We introduce the notion of a conditional encryption scheme as an extension of public key encryption. In addition to the standard public key algorithms (KeyGen, Enc, Dec) for key generation, encryption and decryption, a conditional encryption scheme for a binary predicate.. adds a new conditional encryption algorithm CEnc. The conditional encryption algorithm c = CEnc(pk) (c(1), m(2), m(3)) takes as input the public encryption key pk, a ciphertext c(1) = Enc(pk) (m(1)) for an unknown message m(1), a control message m(2) and a payload message m(3) and outputs a conditional ciphertext c. Intuitively, if P (m(1), m(2)) = 1 then the conditional ciphertext.. should decrypt to the payload message m(3). On the other hand if P(m(1), m(2)) = 0 then the ciphertext should not leak any information about the control message m(2) or the payload message m(3) even if the attacker already has the secret decryption key sk. We formalize the notion of conditional encryption secrecy and provide concretely efficient constructions for a set of predicates relevant to password typo correction. Our practical constructions utilize the Paillier partially homomorphic encryption scheme as well as Shamir Secret Sharing. We prove that our constructions are secure and demonstrate how to use conditional encryption to improve the security of personalized password typo correction systems such as TypTop. We implement a C++ library for our practically efficient conditional encryption schemes and evaluate the performance empirically. We also update the implementation of TypTop to utilize conditional encryption for enhanced security guarantees and evaluate the performance of the updated implementation.

In the past decade, billions of user passwords have been exposed to the dangerous threat of offline password cracking attacks. An offline attacker who has stolen the cryptographic hash of a user's password can check as many password guesses as s/he likes limited only by the resources that s/he is willing to invest to crack the password. Pepper and key-stretching are two techniques that have been proposed to deter an offline attacker by increasing guessing costs. Pepper ensures that the cost of rejecting an incorrect password guess is higher than the (expected) cost of verifying a correct password guess. This is useful because most of the offline attacker's guesses will be incorrect. Unfortunately, as we observe the traditional peppering defense seems to be incompatible with modern memory hard key-stretching algorithms such as Argon2 or Scrypt. We introduce an alternative to pepper which we call Cost-Asymmetric Memory Hard Password Authentication which benefits from the same cost-asymmetry as the classical peppering defense i.e., the cost of rejecting an incorrect password guess is larger than the expected cost to authenticate a correct password guess. When configured properly we prove that our mechanism can only reduce the percentage of user passwords that are cracked by a rational offline attacker whose goal is to maximize (expected) profit i.e., the total value of cracked passwords minus the total guessing costs. We evaluate the effectiveness of our mechanism on empirical password datasets against a rational offline attacker. Our empirical analysis shows that our mechanism can reduce significantly the percentage of user passwords that are cracked by a rational attacker by up to 10%.

We formally introduce, define, and construct memory-hard puzzles. Intuitively, for a difficulty parameter t, a cryptographic puzzle is memory-hard if any parallel random access machine (PRAM) algorithm with “small” cumulative memory complexity ( ≪ t^2 ) cannot solve the puzzle; moreover, such puzzles should be both “easy” to generate and be solvable by a sequential RAM algorithm running in time t. Our definitions and constructions of memory-hard puzzles are in the standard model, assuming the existence of indistinguishability obfuscation ( i𝒪 ) and one-way functions (OWFs), and additionally assuming the existence of a memory-hard language. Intuitively, a language is memory-hard if it is undecidable by any PRAM algorithm with “small” cumulative memory complexity, while a sequential RAM algorithm running in time t can decide the language. Our definitions and constructions of memory-hard objects are the first such definitions and constructions in the standard model without relying on idealized assumptions (such as random oracles). We give two applications which highlight the utility of memory-hard puzzles. For our first application, we give a construction of a (one-time) memory-hard function (MHF) in the standard model, using memory-hard puzzles and additionally assuming i𝒪 and OWFs. For our second application, we show any cryptographic puzzle (e.g., memory-hard, time-lock) can be used to construct resource-bounded locally decodable codes (LDCs) in the standard model, answering an open question of Blocki, Kulkarni, and Zhou (ITC 2020). Resource-bounded LDCs achieve better rate and locality than their classical counterparts under the assumption that the adversarial channel is resource bounded (e.g., a low-depth circuit). Prior constructions of MHFs and resource-bounded LDCs required idealized primitives like random oracles.

