While many distributed consensus protocols provide robust liveness and consistency guarantees under the presence of malicious actors, quantitative estimates of how economic incentives affect security are few and far between. In this paper, we describe a system for simulating how adversarial agents, both economically rational and Byzantine, interact with a blockchain protocol. This system provides statistical estimates for the economic difficulty of an attack and how the presence of certain actors influences protocol-level statistics, such as the expected time to regain liveness. This simulation system is influenced by the design of algorithmic trading and reinforcement learning systems that use explicit modeling of an agent's reward mechanism to evaluate and optimize a fully autonomous agent. We implement and apply this simulation framework to Kadena's Chainweb, a parallelized Proof-of-Work system, that contains complexity in how miner incentive compliance affects security and censorship resistance. We provide the first formal description of Chainweb that is in the literature and use this formal description to motivate our simulation design. Our simulation results include a phase transition in block height growth rate as a function of shard connectivity and empirical evidence that censorship in Chainweb is too costly for rational miners to engage in. We conclude with an outlook on how simulation can guide and optimize protocol development in a variety of contexts, including Proof-of-Stake parameter optimization and peer-to-peer networking design.

An important technique for confirming data integrity is to construct cryptographic hash values for the data. For bulk data, this can be done by generating hash values for ordered sequences of (variable sized) data blocks. This technique is already widely used in various HPE businesses, such as networking, data storage, and software certification (code integrity). The standard hash-chaining approach to constructing hash values can involve retaining large amounts of data due to differences in the order they are received in. In this paper, we present novel solutions to allow hash values to be calculated in stages. These partial hashes are calculated as data becomes available and then opportunistically combined as needed during the computation. The significant advantage of our approach is the considerable flexibility in exactly how and when those hashes are combined, leading to increased efficiencies in managing resources. External Posting Date: February 7, 2017 [Fulltext] Internal Posting Date: February 7, 2017 [Fulltext]  Copyright 2017 Hewlett Packard Enterprise Development LP 1 HashFusion – a method for combining cryptographic hash values Brian Monahan1, Liqun Chen2 and Stuart Haber 3 Hewlett Packard Labs Abstract An important technique for confirming data integrity is to construct cryptographic hash values for the data. For bulk data, this can be done by generating hash values for ordered sequences of (variable sized) data blocks. This technique is already widely used in various HPE businesses, such as networking, data storage, and software certification (code integrity). The standard hash-chaining approach to constructing hash values can involve retaining large amounts of data due to differences in the order they are received in. In this paper, we present novel solutions to allow hash values to be calculated in stages. These partial hashes are calculated as data becomes available and then opportunistically combined as needed during the computation. The significant advantage of our approach is the considerable flexibility in exactly how and when those hashes are combined, leading to increased efficiencies in managing resources.

As non-volatile memory (NVM) technologies are expected to replace DRAM in the near future, new challenges have emerged. For example, NVMs have slow and power-consuming writes, and limited write endurance. In addition, NVMs have a data remanence vulnerability, i.e., they retain data for a long time after being powered off. NVM encryption alleviates the vulnerability, but exacerbates the limited endurance by increasing the number of writes to memory. We observe that, in current systems, a large percentage of main memory writes result from data shredding in operating systems, a process of zeroing out physical pages before mapping them to new processes, in order to protect previous processes' data. In this paper, we propose Silent Shredder, which repurposes initialization vectors used in standard counter mode encryption to completely eliminate the data shredding writes. Silent Shredder also speeds up reading shredded cache lines, and hence reduces power consumption and improves overall performance. To evaluate our design, we run three PowerGraph applications and 26 multi-programmed workloads from the SPEC 2006 suite, on a gem5-based full system simulator. Silent Shredder eliminates an average of 48.6% of the writes in the initialization and graph construction phases. It speeds up main memory reads by 3.3 times, and improves the number of instructions per cycle (IPC) by 6.4% on average. Finally, we discuss several use cases, including virtual machines' data isolation and user-level large data initialization, where Silent Shredder can be used effectively at no extra cost.

