Recently (Crypto’24), Das and Ren proposed an adaptively secure variant of threshold BLS signatures. Unlike the initial threshold BLS signature described by Boldyreva (PKC’03), their variant can be proven secure in the adaptive corruption setting while preserving the useful features of the scheme (i.e., non-interactivity, uniqueness of signatures, and optimal signature size). In this work, we present a simplification of their scheme where the sizes of partial signatures and secret key shares are decreased by ≈ 20 % and 33 % , respectively. In addition, we reduce the communication cost of the distributed key generation phase by a factor 2. We can still prove the security of our simplified variant under adaptive corruptions in the random oracle model and under the same assumptions (namely, the co-CDH assumption and the DDH assumption in the first source group of the pairing) as Das and Ren.
Ascon, a family of algorithms that support hashing and Authenticated Encryption with Associated Data (AEAD), is the final winner of the NIST Lightweight Cryptography Project. As a research hotspot, Ascon has received substantial third-party security evaluation. Among all the results of Ascon-128 (the primary recommendation of AEAD), the key recovery attack can only be achieved by reducing the initialization phase to 7 rounds or fewer, regardless of whether it violates the security claims made by the designers (i.e., misuse of the nonce or exceeding data limits 2^64 ). In this paper, we, from two aspects (misuse-free setting and misused setting), improve the key recovery attack on Ascon-128 using the cube attack method. In one part, we present a faster method to recover the superpolies for a 64-dimensional cube in the output bits of the 7-round initialization, enabling us to recover the secret key with a time complexity of 2^95.96 and a data complexity of 2^64 . Our 7-round key recovery attack, based on the full key space, greatly improves the time complexity, making it the best result to date. Additionally, we utilize several techniques to extend state recovery to key recovery, answering the open problem of transitioning from full state recovery in the encryption phase to key recovery for Ascon-128 (ToSc Vol 4, 2022). By combining encryption phase state recovery with initialization phase key recovery, we can achieve 8-round and 9-round initialization phase key recovery in the nonce misuse scenario, with time complexities of 2^101 and 2^123.92 , respectively. This represents an improvement of two rounds over previous results in the misused setting. Our first key recovery attack is also applicable to Ascon-128a, achieving the same result. In cases where the full state, prior to the encryption phase, can be recovered in other Ascon AEAD modes, our second key recovery attack will also be useful. It is worth noting that this work does not threaten the security of the full 12 rounds Ascon, but we expect that our results provide new insights into the security of Ascon.
The SM4 block cipher has a generalised Feistel structure with four 32-bit branches and a 128-bit user key, which is a Chinese national standard and an ISO international standard. Following Chow et al.’s seminal work of white-box cryptography in 2002, a few white-box SM4 implementations with external encodings have been proposed since 2009, among which, except the one using linear internal encodings, all the others (i.e. the ones using affine internal encodings) are regarded as (practically) secure against key-recovery attack so far, partially because secret constant parts from affine encodings hinder some attack methods under Feistel structure, like algebraic and affine equivalence attacks, though several published attacks recovered a masked key with such constants, while by contrast all published white-box AES implementations have been practically broken mainly with such attack methods. As a consequence, one may think that Feistel structure is better than SPN structure in terms of their security on white-box cryptography. In this paper, we apply Derbez et al.’s affine equivalence algorithm to the generalised Feistel cipher SM4, and give an affine equivalence-based attack framework to recover the original user key of these white-box SM4 implementations with a very practical complexity of about t^2· 2^32 for affine encodings or t · 2^27 for linear encodings (with t being a small integer 1 or 2), by exploring implementation particulars and exploiting a differential meet-in-the-middle approach and the SM4 key expansion formula to filter out a few secret parameters. Finally, as examples, we apply this framework to recover the original user key of Xiao and Lai’s and Bai and Wu’s white-box SM4 implementations for the first time, with a time complexity of 2^32 and 2^34 respectively, and to recover the original user key of Shi et al.’s white-box SM4 implementation with a time complexity of 2^27 , significantly lower than the previous attack complexity of 2^49 . Our work shows how to apply Derbez et al.’s affine equivalence algorithm to a Feistel cipher and all such white-box SM4 implementations are not practically secure like white-box AES, and designers of white-box implementations of Feistel ciphers should pay attention to this framework.
