CryptoVerif Tutorial
|
|
|
- Amanda Chambers
- 10 years ago
- Views:
Transcription
1 CryptoVerif Tutorial Bruno Blanchet INRIA Paris-Rocquencourt November 2014 Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
2 Exercise 1: preliminary definition SUF-CMA Definition (SUF-CMA MACs) The advantage of the adversary against strong unforgeability under chosen message attacks (SUF-CMA) of MACs is: Succ suf cma MAC (t, q m, q v, l) = [ max Pr A k R mkgen; (m, s) A mac(.,k),verify(.,k,.) : verify(m, k, s) s is not the result of calling the oracle mac(., k) on m where A runs in time at most t, calls mac(., k) at most q m times with messages of length at most l, calls verify(., k,.) at most q v times with messages of length at most l. MAC is SUF-CMA if and only if Succ suf cma MAC (t, q m, q v, l) is negligible when t, q m, q v, l are polynomial in the security parameter. ] Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
3 Exercise 1: preliminary definition IND-CCA2 Definition (IND-CCA2 symmetric encryption) The advantage of the adversary against indistinguishabibility under adaptive chosen-ciphertext attacks (IND-CCA2) of a symmetric encryption scheme SE is: Succ ind cca2 SE (t, q e, q d, l e, l d ) = b {0, R 1}; k R kgen; max 2 Pr b A enc(lr(.,.,b),k),dec(.,k) : b = b A A has not called dec(., k) on the result of 1 enc(lr(.,., b), k) where A runs in time at most t, calls enc(lr(.,., b), k) at most q e times on messages of length at most l e, calls dec(., k) at most q d times on messages of length at most l d. SE is IND-CCA2 if and only if Succ ind cca2 SE (t, q e, q d, l e, l d ) is negligible when t, q e, q d, L e, l d are polynomial in the security parameter. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
4 Exercise 1: preliminary definition INT-CTXT Definition (INT-CTXT symmetric encryption) The advantage of the adversary against ciphertext integrity (INT-CTXT) of a symmetric encryption scheme SE is: Succ int ctxt SE (t, q e, q d, l e, l d ) = [ max Pr A k R kgen; c A enc(.,k),dec(.,k) : dec(c, k) c is not the result of a call to the enc(., k) oracle where A runs in time at most t, calls enc(., k) at most q e times with messages of length at most l e, calls dec(., k) at most q d times with messages of length at most l d. SE is INT-CTXT if and only if Succ int ctxt SE (t, q e, q d, l e, l d ) is negligible when t, q e, q d, L e, l d are polynomial in the security parameter. ] Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
5 Exercise 1 1 Show using CryptoVerif that, if the MAC scheme is SUF-CMA and the encryption scheme is IND-CPA, then the encrypt-then-mac scheme is IND-CPA. 2 Show using the same assumptions that the encrypt-then-mac scheme is IND-CCA2. 3 Show using the same assumptions that the encrypt-then-mac scheme is INT-CTXT. 4 What happens if the MAC scheme is only UF-CMA? Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
6 Exercise 2: Preliminary definition A public-key encryption scheme AE consists of a key generation algorithm (pk, sk) R kgen a probabilistic encryption algorithm enc(m, pk) a decryption algorithm dec(m, sk) such that dec(enc(m, pk), sk) = m. The advantage of the adversary against indistinguishability under chosen-plaintext attacks (IND-CPA) is Succ ind cca2 AE (t) = max 2 Pr b {0, R 1}; (pk, sk) R kgen; (m A 0, m 1, s) A 1 (pk); y enc(m b, pk); 1 b A 2 (m 0, m 1, s, y) : b = b where A = (A 1, A 2 ) runs in time at most t. AE is IND-CPA if and only if Succ ind cpa AE (t) is negligible when t is polynomial in the security parameter. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
7 Exercise 2 Suppose that H is a hash function in the Random Oracle Model and that f is a one-way trapdoor permutation. Consider the encryption function E pk (x) = f pk (r) H(r) x, where denotes concatenation and denotes exclusive or (Bellare & Rogaway, CCS 93). What is the decryption function? Show using CryptoVerif that this public-key encryption scheme is IND-CPA. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
