scholarly journals On the Security Margin of TinyJAMBU with Refined Differential and Linear Cryptanalysis

Author(s):  
Dhiman Saha ◽  
Yu Sasaki ◽  
Danping Shi ◽  
Ferdinand Sibleyras ◽  
Siwei Sun ◽  
...  

This paper presents the first third-party security analysis of TinyJAMBU, which is one of 32 second-round candidates in NIST’s lightweight cryptography standardization process. TinyJAMBU adopts an NLFSR based keyed-permutation that computes only a single NAND gate as a non-linear component per round. The designers evaluated the minimum number of active AND gates, however such a counting method neglects the dependency between multiple AND gates. There also exist previous works considering such dependencies with stricter models, however those are known to be too slow. In this paper, we present a new model that provides a good balance of efficiency and accuracy by only taking into account the first-order correlation of AND gates that frequently occurs in TinyJAMBU. With the refined model, we show a 338-round differential with probability 2−62.68 that leads to a forgery attack breaking 64-bit security. This implies that the security margin of TinyJAMBU with respect to the number of unattacked rounds is approximately 12%. We also show a differential on full 384 rounds with probability 2−70.64, thus the security margin of full rounds with respect to the data complexity, namely the gap between the claimed security bits and the attack complexity, is less than 8 bits. Our attacks also point out structural weaknesses of the mode that essentially come from the minimal state size to be lightweight.

Author(s):  
Raghvendra Rohit ◽  
Kai Hu ◽  
Sumanta Sarkar ◽  
Siwei Sun

Being one of the winning algorithms of the CAESAR competition and currently a second round candidate of the NIST lightweight cryptography standardization project, the authenticated encryption scheme Ascon (designed by Dobraunig, Eichlseder, Mendel, and Schläffer) has withstood extensive self and third-party cryptanalysis. The best known attack on Ascon could only penetrate up to 7 (out of 12) rounds due to Li et al. (ToSC Vol I, 2017). However, it violates the data limit of 264 blocks per key specified by the designers. Moreover, the best known distinguishers of Ascon in the AEAD context reach only 6 rounds. To fill these gaps, we revisit the security of 7-round Ascon in the nonce-respecting setting without violating the data limit as specified in the design. First, we introduce a new superpoly-recovery technique named as partial polynomial multiplication for which computations take place between the so-called degree-d homogeneous parts of the involved Boolean functions for a 2d-dimensional cube. We apply this method to 7-round Ascon and present several key recovery attacks. Our best attack can recover the 128-bit secret key with a time complexity of about 2123 7-round Ascon permutations and requires 264 data and 2101 bits memory. Also, based on division properties, we identify several 60 dimensional cubes whose superpolies are constant zero after 7 rounds. We further improve the cube distinguishers for 4, 5 and 6 rounds. Although our results are far from threatening the security of full 12-round Ascon, they provide new insights in the security analysis of Ascon.


Author(s):  
Christof Beierle ◽  
Jérémy Jean ◽  
Stefan Kölbl ◽  
Gregor Leander ◽  
Amir Moradi ◽  
...  

We present the family of authenticated encryption schemes SKINNY-AEAD and the family of hashing schemes SKINNY-Hash. All of the schemes employ a member of the SKINNY family of tweakable block ciphers, which was presented at CRYPTO 2016, as the underlying primitive. In particular, for authenticated encryption, we show how to instantiate members of SKINNY in the Deoxys-I-like ΘCB3 framework to fulfill the submission requirements of the NIST lightweight cryptography standardization process. For hashing, we use SKINNY to build a function with larger internal state and employ it in a sponge construction. To highlight the extensive amount of third-party analysis that SKINNY obtained since its publication, we briefly survey the existing cryptanalysis results for SKINNY-128-256 and SKINNY-128-384 as of February 2020. In the last part of the paper, we provide a variety of ASIC implementations of our schemes and propose new simple SKINNY-AEAD and SKINNY-Hash variants with a reduced number of rounds while maintaining a very comfortable security margin. https://csrc.nist.gov/Projects/Lightweight-Cryptography