Simon’s algorithm, which constructs periodic functions from encryption and decryption oracles of a cipher, has shown great power in breaking symmetric ciphers. This paper studies the quantum chosen-ciphertext attacks (qCCA) distinguishers based on Simon’s algorithm and the general technique to build such distinguishers. The qCCA distinguishers can be divided into distinguishers that use only the decryption oracle and those that use the encryption oracle. We refer to these two types of distinguishers as the ^d distinguishers and the ^e distinguishers, respectively. Firstly, we show the general methods of constructing ^d distinguishers exploiting truncated differential, which can explain the previous work, that is, constructing Simon-based ^d distinguishers of primitives case by case. Secondly, we explored the relations between periodic functions used by ^e distinguishers and boomerang distinguishing attacks. Specifically, we deeply observed truncated boomerang attacks and introduced the definition of truncated boomerang differential to find the relations. The basic observation is that an improved truncated boomerang differential with probability 1 can be used to construct periodic functions, and two such constructions are presented. With these new construction techniques, we present new qCCA distinguishers of unified structures that unify the Feistel, Lai-Massey, MARS-like, and SM4-like structures. In particular, for the d-branch MARS-like and SM4-like structures, we prove the existence of 2d-round qCCA distinguishers that are the best results so far as we know.
The BBS+ signature scheme is one of the most prominent solutions for realizing anonymous credentials. Its prominence is due to properties like selective disclosure and efficient protocols for creating and showing possession of credentials. Traditionally, a single credential issuer produces BBS+ signatures, which poses significant risks due to a single point of failure.I n this work, we address this threat via a novel t-out-of-n threshold BBS+ protocol. Our protocol supports an arbitrary security threshold t ≤ n and works in the so-called preprocessing setting. In this setting, we achieve non-interactive signing in the online phase and sublinear communication complexity in the number of signatures in the offline phase, which, as we show in this work, are important features from a practical point of view. As it stands today, none of the widely studied signature schemes, such as threshold ECDSA and threshold Schnorr, achieve both properties simultaneously. In this work, we make the observation that presignatures can be directly computed from pseudorandom correlations which allows servers to create signatures shares without additional cross-server communication. Both our offline and online protocols are actively secure in the Universal Composability model. Finally, we evaluate the concrete efficiency of our protocol, including an implementation of the online phase and the expansion algorithm of the pseudorandom correlation generator (PCG) used during the offline phase. The online protocol without network latency takes less than 14 ms for t ≤ 30 and credentials sizes up to 10. Further, our results indicate that the influence of t on the online signing is insignificant, ≤ 6 % for t ≤ 30 , and the overhead of the thresholdization occurs almost exclusively in the offline phase. Our implementation of the PCG expansion shows that even for a committee size of 10 servers, each server can expand a correlation of up to 2^17 presignatures in less than 100 ms per presignature.
We investigate the Misty structure with respect to the security notion of sequential indifferentiability of Mandal et al. (TCC 2012). As our main result, we prove sequential indifferentiability for 7-round Misty structures using seven independent random permutations in the rounds. We also prove insecurity for 5 rounds by exhibiting an attack. Our main result implies known-key security of 7 rounds in the sense of correlation intractability, providing the first known-key security results on Misty structures to our knowledge.
Secure computation with penalties aims to achieve fairness in secure computation protocols by imposing monetary penalties on adversarial parties. A fundamental problem to constructing a protocol that involves monetary entities is how to formalize them in the computational model. Bentov and Kumaresan (Crypto 2014) introduced a new computational model with special atomic entities called coins that capture currency and showed a protocol for secure computation with penalties in the model. Their model, secure computation with coins, assumes coins have several properties that are natural in the sense of expressing currency. However, on the other hand, it also requires the unnatural assumption “all coins are indistinguishable from each other” for a technical reason to accomplish the security proof. The motivation of this work is to remove the assumption from the coins to make the model a more general. We propose a new model, secure computation with color coins, such that coins have identifiable colors and do not hold the indistinguishability property. Furthermore, our model allows us to set different prices for each color. We show that secure computation with penalties can be realized in our model. To do this, we make some modifications to the ideal functionality of secure computation with penalties to adapt it to our model without losing the essence, i.e., fairness with penalties.