8 Exercise 3 Consider the fixed version of the Woo-Lam shared-key protocol, by Gordon and Jeffrey (CSFW 01): A B: B A: A B: B S: S B: A N (fresh nonce) {m3, B, N} kas A, B, {m3, B, N} kas {m5, A, N} kbs At the end, B verifies that {m5, A, N} kbs is the message from S. Show that, at the end of the protocol, A is authenticated to B. Suggestion: one may consider 1 First, a simple version in which A talks only to B, B talks only to A, and S talks only to A and B. 2 Then, generalize to the case in which A, B, and S may also talk to dishonest participants. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
9 Exercise 4 Consider the Needham-Schroeder public-key protocol, as fixed by Lowe. We first consider a simplified version without certificates: A B: B A: A B: {N A, pk A } pkb {N A, N B, pk B } pka {N B } pkb Show that, at the end of the protocol, A and B are mutually authenticated. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
10 Exercise 4 Now consider the full version with certificates: A S: (A, B) S A: (pk B, B, {pk B, B} sks ) A B: {N A, A} pkb B S: (B, A) S B: (pk A, A, {pk A, A} sks ) B A: {N A, N B, B} pka A B: {N B } pkb Show that, at the end of the protocol, A and B are mutually authenticated. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
11 Exercise 5 The advantage of the adversary against strong unforgeability under chosen message attacks (SUF-CMA) of MACs is: Succ suf cma MAC (t, q m, q v, l) = [ max Pr A k R mkgen; (m, s) A mac(.,k),verify(.,k,.) : verify(m, k, s) s is not the result of calling the oracle mac(., k) on m where A runs in time at most t, calls mac(., k) at most q m times with messages of length at most l, calls verify(., k,.) at most q v times with messages of length at most l. Represent SUF-CMA MACs in the CryptoVerif formalism. ] Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
12 Exercise 6 A signature scheme S consists of a key generation algorithm (pk, sk) R kgen a signature algorithm sign(m, sk) a verification algorithm verify(m, pk, s) such that verify(m, pk, sign(m, sk)) = 1. The advantage of the adversary against unforgeability under chosen message attacks (UF-CMA) of signatures is: Succ uf cma S (t, q s, l) = [ max Pr A (pk, sk) R kgen; (m, s) A sign(.,sk) (pk) : verify(m, pk, s) m was never queried to the oracle sign(., sk) where A runs in time at most t, calls sign(., sk) at most q s times with messages of length at most l. Represent UF-CMA signatures in the CryptoVerif formalism. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14 ]
13 Exercise 7 The advantage of the adversary against ciphertext integrity (INT-CTXT) of a symmetric encryption scheme SE is: Succ int ctxt SE (t, q e, q d, l e, l d ) = [ max Pr A k R kgen; c A enc(.,k),dec(.,k) : dec(c, k) c is not the result of a call to the enc(., k) oracle where A runs in time at most t, calls enc(., k) at most q e times with messages of length at most l e, calls dec(., k) at most q d times with messages of length at most l d. Represent INT-CTXT encryption in the CryptoVerif formalism. ] Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
14 Exercise 8 A public-key encryption scheme AE consists of a key generation algorithm (pk, sk) R kgen a probabilistic encryption algorithm enc(m, pk) a decryption algorithm dec(m, sk) such that dec(enc(m, pk), sk) = m. The advantage of the adversary against indistinguishability under adaptive chosen-ciphertext attacks (IND-CCA2) is Succ ind cca2 AE (t, q d ) = b {0, R 1}; (pk, sk) R kgen; max 2 Pr (m 0, m 1, s) A dec(.,sk) 1 (pk); y enc(m b, pk); A b A dec(.,sk) 2 (m 0, m 1, s, y) : b = b 1 A 2 has not called dec(., sk) on y where A = (A 1, A 2 ) runs in time at most t and calls dec(., sk) at most q d times. Represent IND-CCA2 encryption in the CryptoVerif formalism. Bruno Blanchet (INRIA) CryptoVerif Tutorial November / 14