A redactable signature scheme is one that allows the original signature to be used, usually along with some additional data, to verify certain carefully specified changes to the original document that was signed, namely the removal or redaction of subdocuments. For redactable signatures, the term transparency has been used to describe a scheme that hides the number and locations of redacted subdocuments. We present here two efficient transparent redactable signature schemes, which are the first such schemes in the literature that are based solely on tools of symmetric cryptography, along with a single application of an ordinary digital signature. As with several previous schemes for redactable signatures, we sign a sequence of randomized commitments that depend on the contents of the subdocuments of the document to be signed. In order to hide their number and location, we randomize their order, and mix them with a sequence of “dummy nodes” that are indistinguishable from commitment values. Our first scheme uses a data structure of size quadratic in the number of subdocuments, encoding all the precedence relations between pairs of subdocuments. By embedding these precedence relations in a smaller family of graphs, our second scheme is more efficient, with expected cost linear in the number of subdocuments in the document to be signed. We introduce a quantified version of the transparency property, precisely describing the uncertainty about the number of redacted subdocuments that is guaranteed by the two schemes. We prove that our schemes are secure, i.e. unforgeable, private, and transparent, based on the security of collision-free hash functions, pseudorandom generators, and digital signature schemes. While providing such strong security, our scheme is also efficient, in terms of both computation and communication.

A capturing group is a syntax used in modern regular expression implementations to specify a subexpression of a regular expression. Given a string that matches the regular expression, submatch extraction is the process of extracting the substrings corresponding to those subexpressions. Greedy and reluctant closures are variants on the standard closure operator that impact how submatches are extracted. The state of the art and practice in submatch extraction are automata based approaches and backtracking algorithms. In theory, the number of states in an automata-based approach can be exponential in n, the size of the regular expression, and the running time of backtracking algorithms can be exponential in ℓ, the length of the string. In this paper, we present an O(ℓc) runtime automata based algorithm for extracting submatches from a string that matches a regular expression, where c > 0 is the number of capturing groups. The previous fastest automata based algorithm was O(nℓc). Both our approach and the previous fastest one require worst-case exponential compile time. But in practice, the worst case behavior rarely occurs, so achieving a practical speed-up against state-of-the-art methods is of significant interest. Our experimental results show that, for a large set of regular expressions used in practice, our algorithm is approximately twice as fast as Java’s backtracking based regular expression library and approximately twenty times faster than the RE2 regular expression engine.

Providers of location-based services seek new methods to authenticate the location of their clients. We propose a novel infrastructure-based solution that provides spontaneous and transaction-oriented mobile device location authentication via an integrated 802.11× wireless access point and 3G femtocell access system. By simply making a voice call while remotely monitoring femtocell activity, a calling party can verify a (co-operating) called party's location even when the participants have no pre-existing relationship. We show how such a traffic signature can be reliably detected even in the presence of heavy cross-traffic introduced by other femtocell users. We describe how the verification proceeds without revealing details of the authentication - or even the parties involved - to the location provider.

Providers of location-based services seek new methods to authenticate the location of their clients. We propose a novel, intelligent infrastructure-based solution that provides spontaneous and transaction-oriented, collusion-resistant mobile device location authentication via an integrated 802.11x wireless access point and 3G femtocell access system. By simply making a voice call while remotely monitoring femtocell activity, a calling party can verify a (cooperating) called party’s location even when the participants have no preexisting relationship. We show how such a traffic signature can be reliably detected even in the presence of heavy crosstraffic introduced by other femtocell users. Remarkably, we describe how the verification proceeds without revealing details of the authentication – or even the parties involved – to the location provider.

Outsourced databases provide a solution for data owners who want to delegate the task of answering database queries to third-party service providers. However, distrustful users may desire a means of verifying the integrity of responses to their database queries. Simultaneously, for privacy or security reasons, the data owner may want to keep the database hidden from service providers. This security property is particularly relevant for aggregate databases, where data is sensitive, and results should only be revealed for queries that are aggregate in nature. In such a scenario, using simple signature schemes for verification does not suffice. We present a solution in which service providers can collaboratively compute aggregate queries without gaining knowledge of intermediate results, and users can verify the results of their queries, relying only on their trust of the data owner. Our protocols are secure under reasonable cryptographic assumptions, and are robust to collusion among k dishonest service providers.