Cryptographic techniques have the potential to enable distrusting parties to collaborate in fundamentally new ways, but their practical implementation poses numerous challenges. An important class of such cryptographic techniques is known as Secure Multi-Party Computation (MPC). Developing Secure MPC applications in realistic scenarios requires extensive knowledge spanning multiple areas of cryptography and systems. And while the steps to arrive at a solution for a particular application are often straightforward, it remains difficult to make the implementation efficient, and tedious to apply those same steps to a slightly different application from scratch. Hence, it is an important problem to design platforms for implementing Secure MPC applications with minimum effort and using techniques accessible to non-experts in cryptography. In this paper, we present the HACCLE (High Assurance Compositional Cryptography: Languages and Environments) toolchain, specifically targeted to MPC applications. HACCLE contains an embedded domain-specific language Harpoon, for software developers without cryptographic expertise to write MPC-based programs, and uses Lightweight Modular Staging (LMS) for code generation. Harpoon programs are compiled into acyclic circuits represented in HACCLE's Intermediate Representation (HIR) that serves as an abstraction over different cryptographic protocols such as secret sharing, homomorphic encryption, or garbled circuits. Implementations of different cryptographic protocols serve as different backends of our toolchain. The extensible design of HIR allows cryptographic experts to plug in new primitives and protocols to realize computation. And the use of standard metaprogramming techniques lowers the development effort significantly. We have implemented Harpoon and HACCLE, and used them to program interesting applications (e.g., secure auction) and key computation components of Secure MPC applications (e.g., matrix-vector multiplication and merge sort). We show that the performance is improved by using our optimization strategies and heuristics.

One of the most used types of auctions in the smart grid is the double auction, in which both buyers and sellers can respectively submit their bids and asks to participate in the auction. In recent years, many schemes have been designed to propose a double auction mechanism for the smart grids; however, few of these schemes consider the information security aspects and users' privacy. In this paper, we propose a protocol that helps different double auction mechanisms be implemented securely in the smart grids. This protocol not only can satisfy the security requirements of a double auction scheme but is also compatible with the smart grid technologies. In this scheme, in order to preserve the users' anonymity and privacy, a pseudo-identity is assigned to each participant, and the bids/asks are encrypted using the Paillier cryptosystem. By virtue of the Pedersen commitment scheme used in this paper, the participants can be verified as having correctly and honestly followed the auction protocol. Moreover, the theoretical analysis and implementation results show that the proposed scheme can be considered as an efficient scheme for the smart grid entities involved in the auction process.

Cryptographic techniques have the potential to enable distrusting parties to collaborate in fundamentally new ways, but their practical implementation poses numerous challenges. An important class of such cryptographic techniques is known as secure multi-party computation (MPC). In an effort to provide an ecosystem for building secure MPC applications using higher degrees of automation, we present the HACCLE (High Assurance Compositional Cryptography: Languages and Environments) toolchain. The HACCLE toolchain contains an embedded domain-specific language (Harpoon) for software developers without cryptographic expertise to write MPC-based programs. Harpoon programs are compiled into acyclic circuits represented in HACCLE's Intermediate Representation (HIR) that serves as an abstraction for implementing a computation using different cryptographic protocols such as secret sharing, homomorphic encryption, or garbled circuits. Implementations of different cryptographic protocols serve as different backends of our toolchain. The extensible design of HIR allows cryptographic experts to plug in new primitives and protocols to realize computations.We have implemented HACCLE, and used it to program interesting algorithms and applications (e.g., secure auction, matrix-vector multiplication, and merge sort). We show that the performance is improved by using our optimization strategies and heuristics.