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre
Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre Some slides were also taken from Chanathip Namprempre's defense
Provable-Security Analysis of Authenticated Encryption in Kerberos
Provable-Security Analysis of Authenticated Encryption in Kerberos Alexandra Boldyreva Virendra Kumar Georgia Institute of Technology, School of Computer Science 266 Ferst Drive, Atlanta, GA 30332-0765
Ciphertext verification security of symmetric encryption schemes
www.scichina.com info.scichina.com www.springerlink.com Ciphertext verification security of symmetric encryption schemes HU ZhenYu 1, SUN FuChun 1 & JIANG JianChun 2 1 National Laboratory of Information
Authenticated Encryption: Relations among notions and analysis of the generic composition paradigm
An extended abstract of this paper appears in Tatsuaki Okamoto, editor, Advances in Cryptology ASIACRYPT 2000, Volume 1976 of Lecture Notes in Computer Science, pages 531 545, Kyoto, Japan, December 3
Introduction. Digital Signature
Introduction Electronic transactions and activities taken place over Internet need to be protected against all kinds of interference, accidental or malicious. The general task of the information technology
MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC
MESSAGE AUTHENTICATION IN AN IDENTITY-BASED ENCRYPTION SCHEME: 1-KEY-ENCRYPT-THEN-MAC by Brittanney Jaclyn Amento A Thesis Submitted to the Faculty of The Charles E. Schmidt College of Science in Partial
Authenticated Encryption (AE) Instructor: Ahmad Boorghany
Sharif University of Technology Department of Computer Engineering Data and Network Security Lab Authenticated Encryption (AE) Instructor: Ahmad Boorghany Most of the slides are obtained from Bellare and
Lecture 3: One-Way Encryption, RSA Example
ICS 180: Introduction to Cryptography April 13, 2004 Lecturer: Stanislaw Jarecki Lecture 3: One-Way Encryption, RSA Example 1 LECTURE SUMMARY We look at a different security property one might require
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)
The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?) Hugo Krawczyk Abstract. We study the question of how to generically compose symmetric encryption and authentication
1 Message Authentication
Theoretical Foundations of Cryptography Lecture Georgia Tech, Spring 200 Message Authentication Message Authentication Instructor: Chris Peikert Scribe: Daniel Dadush We start with some simple questions
DIGITAL SIGNATURES 1/1
DIGITAL SIGNATURES 1/1 Signing by hand COSMO ALICE ALICE Pay Bob $100 Cosmo Alice Alice Bank =? no Don t yes pay Bob 2/1 Signing electronically Bank Internet SIGFILE } {{ } 101 1 ALICE Pay Bob $100 scan
Reconsidering Generic Composition
Reconsidering Generic Composition Chanathip Namprempre Thammasat University, Thailand Phillip Rogaway University of California, Davis, USA Tom Shrimpton Portland State University, USA 1/24 What is the
MACs Message authentication and integrity. Table of contents
MACs Message authentication and integrity Foundations of Cryptography Computer Science Department Wellesley College Table of contents Introduction MACs Constructing Secure MACs Secure communication and
Authentication and Encryption: How to order them? Motivation
Authentication and Encryption: How to order them? Debdeep Muhopadhyay IIT Kharagpur Motivation Wide spread use of internet requires establishment of a secure channel. Typical implementations operate in
1 Construction of CCA-secure encryption
CSCI 5440: Cryptography Lecture 5 The Chinese University of Hong Kong 10 October 2012 1 Construction of -secure encryption We now show how the MAC can be applied to obtain a -secure encryption scheme.