Meet-in-the-middle (MitM) is a powerful approach for the cryptanalysis of symmetric primitives. In recent years, MitM has led to many improved records about key recovery, preimage and collision attacks with the help of automated tools. However, most of the previous work target AES-like hashing where the linear layer is an MDS matrix. And we observe that their automatic model for MDS matrix is not suitable for primitives using a binary matrix as their linear layer. In this paper, we propose the n-XOR model to describe the XOR operation with an arbitrary number of inputs. And it can be applied to primitives with a binary matrix of arbitrary size. Then, we propose a check model to eliminate the possible inaccuracies caused by n-XOR. But the check model is limited by the input size (not greater than 4). Combined with the two new models, we find a MitM key recovery attack on 11-round Midori64. When the whitening keys are excluded, a MitM key recovery attack can be mounted on the 12-round Midori64. Compared with the previous best work, both of the above results have distinct advantages in terms of reducing memory and data complexity. At last, we apply the n-XOR model to the hashing modes of primitives with large size binary matrix. The preimage attack on weakened Camellia-MMO (without FL/FL^-1 and whitening layers) and Aria-DM are both improved by 1 round.
Post-quantum signatures have high costs compared to RSA and ECDSA, in particular for smart cards. A line of work originating from Even, Goldreich, and Micali (CRYPTO’89) aimed to reduce digital signature latency by splitting up signing into an online and offline phase. The online/offline paradigm combines an ordinary long-term signature scheme with a fast, generally one-time, signature scheme. We reconsider this paradigm in the context of lattice-based post-quantum signatures in the GPV framework, with an example instantiation based on Falcon.
Adaptor signatures (AS) extend the functionality of traditional digital signatures by enabling the generation of a pre-signature tied to an instance of a hard NP relation, which can later be turned (adapted) into a full signature upon revealing a corresponding witness. The recent work by Liu et al. [ASIACRYPT 2024] devised a generic AS scheme that can be used for any NP relation—which here we will refer to as universal adaptor signatures scheme, in short UAS—from any one-way function. However, this generic construction depends on the Karp reduction to the Hamiltonian cycle problem, which adds significant overhead and hinders practical applicability. In this work, we present an alternative approach to construct universal adaptor signature schemes relying on the multi-party computation in the head (MPCitH) paradigm. This overcomes the reliance on the costly Karp reduction, while inheriting the core property of the MPCitH—which makes it an invaluable tool in efficient cryptographic protocols—namely, that the construction is black-box with respect to the underlying cryptographic primitive (while it remains non-black-box in the relation being proven). Our framework simplifies the design of UAS and enhances their applicability across a wide range of decentralized applications, such as blockchain and privacy-preserving systems. Our results demonstrate that MPCitH-based UAS schemes offer strong security guarantees while making them a promising tool in the design of real-world cryptographic protocols.
The search for optimal differential trails for ARX ciphers is known to be difficult and scale poorly as the word size (and the branching through the carries of modular additions) increases. To overcome this problem, one may approximate the modular addition with the XOR operation, a process called linearization. The immediate drawback of this approach is that many valid and good trails are discarded. In this work, we explore different partial linearization trade-offs to model the modular addition through the window heuristic, which restricts carry propagation to windows of w_s consecutive positions. This strategy enables the exploration of full linearization ( w_s = 0 ), normal modelling ( w_s = n ), and all the different trade-offs between completeness and speed in between. We give the corresponding SAT and MILP model and their parallel versions, and apply them to ChaCha, SPECK, LEA, and HIGHT. Our method greatly outperforms all previous modeling of modular addition. In particular, we find the first differential path for 4 rounds of ChaCha with a probability greater than 2^-256 , and a corresponding 6 rounds boomerang distinguisher. This indicates that purely differential-based attacks have the potential to become competitive with differential-linear attacks, currently, the best-known attacks against ChaCha and other ARX ciphers. On SPECK, we find many improvements over the state-of-the-art in terms of speed of the differential trail search in the single-key setting and new upper bound probabilities in the related-key setting. Finally, we exhibit an improved key recovery attack on reduced LEA .