Memory hard functions (MHFs) are an important cryptographic primitive that are used to design egalitarian proofs of work and in the construction of moderately expensive key-derivation functions resistant to brute-force attacks. Broadly speaking, MHFs can be divided into two categories: data-dependent memory hard functions (dMHFs) and data-independent memory hard functions (iMHFs). iMHFs are resistant to certain side-channel attacks as the memory access pattern induced by the honest evaluation algorithm is independent of the potentially sensitive input e.g., password. While dMHFs are potentially vulnerable to side-channel attacks (the induced memory access pattern might leak useful information to a brute-force attacker), they can achieve higher cumulative memory complexity (CMC) in comparison than an iMHF. In this paper, we introduce the notion of computationally data-independent memory hard functions (ciMHFs). Intuitively, we require that memory access pattern induced by the (randomized) ciMHF evaluation algorithm appears to be independent from the standpoint of a computationally bounded eavesdropping attacker — even if the attacker selects the initial input. We then ask whether it is possible to circumvent known upper bound for iMHFs and build a ciMHF with CMC Ω(N^2). Surprisingly, we answer the question in the affirmative when the ciMHF evaluation algorithm is executed on a two-tiered memory architecture (RAM/Cache). See paper for the full abstract.

SummaryMany smart grid applications need broadcast communications. Because of the critical role of the broadcasted messages in these applications, their authentication is very important to prevent message forgery attacks. Smart grid consists of plenty of low‐resource devices such as smart meters or phasor measurement units (PMUs) that are located in physically unprotected environments. Therefore, the storage and computational constraints of these devices as well as their security against physical attacks must be considered in designing broadcast authentication schemes. In this paper, we consider two communication models based on the resources of the broadcasters and receivers and propose a physical unclonable function (PUF)–based broadcast authentication scheme for each of them including Broadcast Authentication with High‐Resource Broadcaster (BA‐HRB) and Broadcast Authentication with Low‐Resource Broadcaster (BA‐LRB). We formally prove that both schemes are unforgeable and memory leakage resilient. Moreover, we analyze the performance of our proposed schemes and compare them with related works. The comparison results demonstrate a significant improvement in the storage and computational overhead of our schemes compared with the related works.

In recent years, determining the common information privately and efficiently between two mutually mistrusting parties have become an important issue in social networks. Many Private set intersection (PSI) protocols have been introduced to address this issue. By applying these protocols, two parties can compute the intersection between their sets without disclosing any information about components that are not in the intersection. Due to the broad range of computational resources that the cloud can provide for its users, determining the set intersection by cloud may decrease the computational cost of the users. The proposed protocol by Abadi et al. is one of the introduced protocols in this context. In this paper, we show that their protocol is vulnerable against man in the middle attack and the collusion between the cloud and one of the communicating parties. Also, a solution will be proposed to secure the protocol against mentioned attacks.

In this paper, we propose an efficient secure data aggregation scheme for the smart grid, which supports both lossy and lossless data aggregation. In order to reduce the computational overhead of the control center, our proposed model includes a number of entities, called gateways, which act as intermediaries between the users and the control center. At the end of each measurement interval, each user generates a report which is encrypted using the Paillier cryptosystem and contains the user’s consumption amount during the previous measurement interval as well as his or her prediction of consumption during another interval in the future. After receiving the user’s reports, gateways perform both lossy and lossless aggregation on the encrypted reports without being aware of their contents. In lossy aggregation mode, thanks to the homomorphic property of Paillier cryptosystem, the gateways generate the aggregated data of users’ predictions in order to help the control center to estimate the future electricity usage of the grid. In the lossless aggregation mode, gateways provide the control center with the users’ billing information. Moreover, to encourage the users to predict their future consumption amounts more precisely, this scheme uses special billing policies in which the accuracy of users’ predictions can affect their total electricity costs.