Chapter 11. Asymmetric Encryption. 11.1 Asymmetric encryption schemes
Chapter 11 Asymmetric Encryption The setting of public-key cryptography is also called the asymmetric setting due to the asymmetry in key information held by the parties. Namely one party has a secret
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
CS155. Cryptography Overview
CS155 Cryptography Overview Cryptography Is n A tremendous tool n The basis for many security mechanisms Is not n The solution to all security problems n Reliable unless implemented properly n Reliable
1 Digital Signatures. 1.1 The RSA Function: The eth Power Map on Z n. Crypto: Primitives and Protocols Lecture 6.
1 Digital Signatures A digital signature is a fundamental cryptographic primitive, technologically equivalent to a handwritten signature. In many applications, digital signatures are used as building blocks
Foundations of Group Signatures: The Case of Dynamic Groups
A preliminary version of this paper appears in Topics in Cryptology CT-RSA 05, Lecture Notes in Computer Science Vol.??, A. Menezes ed., Springer-Verlag, 2005. This is the full version. Foundations of
Chosen-Ciphertext Security from Identity-Based Encryption
Chosen-Ciphertext Security from Identity-Based Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz Abstract We propose simple and efficient CCA-secure public-key encryption schemes (i.e., schemes
Authenticated encryption
Authenticated encryption Dr. Enigma Department of Electrical Engineering & Computer Science University of Central Florida [email protected] October 16th, 2013 Active attacks on CPA-secure encryption
MAC. SKE in Practice. Lecture 5
MAC. SKE in Practice. Lecture 5 Active Adversary Active Adversary An active adversary can inject messages into the channel Active Adversary An active adversary can inject messages into the channel Eve
Chapter 12. Digital signatures. 12.1 Digital signature schemes
Chapter 12 Digital signatures In the public key setting, the primitive used to provide data integrity is a digital signature scheme. In this chapter we look at security notions and constructions for this
Crypto-Verifying Protocol Implementations in ML
Crypto-Verifying Protocol Implementations in ML Karthikeyan Bhargavan 1,2 Ricardo Corin 1,3 Cédric Fournet 1,2 1 MSR-INRIA Joint Centre 2 Microsoft Research 3 University of Twente June 2007 Abstract We
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
1 Signatures vs. MACs
CS 120/ E-177: Introduction to Cryptography Salil Vadhan and Alon Rosen Nov. 22, 2006 Lecture Notes 17: Digital Signatures Recommended Reading. Katz-Lindell 10 1 Signatures vs. MACs Digital signatures
Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks
Identity-based Encryption with Post-Challenge Auxiliary Inputs for Secure Cloud Applications and Sensor Networks Tsz Hon Yuen - Huawei, Singapore Ye Zhang - Pennsylvania State University, USA Siu Ming
Lecture 10: CPA Encryption, MACs, Hash Functions. 2 Recap of last lecture - PRGs for one time pads
CS 7880 Graduate Cryptography October 15, 2015 Lecture 10: CPA Encryption, MACs, Hash Functions Lecturer: Daniel Wichs Scribe: Matthew Dippel 1 Topic Covered Chosen plaintext attack model of security MACs
Computational Soundness of Symbolic Security and Implicit Complexity
Computational Soundness of Symbolic Security and Implicit Complexity Bruce Kapron Computer Science Department University of Victoria Victoria, British Columbia NII Shonan Meeting, November 3-7, 2013 Overview
Message Authentication Codes 133
Message Authentication Codes 133 CLAIM 4.8 Pr[Mac-forge A,Π (n) = 1 NewBlock] is negligible. We construct a probabilistic polynomial-time adversary A who attacks the fixed-length MAC Π and succeeds in
Identity-Based Encryption from the Weil Pairing
Appears in SIAM J. of Computing, Vol. 32, No. 3, pp. 586-615, 2003. An extended abstract of this paper appears in the Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer Science, pages
On the Security of the Tor Authentication Protocol
On the Security of the Tor Authentication Protocol Ian Goldberg David R. Cheriton School of Computer Science, University of Waterloo, 00 University Ave W, Waterloo, ON NL 3G1 [email protected] Abstract.