Network ◽  
2021 ◽  
Vol 1 (2) ◽  
pp. 75-94
Author(s):  
Ed Kamya Kiyemba Edris ◽  
Mahdi Aiash ◽  
Jonathan Loo

Fifth Generation mobile networks (5G) promise to make network services provided by various Service Providers (SP) such as Mobile Network Operators (MNOs) and third-party SPs accessible from anywhere by the end-users through their User Equipment (UE). These services will be pushed closer to the edge for quick, seamless, and secure access. After being granted access to a service, the end-user will be able to cache and share data with other users. However, security measures should be in place for SP not only to secure the provisioning and access of those services but also, should be able to restrict what the end-users can do with the accessed data in or out of coverage. This can be facilitated by federated service authorization and access control mechanisms that restrict the caching and sharing of data accessed by the UE in different security domains. In this paper, we propose a Data Caching and Sharing Security (DCSS) protocol that leverages federated authorization to provide secure caching and sharing of data from multiple SPs in multiple security domains. We formally verify the proposed DCSS protocol using ProVerif and applied pi-calculus. Furthermore, a comprehensive security analysis of the security properties of the proposed DCSS protocol is conducted.


1995 ◽  
Vol 74 (6) ◽  
pp. 2665-2684 ◽  
Author(s):  
Y. Kondoh ◽  
Y. Hasegawa ◽  
J. Okuma ◽  
F. Takahashi

1. A computational model accounting for motion detection in the fly was examined by comparing responses in motion-sensitive horizontal system (HS) and centrifugal horizontal (CH) cells in the fly's lobula plate with a computer simulation implemented on a motion detector of the correlation type, the Reichardt detector. First-order (linear) and second-order (quadratic nonlinear) Wiener kernels from intracellularly recorded responses to moving patterns were computed by cross correlating with the time-dependent position of the stimulus, and were used to characterize response to motion in those cells. 2. When the fly was stimulated with moving vertical stripes with a spatial wavelength of 5-40 degrees, the HS and CH cells showed basically a biphasic first-order kernel, having an initial depolarization that was followed by hyperpolarization. The linear model matched well with the actual response, with a mean square error of 27% at best, indicating that the linear component comprises a major part of responses in these cells. The second-order nonlinearity was insignificant. When stimulated at a spatial wavelength of 2.5 degrees, the first-order kernel showed a significant decrease in amplitude, and was initially hyperpolarized; the second-order kernel was, on the other hand, well defined, having two hyperpolarizing valleys on the diagonal with two off-diagonal peaks. 3. The blockage of inhibitory interactions in the visual system by application of 10-4 M picrotoxin, however, evoked a nonlinear response that could be decomposed into the sum of the first-order (linear) and second-order (quadratic nonlinear) terms with a mean square error of 30-50%. The first-order term, comprising 10-20% of the picrotoxin-evoked response, is characterized by a differentiating first-order kernel. It thus codes the velocity of motion. The second-order term, comprising 30-40% of the response, is defined by a second-order kernel with two depolarizing peaks on the diagonal and two off-diagonal hyperpolarizing valleys, suggesting that the nonlinear component represents the power of motion. 4. Responses in the Reichardt detector, consisting of two mirror-image subunits with spatiotemporal low-pass filters followed by a multiplication stage, were computer simulated and then analyzed by the Wiener kernel method. The simulated responses were linearly related to the pattern velocity (with a mean square error of 13% for the linear model) and matched well with the observed responses in the HS and CH cells. After the multiplication stage, the linear component comprised 15-25% and the quadratic nonlinear component comprised 60-70% of the simulated response, which was similar to the picrotoxin-induced response in the HS cells. The quadratic nonlinear components were balanced between the right and left sides, and could be eliminated completely by their contralateral counterpart via a subtraction process. On the other hand, the linear component on one side was the mirror image of that on the other side, as expected from the kernel configurations. 5. These results suggest that responses to motion in the HS and CH cells depend on the multiplication process in which both the velocity and power components of motion are computed, and that a putative subtraction process selectively eliminates the nonlinear components but amplifies the linear component. The nonlinear component is directionally insensitive because of its quadratic non-linearity. Therefore the subtraction process allows the subsequent cells integrating motion (such as the HS cells) to tune the direction of motion more sharply.