Concurrent signatures allow two entities to generate two signatures in such a way that both signatures are ambiguous till some information is revealed by one of the parties. This kind of signature is useful in auction protocols and in a wide range of scenarios in which involving participants are mutually distrustful. In this study, to have quantum-attack-resistant concurrent signatures as recommended by National Institute of Standards and Technology (NISTIR 8105), the first concurrent signature scheme based on coding theory is proposed. Then, its security is proved under Goppa Parameterized Bounded Decoding and the Goppa Code Distinguishing assumptions in the random oracle model. In addition, performance evaluation shows that the proposal is approximately as efficient as Dallot scheme. The authors should highlight that their proposal can be a post-quantum candidate for fair exchange of signatures without a trusted third party in an efficient way (without a high degree of interactions).

Temporary keyword search on confidential data in a cloud environment is the main focus of this research. The cloud providers are not fully trusted. So, it is necessary to outsource data in the encrypted form. In the attribute-based keyword search (ABKS) schemes, the authorized users can generate some search tokens and send them to the cloud for running the search operation. These search tokens can be used to extract all the ciphertexts which are produced at any time and contain the corresponding keyword. Since this may lead to some information leakage, it is more secure to propose a scheme in which the search tokens can only extract the ciphertexts generated in a specified time interval. To this end, in this paper, we introduce a new cryptographic primitive called key-policy attribute-based temporary keyword search (KP-ABTKS) which provide this property. To evaluate the security of our scheme, we formally prove that our proposed scheme achieves the keyword secrecy property and is secure against selectively chosen keyword attack (SCKA) both in the random oracle model and under the hardness of Decisional Bilinear Diffie-Hellman (DBDH) assumption. Furthermore, we show that the complexity of the encryption algorithm is linear with respect to the number of the involved attributes. Performance evaluation shows our scheme's practicality.

In this paper, we revisit the round complexity of designing zero-knowledge (ZK) arguments via a black-box construction from minimal assumptions. Our main result implements a 4-round ZK argument for any language in (textsf {NP}), based on injective one-way functions, that makes black-box use of the underlying function. As a corollary, we also obtain the first 4-round perfect zero-knowledge argument for (textsf {NP}) based on claw-free permutations via a black-box construction and 4-round input-delayed commit-and-prove zero-knowledge argument based on injective one-way functions.

In broadcast encryption schemes, a distribution center broadcasts an encrypted message to a subset chosen from a universe of receivers and only the intended users are able to decrypt the message. Most broadcast encryption schemes do not provide anonymity and the identities of target receivers are sent in plaintext. However, in several applications, the authorized users’ identities have the same sensitivity as the broadcasted messages. Yu, Ren and Lou (YRL) considered this issue and introduced an e€icient anonymous a‚ribute-based broadcast encryption scheme. In this paper, we first propose an a‚ack on the YRL scheme and showthat the unauthorized receivers can also decrypt the broadcasted message. Next, we propose the Improved-YRL scheme and prove that it achieves anonymity and semantic security under adaptive corruptions in the chosen ciphertext se‚ing. The proof is provided using the dual system encryption technique and is based on three complexity assumptions in composite order bilinear maps. The Improved-YRL scheme is a step forwardin solving the long-standing problem of secure and low overhead anonymous broadcast encryption.

Recently, there has been shown a great interest in the private set intersection (PSI) protocols which are widely used in social networks applications. In a PSI protocol two entities are able to find the intersection of their document set without inferring more information than the common data. In some PSI protocols the process of finding the intersections of the documents are delegated to a third entity like cloud which has high computational and storage resources and the clients can verify the accuracy of the received results. These protocols are known as the Verifiable Delegated Set Intersection (VDSI). In this paper, we proposed an efficient VDSI protocol by employing the El-Gamal cryptosystem. We should highlight that, our proposal is a pairing free protocol which significantly reduces the computational overhead of the proposed VDSI construction.