Gaussian Elimination (GE) is a critical operation in the signing procedure of multivariate- and code-based schemes. In this paper, we provide a masking scheme for GE with back substitution to defend against arbitrary-order attacks. We propose a masked algorithm for transforming a system of linear equations into row-echelon form. This is realized by introducing techniques for efficiently making leading (pivot) elements one while avoiding costly conversions between Boolean and multiplicative masking at all orders. We also propose a technique for efficient masked back substitution, which eventually enables a secure unmasking of the output. All novel gadgets are proven secure in the t-probing model. Additionally, we evaluate the overhead of our countermeasure for several post-quantum candidates and their different security levels at first-, second-, and third-order, including UOV, MAYO, SNOVA, QR-UOV, and MQ-Sign. Notably, the operational cost of first-, second-, and third-order masked GE is 2.3 × higher, and the randomness cost is 1.2 × higher in MAYO compared to UOV for security levels III and V. In contrast, these costs are similar in UOV and MAYO for one version of level I. We also show detailed performance results for first-, second- and third-order masked GE implementations on the Arm Cortex-M4 and compare them with unmasked cycle counts. Our first-order masked implementation has an overhead of factor 15.1 × , 15.2 × , and 15.4 × compared to the unprotected implementation of UOV-I, UOV-III and UOV-V.
Clarifying the robustness of authenticated encryption (AE) schemes, such as security under nonce misuse or Release of Unverified Plaintext (RUP), has significant importance due to the extensive use of AEs in real-world applications. We present a comprehensive analysis of the robustness of well-known standards, namely GCM, CCM, and OCB3. Despite many existing studies, we uncovered several robustness properties for them that were not known in the literature. In particular, we show that both GCM and CCM maintain authenticity under RUP. Moreover, CCM keeps this feature even if a nonce is misused. We show that this robust security is maintained if one block cipher call in CCM is omitted, resulting in an efficiency improvement of CCM since the proposal. Together with existing analysis, our work gives a complete picture of the robustness of these standards for the first time. Our results also imply several new robust AE schemes based on GCM and CCM.
Class groups of imaginary quadratic fields (class groups for short) have seen a resurgence in cryptography as transparent groups of unknown order. They are a prime candidate for being a trustless alternative to RSA groups because class groups do not need a (distributed) trusted setup to sample a cryptographically secure group of unknown order. Class groups have recently found many applications in verifiable secret sharing, secure multiparty computation, transparent polynomial commitments, and perhaps most importantly, in time-based cryptography, i.e., verifiable delay functions, (homomorphic) time-lock puzzles, timed commitments, etc. However, there are various roadblocks to making class groups widespread in practical cryptographic deployments. We initiate the rigorous study of hashing into class groups. Specifically, we want to sample a uniformly distributed group element in a class group such that nobody knows its discrete logarithm with respect to any public parameter. We point out several flawed algorithms in numerous publicly available class group libraries. We further illustrate the insecurity of these hash functions by showing concrete attacks against cryptographic protocols, i.e., verifiable delay functions, if they were deployed with one of those broken hash-to-class group functions. We propose two families of cryptographically secure hash functions into class groups. We implement these constructions and evaluate their performance. We release our implementation as an open-source library.
With applications in secure messaging, Updatable Public Key Encryption (UPKE) was proposed by Jost et al. (EUROCRYPT ’19) and Alwen et al. (CRYPTO ’20). It is a natural relaxation of forward-secure public-key encryption. In UPKE, we can update secret keys by using update ciphertexts which any sender can generate. The UPKE schemes proposed so far that satisfy the strong CCA security are Haidar et al.’s concrete construction (CCS ’22) and Dodis et al.’s generic construction that use Non-Interactive Zero-Knowledge (NIZK) arguments. Yet, even despite the aid of random oracles, their concrete efficiency, except for the recent independent work (EUROCRYPT ’24), is quite far from the most efficient CPA-secure scheme. In this paper, we first demonstrate a simple and efficient attack against Dodis et al.’s strongly CCA-secure scheme, and show how to fix it. Then, based on the observation from the attack and fix, we propose a new strongly CCA-secure generic construction for a UPKE scheme with random oracles and show that its instantiation is almost as concretely efficient as the most efficient CPA-secure one. Our construction does not rely on either NIZKs, the AGM, or GGM.