2021 ◽  
Vol 2021 ◽  
pp. 1-12
Author(s):  
Zhongxiang Zheng ◽  
Anyu Wang ◽  
Lingyue Qin

Rejection sampling technology is a core tool in the design of lattice-based signatures with ‘Fiat–Shamir with Aborts’ structure, and it is related to signing efficiency and signature, size as well as security. In the rejection sampling theorem proposed by Lyubashevsky, the masking vector of rejection sampling is chosen from discrete Gaussian distribution. However, in practical designs, the masking vector is more likely to be chosen from bounded uniform distribution due to better efficiency and simpler implementation. Besides, as one of the third-round candidate signatures in the NIST postquantum cryptography standardization process, the 3rd round version of CRYSTALS-Dilithium has proposed a new method to decrease the rejection probability in order to achieve better efficiency and smaller signature size by decreasing the number of nonzero coefficients of the challenge polynomial according to the security levels. However, it is seen that small entropies in this new method may lead to higher risk of forgery attack compared with former schemes proposed in its 2nd version. Thus, in this paper, we first analyze the complexity of forgery attack for small entropies and then introduce a new method to decrease the rejection probability without loss of security including the security against forgery attack. This method is achieved by introducing a new rejection sampling theorem with tighter bound by utilizing Rényi divergence where masking vector follows uniform distribution. By observing large gaps between the security claim and actual security bound in CRYSTALS-Dilithium, we propose two series of adapted parameters for CRYSTALS-Dilithium. The first set can improve the efficiency of the signing process in CRYSTALS-Dilithium by factors of 61.7 %  and  41.7 % , according to the security levels, and ensure the security against known attacks, including forgery attack. And, the second set can reduce the signature size by a factor of 14.09 % with small improvements in efficiency at the same security level.


2021 ◽  
Vol 2021 ◽  
pp. 1-13
Author(s):  
Tzung-Her Chen ◽  
Ting-Le Zhu ◽  
Fuh-Gwo Jeng ◽  
Chien-Lung Wang

Although encryption and signatures have been two fundamental technologies for cryptosystems, they still receive considerable attention in academia due to the focus on reducing computational costs and communication overhead. In the past decade, applying certificateless signcryption schemes to solve the higher cost of maintaining the certificate chain issued by a certificate authority (CA) has been studied. With the recent increase in the interest in blockchains, signcryption is being revisited as a new possibility. The concepts of a blockchain as a CA and a transaction as a certificate proposed in this paper aim to use a blockchain without CAs or a trusted third party (TTP). The proposed provably secure signcryption scheme implements a designated recipient beforehand such that a sender can cryptographically facilitate the interoperation on the blockchain information with the designated recipient. Thus, the proposed scheme benefits from the following advantages: (1) it removes the high maintenance cost from involving CAs or a TTP, (2) it seamlessly integrates with blockchains, and (3) it provides confidential transactions. This paper also presents the theoretical security analysis and assesses the performance via the simulation results. Upon evaluating the operational cost in real currency based on Ethereum, the experimental results demonstrate that the proposed scheme only requires a small cost as a fee.


Author(s):  
Kundankumar Rameshwar Saraf ◽  
Malathi P. Jesudason

This chapter explores the encryption techniques used for the internet of things (IoT). The security algorithm used for IoT should follow many constraints of an embedded system. Hence, lightweight cryptography is an optimum security solution for IoT devices. This chapter mainly describes the need for security in IoT, the concept of lightweight cryptography, and various cryptographic algorithms along with their shortcomings given IoT. This chapter also describes the principle of operation of all the above algorithms along with their security analysis. Moreover, based on the algorithm size (i.e., the required number of gate equivalent, block size, key size, throughput, and execution speed of the algorithm), the chapter reports the comparative analysis of their performance. The chapter discusses the merits and demerits of these algorithms along with their use in the IoT system.