With the development of modern power systems, Smart Grid as the intelligent generation of electricity networks, has been faced with a tremendous attention. The Smart Grid systems are made up of fine-grained power grid measurements to achieve a high stability and reliability. In these networks, the data security and privacy issues for secure data sharing among the components of the system have emerged as the basic requirement. Typically, a service provider securely shares the data/commands with the smart meters under an arbitrary policy which is determined by the service providers. As the smart grid components are considered to have constrained computational resources, we cannot directly use the common cryptographic primitives, such as attribute-based encryption schemes, for data sharing. In this paper, we consider a communications model in which a delegated third party as the storage center with a powerful computational ability is determined to partially decrypt the shared ciphertexts and finally the authorized end users can decrypt the received messages. Then we propose an efficient attribute-based signcryption scheme in which the number of the required pairing is independent to the number of the attributes. Complexity comparison of our proposed scheme with the existing work shows the efficiency of our proposal.

To provide the privacy of the users who receive some computing services from the cloud, the users must encrypt their documents before outsourcing them to the cloud. Computation on outsourced encrypted data in the cloud rises some complexity to the system specially in the case when an entity would like to find some documents related to a special keyword. Searchable encryption is a tool for data owners to encrypt their data in a searchable manner. Generally, there exist two kinds of searchable encryption, namely symmetric (secret key) and asymmetric (public key) ones. Most of the public key searchable encryption schemes are vulnerable to the keyword guessing attack (KGA). In this paper we propose an attribute-based keyword search scheme which is proved to be secure against KGA.

Multi sender attribute-based broadcast authentication scheme for the network containing resource constrained nodes is the main focus of this research. In this paper, we proposed a framework in which each element of a set of authorized users whose attributes satisfy a special sign control policy can generate a valid signature. In this framework, there exists a trusted server who receives and verifies the validity of the generated attribute-based signatures and broadcast the intended message through the nodes of the network in an efficient and authenticated manner. We also proposed a new symmetric-based broadcast authentication scheme which is used for broadcasting the authenticated messages in the proposed framework.

Hierarchical identity-based broadcast encryption (HIBBE) organizes the users in a tree-like structure in which they can delegate the decryption ability to their subordinates. In addition, the trusted third party (TTP) can reduce its burden because the users’ secret keys can be generated in a distributed mechanism by users’ supervisors. HIBBE enables encrypting a message for any arbitrary set of receivers, and only the chosen users and their supervisors are able to decrypt. To preserving the anonymity of the intended receivers, in this paper, for the first time, we propose an anonymous HIBBE scheme. The proposed scheme is constructed based on composite order bilinear maps. We formally define the anonymity against chosen identity vector set and chosen plaintext a‚ack (Anon-CIVS-CPA), and prove that the proposed scheme provides this property. Performance evaluation shows the practical and deployable aspects of our proposed scheme. With the advantage of HIBBE, we enable hierarchical identity-based signature (HIBS) schemes to sign a message for a set of designated verifiers. This resulted in proposing a generic construction for the novel notion of hierarchical identity-based multi-designated verifiable signature (HIB-MDVS). We formally define HIB-MDVS’s security against existential forgery under chosen message a‚ack (EF-CMA), prove that the resulting HIB-MDVS is unforgeable, and finally show that it provides the anonymity of the intended verifiers.

Broadcast encryption is a novel concept for sending a special message to a subset of users. In broadcast encryption schemes, the distribution center broadcasts the message in encrypted form and expect that only the intended users be able to decrypt the message. This concept has several applications such as pay-per-service TVs. In this paper, we investigate one of the most recent broadcast encryption schemes and show that the introduced scheme does not provide the main requirement of broadcast encryption schemes. For this purpose, we demonstrate that all of the users, including authorized and unauthorized users, can decrypt the broadcasted encrypted message.