This work introduces DSKE, digital signatures with key extraction. In a DSKE scheme, the private key can be extracted if more than a threshold number of signatures on different messages are ever created while, within the threshold, each signature continues to authenticate the signed message. We propose a formal definition of DSKE, as well as two provably secure constructions, one from hash-based digital signatures and one from polynomial commitments. We demonstrate that DSKE is useful for various applications, such as cryptographic deniability and spam prevention. First, we introduce the GroupForge signature scheme, leveraging DSKE to achieve deniability in digital communication. GroupForge integrates DSKE with a Merkle tree and timestamps to produce a forward-forgeable signature equipped with extractable sets, ensuring deniability under a fixed public key. We illustrate that GroupForge can serve as a viable alternative to Keyforge in the non-attributable email protocol of Specter, Park, and Green (USENIX Sec ’21), thereby eliminating the need for continuous disclosure of outdated private keys. GroupForge can also operate as a short-lived signature, providing deniability non-interactively and agnostic to time. Second, we leverage the inherent extraction property of DSKE to develop a Rate-Limiting Nullifier (RLN) scheme. RLN efficiently identifies and expels spammers once they exceed a predetermined action threshold, thereby jeopardizing their private keys. Moreover, we implement both variants of the DSKE to demonstrate their performance and show they are comparable to existing signature schemes. We also implement GroupForge from the polynomial commitment-based DSKE and illustrate the practicality of our proposed scheme.
A sequential aggregate signature (SAS) scheme allows multiple users to sequentially combine their respective signatures in order to reduce communication costs. Historically, early proposals required the use of trapdoor permutation (e.g., RSA). In recent years, a number of attempts have been made to extend SAS schemes to post-quantum assumptions. Many post-quantum signatures have been proposed in the hash-and-sign paradigm, which requires the use of trapdoor functions and appears to be an ideal candidate for sequential aggregation attempts. However, the hardness in achieving post-quantum one-way permutations makes it difficult to obtain similarly general constructions. Direct attempts at generalizing permutation-based schemes have been proposed, but they either lack formal security or require additional properties on the trapdoor function, which are typically not available for multivariate or code-based functions. In this paper, we propose a (partial-signature) history-free SAS within the probabilistic hash-and-sign with retry paradigm, generalizing existing techniques to generic trapdoor functions. We prove the security of our scheme in the random oracle model and we instantiate our construction with three post-quantum schemes, comparing their compression capabilities. Finally, we discuss how direct extensions of permutation-based SAS schemes are not possible without additional properties, showing the lack of security of two existing multivariate schemes.
We revisit batch signatures (previously considered in a draft RFC and used in multiple recent works), where a single, potentially expensive, “inner” digital signature authenticates a Merkle tree constructed from many messages. We formalise a construction and prove its unforgeability and privacy properties. We also show that batch signing allows us to scale slow signing algorithms, such as those recently selected for standardisation as part of NIST’s post-quantum project, to high throughput, with a mild increase in latency and demonstrate the practical efficiency of batch signing in the context of TLS. For the example of Falcon-512 in TLS, we can increase the amount of connections per second by a factor 3.2, at the cost of an increase in the signature size by 14% and the median latency by 25%; both run on the same 30 core server. For SPHINCS-128, throughput improves by a factor 4.6, with a negligible impact on signature size and an 11% impact on median latency. We also discuss applications where batch signatures allow us to increase throughput and to save bandwidth. For example, again for 16 Falcon-512 signatures, once one batch signature is available, the additional bandwidth for each of the remaining is only 82 bytes.
In 2023, NIST has selected Ascon as the new standard for lightweight cryptography. The Ascon v1.2 family provides authenticated encryption, hash functions, and extendable output functions, all using the same Ascon permutation. The main use case of Ascon is to provide efficient cryptographic primitives for resource-constraint devices. While additional primitives can be built on top of the existing Ascon functions, dedicated schemes are often more efficient. In this paper, we enrich the functionality of Ascon by providing efficient Pseudorandom Functions (PRFs), Message Authentication Codes (MACs), and a fast short-input PRF for messages up to 128 bits.