Overview of Public-Key Cryptography
CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows
Universal Padding Schemes for RSA
Universal Padding Schemes for RSA Jean-Sébastien Coron, Marc Joye, David Naccache, and Pascal Paillier Gemplus Card International, France {jean-sebastien.coron, marc.joye, david.naccache, pascal.paillier}@gemplus.com
Chapter 16: Authentication in Distributed System
Chapter 16: Authentication in Distributed System Ajay Kshemkalyani and Mukesh Singhal Distributed Computing: Principles, Algorithms, and Systems Cambridge University Press A. Kshemkalyani and M. Singhal
Cryptosystems. Bob wants to send a message M to Alice. Symmetric ciphers: Bob and Alice both share a secret key, K.
Cryptosystems Bob wants to send a message M to Alice. Symmetric ciphers: Bob and Alice both share a secret key, K. C= E(M, K), Bob sends C Alice receives C, M=D(C,K) Use the same key to decrypt. Public
3-6 Toward Realizing Privacy-Preserving IP-Traceback
3-6 Toward Realizing Privacy-Preserving IP-Traceback The IP-traceback technology enables us to trace widely spread illegal users on Internet. However, to deploy this attractive technology, some problems
Capture Resilient ElGamal Signature Protocols
Capture Resilient ElGamal Signature Protocols Hüseyin Acan 1, Kamer Kaya 2,, and Ali Aydın Selçuk 2 1 Bilkent University, Department of Mathematics [email protected] 2 Bilkent University, Department
Symmetric Crypto MAC. Pierre-Alain Fouque
Symmetric Crypto MAC Pierre-Alain Fouque Birthday Paradox In a set of D elements, by picking at random D elements, we have with high probability a collision two elements are equal D=365, about 23 people
Authenticated Encryption in SSH: Provably Fixing the SSH Binary Packet Protocol
Authenticated Encryption in SSH: Provably Fixing the SSH Binary Packet Protocol Mihir Bellare UC San Diego [email protected] Tadayoshi Kohno UC San Diego [email protected] Chanathip Namprempre Thammasat
Digital Signatures. What are Signature Schemes?
Digital Signatures Debdeep Mukhopadhyay IIT Kharagpur What are Signature Schemes? Provides message integrity in the public key setting Counter-parts of the message authentication schemes in the public
Digital Signatures. Prof. Zeph Grunschlag
Digital Signatures Prof. Zeph Grunschlag (Public Key) Digital Signatures PROBLEM: Alice would like to prove to Bob, Carla, David,... that has really sent them a claimed message. E GOAL: Alice signs each
Talk announcement please consider attending!
Talk announcement please consider attending! Where: Maurer School of Law, Room 335 When: Thursday, Feb 5, 12PM 1:30PM Speaker: Rafael Pass, Associate Professor, Cornell University, Topic: Reasoning Cryptographically
Q: Why security protocols?
Security Protocols Q: Why security protocols? Alice Bob A: To allow reliable communication over an untrusted channel (eg. Internet) 2 Security Protocols are out there Confidentiality Authentication Example:
How to Formally Model Features of Network Security Protocols
, pp.423-432 http://dx.doi.org/10.14257/ijsia How to Formally Model Features of Network Security Protocols Gyesik Lee Dept. of Computer & Web Information Engineering Hankyong National University Anseong-si,
Lecture 15 - Digital Signatures
Lecture 15 - Digital Signatures Boaz Barak March 29, 2010 Reading KL Book Chapter 12. Review Trapdoor permutations - easy to compute, hard to invert, easy to invert with trapdoor. RSA and Rabin signatures.
