Passwords and personal identification numbers (PINs) are convenient and ubiquitous, but they are quite vulnerable to attackers who stand near the user ("shoulder-surfers"). This problem may be partially resolved by changing the user interface, but previous solutions of this kind still give shoulder-surfing attackers a significant advantage over brute force search. This paper provides a novel solution based on three dimensions, particularly suitable for glasses-free three-dimensional (3D) displays found in many smartphones and handheld game consoles. A user at the "3D spot" may log in easily, while nearby shoulder-surfers gain no advantage. A detailed experimental usability analysis is performed to demonstrate the effectiveness of the proposed scheme in comparison to the existing methods.

Passwords and PINs are convenient and ubiquitous, yet they are quite vulnerable to attackers who stand near the user. This problem may be partially resolved by changing the user interface, but previous solutions of this kind still give shoulder-surfing attackers a significant advantage over brute-force search. We propose a novel solution based on 3D, especially suitable for glasses-free 3D displays found in many smartphones and handheld game consoles. A user at the “3D spot” may log in easily, while nearby shoulder-surfers gain no advantage. We perform a detailed experimental analysis of the usability of our scheme.

We reformalize and recast dual-receiver encryption (DRE) proposed in CCS ’04, a public-key encryption (PKE) scheme for encrypting to two independent recipients in one shot. We start by defining the crucial soundness property for DRE, which ensures that two recipients will get the same decryption result. While conceptually simple, DRE with soundness turns out to be a powerful primitive for various goals for PKE, such as complete non-malleability (CNM) and plaintext-awareness (PA). We then construct practical DRE schemes without random oracles under the Bilinear Decisional Diffie-Hellman assumption, while prior approaches rely on random oracles or inefficient non-interactive zero-knowledge proofs. Finally, we investigate further applications or extensions of DRE, including DRE with CNM, combined use of DRE and PKE, strengthening two types of PKE schemes with plaintext equality test, off-the-record messaging with a stronger notion of deniability, etc.

Error correction and message authentication are well studied in the literature, and various efficient solutions have been suggested and analyzed. This is however not the case for data streams in which the message is very long, possibly infinite, and not known in advance to the sender. Trivial solutions for error-correcting and authenticating data streams either suffer from a long delay at the receiver’s end or cannot perform well when the communication channel is noisy. In this work we suggest a constant-rate error-correction scheme and an efficient authentication scheme for data streams over a noisy channel (one-way communication, no feedback) in the shared-randomness model. Our first scheme does not assume shared randomness and (non-efficiently) recovers a (1 − 2c)-fraction prefix of the stream sent so far, assuming the noise level is at most c < 1/2. The length of the recovered prefix is tight. To be able to overcome the c = 1/2 barrier we relax the model and assume the parties pre-share a secret key. Under this assumption we show that for any given noise rate c < 1, there exists a scheme that correctly decodes a (1 − c)-fraction of the stream sent so far with high probability, and moreover, the scheme is efficient. Furthermore, if the noise rate exceeds c, the scheme aborts with high probability. We also show that no constant-rate authentication scheme recovers more than a (1 − c)-fraction of the stream sent so far with non-negligible probability, thus the relation between the noise rate and recoverable fraction of the stream is tight, and our scheme is optimal. Our techniques also apply to the task of interactive communication (two-way communication) over a noisy channel. In a recent paper, Braverman and Rao [STOC 2011] show that any function of two inputs has a constant-rate interactive protocol for two users that withstands a noise rate up to 1/4. By assuming that the parties share a secret random string, we extend this result and construct an interactive protocol that succeeds with overwhelming probability against noise rates up to 1/2. We also show that no constant-rate protocol exists for noise rates above 1/2 for functions that require two-way communication. This is contrasted with our first result in which computing the “function” requires only one-way communication and the noise rate can go up to 1.

We propose unique ring signatures that simplify and capture the spirit of linkable ring signatures. We use new techniques to provide an instantiation which can be tightly related to the DDH problem in the random oracle model, leading to the most efficient linkable/unique ring signature.