2017 ◽  
Vol 26 (07) ◽  
pp. 1750119 ◽  
Author(s):  
Chunguang Ma ◽  
Lei Zhang ◽  
Songtao Yang ◽  
Xiaodong Zheng

The prosperity of location-based services (LBSs) makes more and more people pay close attention to personal privacy. In order to preserve users privacy, several schemes utilized a trusted third party (TTP) to obfuscate users, but these schemes were suspected as the TTP may become the single point of failure or service performance bottleneck. To alleviate the suspicion, schemes with collaborative users to achieve [Formula: see text]-anonymity were proposed. In these schemes, users equipped with short-range communication devices could communicate with adjacent users to establish an anonymous group. With this group, the user can obfuscate and hide herself behind at least [Formula: see text] other users. However, these schemes are usually more efficient in snapshot services than continuous ones. To cope with the inadequacy, with the help of caching in mobile devices, we propose a query information blocks random exchange and results caching scheme (short for CaQBE). In this scheme, a particular user is hidden behind collaborative users in snapshot service, and then the caches further preserve the privacy in continuous service. In case of the active adversary launching the query correlation attack and the passive adversary launching the impersonation attack, a random collaborative user selection and a random block exchange algorithm are also utilized. Then based on the feature of entropy, a metric to measure the privacy of the user against attacks from the active and passive adversaries is proposed. Finally, security analysis and experimental comparison with other similar schemes further verify the optimal of our scheme in effectiveness of preservation and efficiency of performance.


1965 ◽  
Vol 38 (4) ◽  
pp. 757-768 ◽  
Author(s):  
S. D. Gehman ◽  
F. S. Maxey ◽  
S. R. Ogilby

Abstract Using a continuous cure curve to select a minimum number of stepped cures, it should be possible to vulcanize and test fewer sheets to determine best cure. This procedure is attractive for its potential of expediting the output of physical testing laboratories and especially for reducing the work load of stress-strain testing. Cure curves recorded with the Vulcameter approximated first-order reactions. Equations were derived to calculate the final force and rate constant from recorded force values without carrying the reaction to completion. A chart is suggested to assist in calculating the rate constant. Time for a given fractional rise in force depends only on the rate constant so that a chart for obtaining it is relatively simple. Experience and correlation with service performance in selecting best cures is emphasized. 95% rise times from Vulcameter curves were compared with conventionally selected best cures for a wide variety of compounds. Indications are that experience with the method might reduce the number of test-sheet cures to determine optimum stress-strain properties to one, two, or three depending upon the compound and the exactness required.


2018 ◽  
Vol 2018 ◽  
pp. 1-11 ◽  
Author(s):  
Lu Ou ◽  
Hui Yin ◽  
Zheng Qin ◽  
Sheng Xiao ◽  
Guangyi Yang ◽  
...  

Location-based services (LBSs) are increasingly popular in today’s society. People reveal their location information to LBS providers to obtain personalized services such as map directions, restaurant recommendations, and taxi reservations. Usually, LBS providers offer user privacy protection statement to assure users that their private location information would not be given away. However, many LBSs run on third-party cloud infrastructures. It is challenging to guarantee user location privacy against curious cloud operators while still permitting users to query their own location information data. In this paper, we propose an efficient privacy-preserving cloud-based LBS query scheme for the multiuser setting. We encrypt LBS data and LBS queries with a hybrid encryption mechanism, which can efficiently implement privacy-preserving search over encrypted LBS data and is very suitable for the multiuser setting with secure and effective user enrollment and user revocation. This paper contains security analysis and performance experiments to demonstrate the privacy-preserving properties and efficiency of our proposed scheme.


Sign in / Sign up

Export Citation Format

Share Document