Erasable memory is an important resource for designing practical cryptographic protocols that are secure against adaptive attacks. Many practical memory devices such as solid state drives, hard disks, or file systems are not perfectly erasable because a deletion operation leaves traces of the deleted data in the system. A number of methods for constructing a large erasable memory from a small one, e.g., using encryption, have been proposed. Despite the importance of erasable memory in cryptography, no formal model has been proposed that allows one to formally analyse such memory constructions or cryptographic protocols relying on erasable memory. The contribution of this paper is three-fold. First, we provide a formal model of erasable memory. A memory device allows a user to store, retrieve, and delete data, and it is characterised by a leakage function defining the extent to which erased data is still accessible to an adversary. Second, we investigate how the erasability of such memories can be amplified. We provide a number of constructions of memories with strong erasability guarantees from memories with weaker guarantees. One of these constructions of perfectly erasable memories from imperfectly erasable ones can be considered as the prototypical application of Canetti et al.'s All-or-Nothing Transform AoNT. Motivated by this construction, we propose some new and better AoNTs that are either perfectly or computationally secure. These AoNTs are of possible independent interest. Third, we show in the constructive cryptography framework how the construction of erasable memory and its use in cryptographic protocols for example to achieve adaptive security can naturally be composed to obtain provable security of the overall protocol.

A constructive perspective on public-key encryption. Public-key encryption (PKE) is an extremely important and fundamental cryptographic primitive. The security of PKE has received much attention in the cryptographic literature, and many security notions for PKE have been proposed. When a PKE scheme is used in a larger protocol, the security of this protocol is proved by showing a reduction of breaking a certain security property of the PKE scheme to breaking the security of the protocol. Consequently, each protocol requires in principle its own tailor-made security reduction. Moreover, which PKE security notion should be used in a given context is a priori not evident: PKE security notions are usually defined in terms of a certain game that an efficient adversary cannot win with nonnegligible advantage; the employed games model the use of the scheme implicitly through oracle access to its algorithms, and the sufficiency for specific applications is neither explicitly stated nor proven. The first part of this thesis proposes a new approach to investigating the application of PKE, following the constructive cryptography (CC) paradigm of Maurer and Renner [MR11]: The basic use of PKE is to enable confidential communication from a sender A to a receiver B, assuming A is in possession of B’s public key. One can distinguish two relevant cases: The (non-confidential) communication channel from A to B can be authenticated (e.g., because messages are signed) or non-authenticated. The application of PKE is shown to provide the construction of a secure channel from A to B from two assumed authenticated channels, one in each direction, or, alternatively, if the channel from A to B is completely insecure, the construction of a confidential channel without authenticity. The composition theorem of CC implies that the assumed channels can either be physically realized or can themselves be constructed cryptographically, and also that the constructed channels can directly be used

In universal composability frameworks, adversaries or environments and protocols/ideal functionalities often have to exchange meta-information on the network interface, such as algorithms, keys, signatures, ciphertexts, signaling information, and corruption-related messages. For these purely modeling-related messages, which do not reflect actual network communication, it would often be very reasonable and natural for adversaries/environments to provide the requested information immediately or give control back to the protocol/functionality immediately after having received some information. However, in none of the existing models for universal composability is this guaranteed. We call this the non-responsiveness problem. As we will discuss in the paper, while formally non-responsiveness does not invalidate any of the universal composability models, it has many disadvantages, such as unnecessarily complex specifications and less expressivity. Also, this problem has often been ignored in the literature, leading to ill-defined and flawed specifications. Protocol designers really should not have to care about this problem at all, but currently they have to: giving the adversary/environment the option to not respond immediately to modeling-related requests does not translate to any real attack scenario. This paper solves the non-responsiveness problem and its negative consequences completely, by avoiding this artificial modeling problem altogether. We propose the new concepts of responsive environments and adversaries. Such environments and adversaries must provide a valid response to modeling-related requests before any other protocol/functionality is activated. Hence, protocol designers do no longer have to worry about artifacts resulting from such requests not being answered promptly. Our concepts apply to all existing models for universal composability, as exemplified for the UC, GNUC, and IITM models, with full definitions and proofs simulation relations, transitivity, equivalence of various simulation notions, and composition theorems provided for the IITM model.

Protecting user data entails providing authenticated users access to their data. The most prevalent and probably also the most feasible approach to the latter is by username and password. With password breaches through server compromise now reaching billions of affected passwords, distributing the password files and user data over multiple servers is not just a good idea, it is a dearly needed solution to a topical problem. Threshold password-authenticated secret sharing (TPASS) protocols enable users to share secret data among a set of servers so that they can later recover that data using a single password. No coalition of servers up to a certain threshold can learn anything about the data or perform an offline dictionary attack on the password. Several TPASS protocols have appeared in the literature and one is even available commercially. Although designed to tolerate server corruptions, unfortunately none of these protocols provide details, let alone security proofs, about how to proceed when a compromise actually occurs. Indeed, they consider static corruptions only, which for instance does not model real-world adaptive attacks by hackers. We provide the first TPASS protocol that is provably secure against adaptive server corruptions. Moreover, our protocol contains an efficient recovery procedure allowing one to re-initialize servers to recover from corruption. We prove our protocol secure in the universal-composability model where servers can be corrupted adaptively at any time; the users' passwords and secrets remain safe as long as both servers are not corrupted at the same time. Our protocol does not require random oracles but does assume that servers have certified public keys.