In this paper we give a new signature algorithm that allows for controlled changes to the signed data. The change operations we study are removal of subdocuments (redaction), pseudonymization, and gradual deidentification of hierarchically structured data. These operations are applicable in a number of practically relevant application scenarios, including the release of previously classified government documents, privacy-aware management of audit-log data, and the release of tables of health records. When applied directly to redaction, our algorithm improves on [18] by reducing significantly the overhead of cryptographic information that has to be stored with the original data.

We present a "content integrity service" for long-lived digital documents, especially for objects stored in digital repositories. The goal of the service is to demonstrate that information in the repository is authentic and has not been unintentionally or maliciously altered, even after its bit representation in the repository has undergone one or more transformations. We describe our design for an efficient, secure service that achieves this, and our implementations of two prototypes of such a service that we developed, most recently for DSpace. Our solution relies on one-way hashing and digital time-stamping procedures. Our service applies not only to transformations to archival content such as format changes, but also to the introduction of new cryptographic primitives, such as the new one-way hash function family that will be chosen by NIST in the competition that was recently announced (10). In the face of recent attacks on hash functions, this feature is absolutely necessary to the design of an integrity-preserving system that is meant to endure for decades.

It is often desirable to be able to guarantee the integrity of historical data, ensuring that any subsequent modifications to the data can be detected. It would be especially convenient to extend such proofs of integrity to certain computations performed later using the historic data. We raise this question in the context of outsourced databases, where a data owner delegates the ability to answer users’ queries to a service provider, and distrustful users may desire to verify the integrity of responses to their queries on the data. We present a solution for integrity verification of aggregate database queries, such as SUM and MAX, with efficient proofs of correctness and completeness of responses to the queries. What makes the problem challenging is that individual data entries may be sensitive, and should not be revealed to the user. Our protocols are secure, under reasonable cryptographic assumptions.

function? This is no longer the merely academic ques­ tion it was when it was first raised by the authors of New collision-finding attacks on widely used crypto[3], who proposed an incorrect solution, and then cor­ graphic hash functions raise questions about systems rectly solved by [1]. that depend on certain properties of these functions for their security. Even after new and presumably better hash functions are deployed, users may have 2 Renewing integrity certifi­ digital signatures and digital time-stamp certificates cates that were computed with recently deprecated hash functions. Is there any way to use a new and cur­ rently unassailable hash function to buttress the se2.1 Time-stamp certificates curity of an old signature or time-stamp certificate? Here we describe the process of “renewing” digital The main purpose of this note is to remind the time-stamp certificates, as presented by [1]. technical community of a simple solution to this probSuppose that an implementation of a particular lem that was published more than a decade ago. time-stamping system is in place, and consider the pair (x, c1), where c1 is a valid time-stamp certifi­ cate (in this implementation) for the bit-string x. Introduction Now suppose that some time later an improved timeWith advances in computational power and restamping system is implemented and deployed—by sources, as well as the discovery of entirely new cryptreplacing the hash function used in the original sys­ analytic algorithms, particular instances of cryptotem with a new hash function, or even perhaps af­ graphic primitives that were secure when they were ter the invention of a completely new algorithm. Is first deployed may become insecure several years there any way to use the new time-stamping system later. In the last couple of years, the cryptographic to buttress the guarantee of integrity supplied by the community has been surprised by powerful new atcertificate, c1, in the face of potential later attacks on tacks on the hash functions MD5 and SHA-1, among the old system? others [6, 5]. This raises the question of how best to One could simply submit x as a request to the new introduce a new and presumably more secure hash time-stamping system. But this would lose the confunction into a system that now uses an older hashnection to the original time of certification. function design that may soon be subject to devasAnother possibility is to submit c1 as a request to tating compromise. In particular, what can be done the new time-stamping system. But that would be with digital signatures and time-stamp certificates vulnerable to the later existence of a devastating atthat were computed using the original system’s hash tack on the hash function used in the computation