We propose a simple, general, and unified framework for constructing unique ring signatures that simplify and capture the spirit of linkable ring signatures. The framework, which can be efficiently instantiated in the random oracle and the standard model, is obtained by generalizing the Bellare-Goldwasser “PRF made public” paradigm. Security of the first instantiation can be tightly related to the DDH problem. The scheme leads to the most efficient linkable/unique ring signature in the random oracle model, for a given level of provable security. The second one based on stronger assumptions partly simplifies and slightly improves sublinear size traceable ring signature of Fujisaki. Both of the improvements would be difficult without the general framework in hand.

An alibi provides evidence of a person's past location and can be critical in proving ones innocence. An alibi involves two parties: the owner , who benefits from the alibi, and the corroborator , who testifies for the owner. As mobile devices become ubiquitous, they can determine where we are and what we are doing, and help us to establish evidence of our location as they accompany us on our daily activities. Existing location-based services like Google Latitude can already track and record our every move, but these systems require us to reveal our identity when recording our location. This leaves our privacy at risk, and requires a trusted third party to maintain our location information.

We initiate the study of unique group signature such that signatures of the same message by the same user will always have a large common component (i.e., unique identifier). It enables an efficient detection algorithm, revealing the identities of illegal users, which is fundamentally different from previous primitives. We present a number of unique group signature schemes (without random oracles) under a variety of security models that extend the standard security models of ordinary group signatures. Our work is a beneficial step towards mitigating the well-known group signature paradox, and it also has many other interesting applications and efficiency implications.

We survey some recent progress in the design of efficient protocols for secure computation and communication, in a variety of cryptographic settings. The common thread is the usefulness of interesting algorithmic methods originally developed for non-cryptographic applications. We also present some intriguing open problems for which new algorithmic ideas may be needed.

In this work, we design two-party and multiparty protocols for evaluating multivariate polynomials at participants' inputs with security against a malicious adversary who may corrupt all but one of the parties. Our protocols are round and communication efficient, and use the underlying cryptographic primitives in a black-box way. Our construction achieves optimal communication complexity for degree 2 and 3 polynomials. Our constructions can be used to securely and efficiently realize a wide range of functionalities. For instance, we demonstrate how our techniques lead to efficient protocols for secure linear algebra with security against malicious adversaries. Other applications include secure evaluation of DNF/CNF formulas, and conditional secret reconstruction (or conditional oblivious transfer) for a large family of condition functions.

In this dissertation, we study the design of secure and efficient protocols for distributed linear algebra problems. All existing solutions to the problem are either inefficient in terms of round and communication complexity and/or provide security against very weak adversaries. We design protocols for two different adversarial settings. (i) Computational: where the adversary's computational resources are bounded, but the adversary is allowed to corrupt all but one of the participants. (ii) Information theoretic: where the adversary is unconditionally powerful, but is only allowed to corrupt a third of the participants. The security in both cases is defined in the real world/ideal world simulation paradigm, where we assume that the adversary can behave arbitrarily malicious. Our main constructions are O(s) round protocols with O(sn2+1/s) communication for testing singularity of a shared n x n matrix, for any positive integer s, in both adversarial settings. We then use and extend these constructions to design secure protocols for computing the rank of a shared matrix and solving shared linear systems with similar efficiency. Our protocols are almost optimal in terms of round and communication complexity, as they roughly match the efficiency of the best possible protocols for the case where security is not a concern. We use a wide range of techniques from computer algebra to reduce the problem of securely deciding singularity to the problem of secure matrix multiplication. We then design new and efficient protocols for secure matrix multiplication in both adversarial environments. In the computational setting, and when there are only two parties, we apply cut-and-choose techniques to encrypted algebraic encodings of the inputs, outputs, and intermediate values in order to prevent malicious behavior. We achieve even better amortized efficiency when running multiple instances of the protocol, via use of share-packing techniques. When the number of parties is more that two, our construction relies on efficient instantiations of the inner and outer protocols in a recently introduced compiler by Ishai et al. [35]. In the information theoretic setting, our protocol takes advantage of a homomorphic commitment scheme to achieve the improved efficiency.