Non-interactive and Reusable Non-malleable Commitment Schemes
Non-interactive and Reusable Non-malleable Commitment Schemes Ivan Damgård a Jens Groth b June 16, 2003 Abstract We consider non-malleable (NM) and universally composable (UC) commitment schemes in the
Cryptography Overview
Cryptography Overview Cryptography Is n A tremendous tool n The basis for many security mechanisms Is not n The solution to all security problems n Reliable unless implemented properly n Reliable unless
Lecture 13: Message Authentication Codes
Lecture 13: Message Authentication Codes Last modified 2015/02/02 In CCA security, the distinguisher can ask the library to decrypt arbitrary ciphertexts of its choosing. Now in addition to the ciphertexts
Lecture 9 - Message Authentication Codes
Lecture 9 - Message Authentication Codes Boaz Barak March 1, 2010 Reading: Boneh-Shoup chapter 6, Sections 9.1 9.3. Data integrity Until now we ve only been interested in protecting secrecy of data. However,
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.
QUANTUM COMPUTERS AND CRYPTOGRAPHY. Mark Zhandry Stanford University
QUANTUM COMPUTERS AND CRYPTOGRAPHY Mark Zhandry Stanford University Classical Encryption pk m c = E(pk,m) sk m = D(sk,c) m??? Quantum Computing Attack pk m aka Post-quantum Crypto c = E(pk,m) sk m = D(sk,c)
Message Authentication Code
Message Authentication Code Ali El Kaafarani Mathematical Institute Oxford University 1 of 44 Outline 1 CBC-MAC 2 Authenticated Encryption 3 Padding Oracle Attacks 4 Information Theoretic MACs 2 of 44
Overview of Cryptographic Tools for Data Security. Murat Kantarcioglu
UT DALLAS Erik Jonsson School of Engineering & Computer Science Overview of Cryptographic Tools for Data Security Murat Kantarcioglu Pag. 1 Purdue University Cryptographic Primitives We will discuss the
Lecture 2 August 29, 13:40 15:40
Lecture 2 August 29, 13:40 15:40 Public-key encryption with keyword search Anonymous identity-based encryption Identity-based encryption with wildcards Public-key encryption with keyword search & anonymous
Simplified Security Notions of Direct Anonymous Attestation and a Concrete Scheme from Pairings
Simplified Security Notions of Direct Anonymous Attestation and a Concrete Scheme from Pairings Ernie Brickell Intel Corporation [email protected] Liqun Chen HP Laboratories [email protected] March
Overview of Symmetric Encryption
CS 361S Overview of Symmetric Encryption Vitaly Shmatikov Reading Assignment Read Kaufman 2.1-4 and 4.2 slide 2 Basic Problem ----- ----- -----? Given: both parties already know the same secret Goal: send
Efficient and Secure Authenticated Key Exchange Using Weak Passwords
Efficient and Secure Authenticated Key Exchange Using Weak Passwords Jonathan Katz Rafail Ostrovsky Moti Yung Abstract Mutual authentication and authenticated key exchange are fundamental techniques for
Recongurable Cryptography: A exible approach to long-term security
Recongurable Cryptography: A exible approach to long-term security Julia Hesse and Dennis Hofheinz and Andy Rupp Karlsruhe Institute of Technology, Germany {julia.hesse, dennis.hofheinz, andy.rupp}@kit.edu
Delegation of Cryptographic Servers for Capture-Resilient Devices
ACM, 2001. This is the authors' version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version is available at http://doi.acm.org/10.1145/501983.501986.
Certificate Based Signature Schemes without Pairings or Random Oracles
Certificate Based Signature Schemes without Pairings or Random Oracles p. 1/2 Certificate Based Signature Schemes without Pairings or Random Oracles Joseph K. Liu, Joonsang Baek, Willy Susilo and Jianying
A Secure RFID Ticket System For Public Transport
A Secure RFID Ticket System For Public Transport Kun Peng and Feng Bao Institute for Infocomm Research, Singapore Abstract. A secure RFID ticket system for public transport is proposed in this paper. It
Advanced Cryptography
Family Name:... First Name:... Section:... Advanced Cryptography Final Exam July 18 th, 2006 Start at 9:15, End at 12:00 This document consists of 12 pages. Instructions Electronic devices are not allowed.