Provided are methods and apparatus for generating a secret encryption key of a user computer 3, which can be connected to a server 2 via a network. 4 On the client computer 3, a secret user value is provided. On the server 2, a server secret value with a check value is provided that encodes the user secret value and a user password. In response to input of an input password on the user computer 3, the user computer encodes the user secret value and the input password to generate a first value that corresponds to the check value, and transmits the first value over the network 4 to the server 2. In response, 2 compares the server the first value and the check value to check whether the input password is equal to the user's password. If this is the case, 2 encoded the server the first value and the secret Server value to generate a second value, and transmits the second value via the network 4 to the user computer 3. In response, the user's computer generates the secret encryption key by it encodes the second value, the input password and the user secret value.

One of the main objectives of the ABC4Trust project was to define a common, unified architecture for Privacy-ABC systems to allow comparing their respective features and combining them into common platforms. The chapter presents an overview of features and concepts of Privacy-ABCs and introduces the architecture proposed by ABC4Trust, describing the layers and components as well as the highlevel APIs. We also present the language framework of ABC4Trust through an example scenario. Furthermore, this chapter investigates integration of Privacy-ABCs with the existing Identity Management protocols and also analyses the required trust relationships in the ecosystem of Privacy-ABCs. As we mentioned in the previous chapter, there are several implementations of Privacy-ABCs, based on different cryptographic primitives. Even though these schemes have similar features, they are realized with different cryptographic mechanisms and many times they are even called differently, making these technologies hard to understand and compare. Their differences and complexity also makes it difficult for application developers to use them in practice and it is almost impossible to switch between them once the application has been deployed. The ABC4Trust architecture presented in this chapter aims to overcome these problems by defining an abstract interface to Privacy-ABCs, in such a way that they are independent from the concrete algorithms or cryptographic components used Patrik Bichsel, Jan Camenisch, Maria Dubovitskaya, Robert R. Enderlein, Stephan Krenn, Anja Lehmann, Gregory Neven, and Franz-Stefan Preiss IBM Research – Zurich, Switzerland, e-mail: {pbi,jca,mdu,enr,skr,anj,nev,frp}@

We present a set of new, efficient, universally composable two-party protocols for evaluating reactive arithmetic circuits modulo n, where n is a safe RSA modulus of unknown factorization. Our protocols are based on a homomorphic encryption scheme with message space ℤn, zero-knowledge proofs of existence, and a novel “mixed” trapdoor commitment scheme. Our protocols are proven secure against adaptive corruptions (assuming secure erasures) under standard assumptions in the CRS model (without random oracles). Our protocols appear to be the most efficient ones that satisfy these security requirements. In contrast to prior protocols, we provide facilities that allow for the use of our protocols as building blocks of higher-level protocols.

The notion of oblivious transfer with hidden access control policies (HACOT) was recently proposed by Camenisch et al. (Public-Key Cryptography 2011). This primitive allows a user to anonymously query a database where each record is protected by a hidden attribute-based access control policy. At each query, the user either learns the value of a single record if the attributes in his key satisfy the policy, or the mere fact that his attributes do not satisfy the policy. The database, even when colluding with the key issuer, learns nothing about the identity of the user, the index or the access policy of the record, or whether access was granted or denied. At the same time, the database can keep an eye on the overall access frequency to prevent the data from being "crawled". In this paper, we present a new HACOT scheme which is more efficient and offers more expressive policies than the scheme presented by Camenisch et al. We construct our HACOT protocol based on a hidden ciphertext-policy attribute-based encryption (HP-ABE) scheme by Nishide et al.: users are issued HACOT decryption keys based on HP-ABE attributes and HACOT records are encrypted under HP-ABE policies. However, as we will see, this simple approach does not work and we need to extend the Nishide et al. scheme as follows. First, we add protocols that allows users to verify that the public key of the issuer and ciphertexts are correctly formed. Second, we reserve one attribute and give the corresponding decryption key only to the database. Thereby users can no longer decrypt records by themselves but require the help of the database. Third, we provide a joint decryption protocol between the user and the database, so that the database does not learn which ciphertext is decrypted. The latter will also allow one to optionally add revocation of the users' access. We prove our construction secure by a reduction to the security of Nishide et al.'s scheme, the Symmetric External Diffie-Hellman (SXDH) and Simultaneous Flexible Pairing (SFP) assumptions.

The goal of ABC4Trust is to address the federation and interchangeability of technologies that support trustworthy yet Privacy-preserving Attribute-based Credentials (Privacy-ABCs). Towards this goal, one of the main objectives of the project is to define a common, unified architecture for Privacy-ABC systems to allow comparing their respective features and combining them into common platforms. The first version of this architecture is described in deliverable D2.1 of the project. Its main contribution is the specification of the data artefacts exchanged between the implicated entities (i.e. issuer, user, verifier, revocation authority, etc.), in such a way that the underlying differences of concrete Privacy-ABC implementations are abstracted away through the definition of formats that can convey information independently from the mechanism-specific cryptographic data. It also defines all technology-agnostic components and corresponding APIs a system needs to implement in order to perform the corresponding operations. This Deliverable (D2.2) comes to present the final version of the architecture. This document targets to keep early adopters up-to-date, so it presents only those changes that are relevant to the development of applications and removes the details of the internal components.