further research. In a second part we quantitatively characterize two classes
of PUF security mechanisms, the standard one, based on a minimum secret
read-out time, and a novel one, based on challenge-dependent erasure of stored
information. The new mechanism is shown to allow in principle the construction
of a "quantum-PUF", that is absolutely secure while not requiring the storage
of an exponentially large secret. The construction of a PUF that is
mathematically and physically unclonable in principle does not contradict the
laws of physics.Comment: 13 pages, 1 figure, Conference Proceedings MMB & DFT 2012,
Kaiserslautern, German
Preimage resistance beyond the birthday bound: Double-length hashing revisited
Security proofs are an essential part of modern cryptography. Often the challenge is not to come up with appropriate schemes but rather to technically prove that these satisfy the desired security properties.
We provide for the first time techniques for proving asymptotically optimal preimage resistance bounds for block cipher based double length, double call hash functions. More precisely, we consider for some \keylength>\blocklength compression functions H:\{0,1\}^{\keylength+\blocklength} \rightarrow \{0,1\}^{2\blocklength} using two calls to an ideal block cipher with an \blocklength-bit block size. Optimally, an adversary trying to find a preimage for should require \Omega(2^{2\blocklength}) queries to the underlying block cipher. As a matter of fact there have been several attempts to prove the preimage resistance of such compression functions, but no proof did go beyond the \Omega(2^{\blocklength}) barrier, therefore leaving a huge gap when compared to the optimal bound.
In this paper, we introduce two new techniques on how to lift this bound to \Omega(2^{2\blocklength}). We demonstrate our new techniques for a simple and natural design of , being the concatenation of two instances of the well-known Davies-Meyer compression function
- …