1. a. Define the properties of a one-way hash function. (6 marks)
1. a. Define the properties of a one-way hash function. (6 marks) A hash function h maps arbitrary length value x to fixed length value y such that: Hard to reverse. Given value y not feasible to find
Victor Shoup Avi Rubin. fshoup,[email protected]. Abstract
Session Key Distribution Using Smart Cards Victor Shoup Avi Rubin Bellcore, 445 South St., Morristown, NJ 07960 fshoup,[email protected] Abstract In this paper, we investigate a method by which smart
An Efficient and Secure Data Sharing Framework using Homomorphic Encryption in the Cloud
An Efficient and Secure Data Sharing Framework using Homomorphic Encryption in the Cloud Sanjay Madria Professor and Site Director for NSF I/UCRC Center on Net-Centric Software and Systems Missouri University
Chosen-Ciphertext Security from Identity-Based Encryption
Chosen-Ciphertext Security from Identity-Based Encryption Dan Boneh Ran Canetti Shai Halevi Jonathan Katz June 13, 2006 Abstract We propose simple and efficient CCA-secure public-key encryption schemes
Security Analysis for Order Preserving Encryption Schemes
Security Analysis for Order Preserving Encryption Schemes Liangliang Xiao University of Texas at Dallas Email: [email protected] Osbert Bastani Harvard University Email: [email protected] I-Ling
A CCA2 Secure Variant of the McEliece Cryptosystem
1 A CCA2 Secure Variant of the McEliece Cryptosystem Nico Döttling, Rafael Dowsley, Jörn Müller-Quade and Anderson C. A. Nascimento Abstract The McEliece public-ey encryption scheme has become an interesting
Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
Leakage-Resilient Authentication and Encryption from Symmetric Cryptographic Primitives
Leakage-Resilient Authentication and Encryption from Symmetric Cryptographic Primitives Olivier Pereira Université catholique de Louvain ICTEAM Crypto Group B-1348, Belgium [email protected]
Ensuring Integrity in Cloud Computing via Homomorphic Digital Signatures: new tools and results
Ensuring Integrity in Cloud Computing via Homomorphic Digital Signatures: new tools and results Dario Catalano Dario Fiore Luca Nizzardo University of Catania Italy IMDEA Software Institute Madrid, Spain
CS558. Network Security. Boston University, Computer Science. Midterm Spring 2014.
CS558. Network Security. Boston University, Computer Science. Midterm Spring 2014. Instructor: Sharon Goldberg March 25, 2014. 9:30-10:50 AM. One-sided handwritten aid sheet allowed. No cell phone or calculators
Message Authentication Codes
2 MAC Message Authentication Codes : and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l08, Steve/Courses/2013/s2/css322/lectures/mac.tex,
Schnorr Signcryption. Combining public key encryption with Schnorr digital signature. Laura Savu, University of Bucharest, Romania
Schnorr Signcryption Combining public key encryption with Schnorr digital signature Laura Savu, University of Bucharest, Romania IT Security for the Next Generation European Cup, Prague 17-19 February,
Chapter 3. Network Domain Security
Communication System Security, Chapter 3, Draft, L.D. Chen and G. Gong, 2008 1 Chapter 3. Network Domain Security A network can be considered as the physical resource for a communication system. This chapter
CSC474/574 - Information Systems Security: Homework1 Solutions Sketch
CSC474/574 - Information Systems Security: Homework1 Solutions Sketch February 20, 2005 1. Consider slide 12 in the handout for topic 2.2. Prove that the decryption process of a one-round Feistel cipher