Key derivation functions can be used to derive variable-length random strings that serve as cryptographic keys. They are integral to many widely-used communication protocols such as TLS, IPsec and Signal. NIST SP 800-108 specifies several key derivation functions based on pseudorandom functions such as CMAC and HMAC, that can be used to derive additional keys from an existing cryptographic key. This standard either explicitly or implicitly requests their KDFs to be variable output length pseudorandom function, collision resistant, and preimage resistant, which are also demanded by practical applications. Yet, since the publication of this standard dating back to the year of 2008, until now, there is no formal analysis to justify these security properties of KDFs. In this work, we give the formal security analysis of key derivation functions in NIST SP 800-108. We show both positive and negative results regarding these key derivation functions. For KCTR-CMAC, KFB-CMAC, and KDPL-CMAC that are key derivation functions based on CMAC in counter mode, feedback mode, and double-pipeline mode respectively, we prove that all of them are secure variable output length pseudorandom functions and preimage resistant. We show that KFB-CMAC and KDPL-CMAC are collision resistant. While for KCTR-CMAC, we can mount constant-time collision attack against it. For KCTR-HMAC, KFB-HMAC, and KDPL-HMAC that are key derivation functions based on HMAC in modes, we show that all of them behave like variable output length pseudorandom functions. When the key of these key derivation functions is of variable length, they suffer from collision attacks. For the case when the key of these key derivation function is of fixed length and less than d-1 bits where d is the input block size of the underlying compression function, we can prove that they are collision resistant and preimage resistant. Finally, we extend our analysis to the plain CMAC-based KDFs for which mitigation techniques against key-control attacks do not apply, as well as to the KMAC-based KDF.
We study certified everlasting security for functional encryption (FE) and other advanced cryptographic primitives. Informally, certified everlasting security provides a quantum deletion guarantee: a receiver who holds a quantum cryptographic object (e.g., a ciphertext) can produce a deletion certificate attesting that the object has been deleted, so that any information encoded in it (e.g., the plaintext) is irrecoverable. If the certificate verifies, then security holds even if the receiver later becomes computationally unbounded. Since many primitives are impossible (or are widely believed to be impossible) to realize with information-theoretic security even with quantum communication, certified everlasting security offers an appealing, inherently quantum compromise. In this work, we formalize certified everlasting secure variants of FE, compute-and-compare obfuscation, predicate encryption (PE), secret-key encryption (SKE), public-key encryption (PKE), receiver non-committing encryption (RNCE), and garbled circuits. We then give the following constructions:
The Fiat-Shamir transform is one of the most widely applied methods for secure signature construction. Fiat-Shamir starts with an interactive zero-knowledge identification protocol and transforms this via a hash function into a non-interactive signature. The protocol’s zero-knowledge property ensures that a signature does not leak information on its secret key s , which is achieved by blinding s⃗ via proper randomness y . Most prominent Fiat-Shamir examples are EC-DSA signatures and the new post-quantum standard ML-DSA (aka Dilithium). In practice, EC-DSA signatures have experienced fatal attacks via leakage of a few bits of the randomness y per signature. Similar attacks now emerge for lattice-based signatures, such as ML-DSA. We build on, improve and generalize the pioneering leakage attack on ML-DSA by Liu, Zhou, Sun, Wang, Zhang, and Ming. Using a transformation to Integer LWE (ILWE), their attack can recover a 256-dimensional subkey of ML-DSA-44 from leakage in a single bit of y per signature, in any bit position j ≥ 6 . However, the number of required signatures grows exponentially as 4^j . In this work, we show that not all leaky signatures carry information about the secret subkey. We introduce the notion of informative signature relations. This notion allows us to define a preprocessing step, called filter-and-shift that leads to ILWE instances that require a smaller sample amount. Unlike the standard ILWE transformation, filter-and-shift exploits the smallness of secret keys, and therefore might be of independent cryptanalytic interest. In comparison to Liu et al., for j=6 we require only a quarter of the signatures and reduce the exponential growth to 2^j . In addition, we show that the secret subkey can be recovered even with a leak bit corrupted by a large amount of noise, in theory up to the maximum of 50% . Experimentally, we still recover the secret with 43% noise, where we need 170 times as many signatures as in the noise-free setting. The attack applies more generally to all Fiat-Shamir-type lattice-based signatures. For a signature scheme based on module LWE over an ℓ -dimensional module, the attack uses a 1-bit leak per signature to efficiently recover a 1/ℓ -fraction of the secret key. In the ring LWE setting, which can be seen as module LWE with ℓ = 1 , the attack recovers the whole key.
We present two general compilers that endow a wide range of cryptographic primitives—including public-key encryption, attribute-based encryption, and (quantum) fully homomorphic encryption—with the publicly verifiable deletion property. Our compilers are based solely on minimal cryptographic assumptions: They require only one-way functions, one-way state generators, or, more generally, hard quantum planted problems for , all of which are implied by the existence of one-way functions. By relying on these minimal assumptions, our compilers enable the addition of the publicly verifiable deletion property to the aforementioned primitives without introducing any additional assumptions. In contrast, prior approaches, such as the one by Bartusek, Khurana, and Poremba [13], rely on stronger assumptions, including injective trapdoor one-way functions or pseudorandom group actions. From a technical standpoint, our work builds upon the compiler for privately verifiable deletion introduced by Bartusek and Khurana [11] and enhances it to achieve public verifiability. This is accomplished by incorporating one-time digital signatures—either directly or via indirect mechanisms.
Abstract The Fiat–Shamir transformation is a general principle to turn any public-coin interactive proof into non-interactive one (with security then typically analyzed in the random oracle model). While initially used for 3-round protocols, many recent constructions use it for multi-round protocols. However, in general the soundness error of the Fiat–Shamir transformed protocol degrades exponentially in the number of rounds. On the positive side, it was shown that for the special class of $$(k_1,\dots ,k_\mu )$$ ( k 1 , ⋯ , k μ ) -special-sound $$\varSigma $$ Σ -protocols, which is a natural multi-round generalization of the well-known class of special-sound protocols, the loss is actually only linear in the number of random oracle queries, and independent of the number of rounds, which is optimal. A natural next question is whether this positive result extends to the Fiat–Shamir transformation of so-called $$(\varGamma _1,\dots ,\varGamma _\mu )$$ ( Γ 1 , ⋯ , Γ μ ) -special-sound protocols. This notion was recently defined and analyzed in the interactive case; it captures a larger class of protocols, namely where the special-soundness property is characterized by a general access structure, rather than a threshold. We show in this work that this is indeed the case. Concretely, we show that the Fiat–Shamir transformation of any $$(\varGamma _1, \ldots , \varGamma _\mu )$$ ( Γ 1 , … , Γ μ ) -special-sound interactive proof is knowledge sound under the same condition on $$\varGamma _1,\dots ,\varGamma _\mu $$ Γ 1 , ⋯ , Γ μ for which the original interactive proof is knowledge sound. Furthermore, also here the loss is linear in the number of random oracle queries and independent of the number of rounds. In light of the above, one might suspect that our argument follows as a straightforward combination of the above mentioned prior works. However, this is not the case. The approach used for $$(k_1,\dots ,k_\mu )$$ ( k 1 , ⋯ , k μ ) -special-sound protocols, which is based on an extractor that samples without replacement, does not (seem to) generalize; on the other hand, the other approach, which uses an extractor based on sampling with replacement, comes with an additional loss that would blow up in the recursive multi-round analysis. Thus, new techniques are necessary to handle the above complications.