A threshold decryption scheme is a multi-party public key cryptosystem that allows any sufficiently large subset of participants to decrypt a ciphertext, but disallows the decryption otherwise. Many threshold cryptographic schemes have been proposed so far, but fairness is not generally considered in this earlier work. In this paper, we present fair threshold decryption schemes, where either all of the participants can decrypt or none of them can. Our solutions employ semi-trusted third parties (STTP) and off-line semi-trusted third parties (OTTP) previously used for fair exchange. We consider a number of variants of our schemes to address realistic alternative trust scenarios. Although we describe our schemes using a simple hashed version of ElGamal encryption, our methods generalize to other threshold decryption schemes and threshold signature schemes as well.

We develop a new multi-party generalization of Naor-Nissim indirect indexing, making it possible for many participants to simulate a RAM machine with only poly-logarithmic blow-up. Underlying our approach is a new multi-party variant of oblivious transfer which may be of independent interest. Our most efficient instantiation (built from length-flexible additively homomorphic public key encryption) improves the communication complexity of secure multi-party computation for a number of problems in the literature. We explore, in depth, some of these applications, including private distributed constraint satisfaction problems, private stable bipartite matching, and private longest common subsequence. In the case of the private bipartite stable matching (stable marriage) problem, we follow-up the work of Golle (Financial Crypto 2006) who motivates the application and introduces a novel framework for the solving the problem. We show that the communication complexity of Golle’s main protocol is substantially greater than what was claimed, in part due to surprising pathological behavior of Golle’s variant of the Gale-Shapley stable matching algorithm. We develop new secure protocols in Golle’s basic framework with greatly reduced communication complexity. In the case of the longest common subsequence problem, we design communication efficient two-party and multi-party protocols for several variants of this and related problems. Our protocols achieve the first improvement to the communication complexity for this application over generic results (such as Yao’s garbled circuit protocol). As such, this result is interesting as a contribution to the theory of communication efficiency for secure two-party and multi-party applications. We benefit from the felicitous interplay of an efficient block-retrieval PIR (Gentry-Ramzan, ICALP 2005) with the classic “four Russians” algorithmic design. We believe this technique will be useful for privately implementing a variety of “efficiently encodable” dynamic programming applications.

Cryptosystems.- Chosen-Ciphertext Secure Proxy Re-encryption without Pairings.- Hybrid Damgard Is CCA1-Secure under the DDH Assumption.- Efficient Dynamic Broadcast Encryption and Its Extension to Authenticated Dynamic Broadcast Encryption.- Cryptanalysis of Short Exponent RSA with Primes Sharing Least Significant Bits.- Signatures.- Efficient and Short Certificateless Signature.- Sanitizable Signatures Revisited.- An Efficient On-Line/Off-Line Signature Scheme without Random Oracles.- On the Security of Online/Offline Signatures and Multisignatures from ACISP'06.- Identification, Authentication and Key Management.- A Killer Application for Pairings: Authenticated Key Establishment in Underwater Wireless Sensor Networks.- Anonymous and Transparent Gateway-Based Password-Authenticated Key Exchange.- Cryptanalysis of EC-RAC, a RFID Identification Protocol.- Cryptographic Algorithms and Protocols.- Counting Method for Multi-party Computation over Non-abelian Groups.- Keyword Field-Free Conjunctive Keyword Searches on Encrypted Data and Extension for Dynamic Groups.- Analysis and Design of Multiple Threshold Changeable Secret Sharing Schemes.- Black-Box Constructions for Fully-Simulatable Oblivious Transfer Protocols.- Skew Frobenius Map and Efficient Scalar Multiplication for Pairing-Based Cryptography.- Stream Ciphers and Block Ciphers.- Cryptanalysis of MV3 Stream Cipher.- 3D: A Three-Dimensional Block Cipher.- Cryptographic Foundations.- Construction of Resilient Functions with Multiple Cryptographic Criteria.- Enumeration of Homogeneous Rotation Symmetric Functions over F p .- Unconditionally Reliable Message Transmission in Directed Hypergraphs.- Applications and Implementations.- An Open Framework for Remote Electronic Elections.- Conditional Payments for Computing Markets.- High-Speed Search System for PGP Passphrases.- Workload Characterization of a Lightweight SSL Implementation Resistant to Side-Channel Attacks.- Security in Ad Hoc Networks and Wireless Sensor Networks.- Authenticated Directed Diffusion.- A New Message Recognition Protocol for Ad Hoc Pervasive Networks.