The purpose of this diploma thesis is the study both of the mathematical background on lattice th... more The purpose of this diploma thesis is the study both of the mathematical background on lattice theory and of the corresponding applications to the RSA Cryptosystem. In bibliography, there are two quite different mathematical structures that are usually called lattices. The first one has to do with partially ordered sets while the other has to do with regular arrangements of points in space. In this thesis we exclusively consider the second case. Historically, lattices were investigated since the late 18th century by mathematicians such as Lagrange and Gauss. In the 19th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. The evolution of computer science in the 20th century led to lattice applications in various theoretical areas such as factorization of integer polynomials, integer programming and Public-Key Cryptography. In the latter area, lattice theory has played a crucial role in the definition of new cryptosys...
Abstract. Side-channel attacks represent a very frequent and severe type of attack against implem... more Abstract. Side-channel attacks represent a very frequent and severe type of attack against implementations of cryptographic protocols. Most countermeasures proposed until recently are ad-hoc, offer only partial remedy and fail to capture the problem in its entirety. In light of this, the last few years the cryptographic community has tried to set the theoretical foundations in order to formally address the problem of side-channel attacks. These efforts led to the development of Leakage Resilient Cryptography the goal of which is to design cryptographic protocols that remain secure in the presence of arbitrary, yet bounded, information about the secret key. In this survey, we review recent advances towards this direction. We first present an abstract and general framework that captures a wide range of side-channel attacks. We then present some of the most influential models from the literature as special cases of the general framework and describe how standard (leakage-free) security...
Outline What is a Lattice? Informally: A infinite regular arrangement of points in space. Outline... more Outline What is a Lattice? Informally: A infinite regular arrangement of points in space. Outline Where are the lattices used? O In late 18 th and 19 th century mathematicians such as Lagrange, Gauss and Hermite used lattices in the field of algebraic number theory. O In the 19 th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. O More recently, lattices have become a topic of active research in Computer Science. Outline Where are the lattices used? O In late 18 th and 19 th century mathematicians such as Lagrange, Gauss and Hermite used lattices in the field of algebraic number theory. O In the 19 th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. O More recently, lattices have become a topic of active research in Computer Science. Lattices have found applications both in Cryptography, where hard lattice problems are used to design secure cryp...
Secret-key authentication is the task of one party proving to another party that they share the s... more Secret-key authentication is the task of one party proving to another party that they share the same key. The problem has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. This paper revisits and improves upon the large body of work on secret-key authentication in two different ways. On the definitional side, we show that the notion of active security, the strongest attained by existing lightweight protocols, is too weak and can be satisfied by protocols completely insecure with respect to seemingly much weaker notions. We provide new, more apt definitions of active security, and investigate relations among them, within a new general framework for fine-grained modeling of the security of secret-key authentication protocols of independent interest. Moreover, we prove that previous protocols following the so-called challenge-response paradigm remain secure with respect to our new ...
We study the pseudorandomness of bounded knapsack functions over arbitrary finite abelian groups.... more We study the pseudorandomness of bounded knapsack functions over arbitrary finite abelian groups. Previous works consider only specific families of finite abelian groups and 0-1 coefficients. The main technical contribution of our work is a new, general theorem that provides sufficient conditions under which pseudorandomness of bounded knapsack functions follows directly from their one-wayness. Our results generalize and substantially extend previous work of Impagliazzo and Naor (J. Cryptology 1996). As an application of the new theorem, we give sample preserving search-to-decision reductions for the Learning With Errors (LWE) problem, introduced by (Regev, STOC 2005) and widely used in lattice-based cryptography. Concretely, we show that, for a wide range of parameters, m LWE samples can be proved indistinguishable from random just under the hypothesis that search LWE is a one-way function for the same number m of samples.
High throughput and fairness consist two desirable properties when scheduling traffic in an Input... more High throughput and fairness consist two desirable properties when scheduling traffic in an Input-Queued crossbar switch. Unfortunately, these two goals are conflicting which makes the job of most scheduling algorithms that want to achieve both hard. Here, we investigate the trade offs between throughput and fairness for iSLIP, one of the most well-studied algorithms introduced in [4]. We study iSLIP's behavior under several traffic patterns both for persistent and for Bernoulli arrivals and compare its throughput to the throughput achieved by a maximum matching algorithm which is less efficient and completely ignores fairness. We conclude that iSLIP's superiority in fairness comes with only a minor degradation of throughput. Hence iSLIP seems to achieve a great balance between performance, throughput and fairness.
, introduced by Peikert and Waters (STOC 2008) have been useful for building many cryptographic p... more , introduced by Peikert and Waters (STOC 2008) have been useful for building many cryptographic primitives. In particular, by using an LTDF that loses a (1 -1/ω(log n)) fraction of all its input bits, it is possible to achieve CCA security using the LTDF as a black-box. Unfortunately, not all candidate LTDFs achieve such a high level of lossiness. In this paper we drastically lower the lossiness required to achieve CCA security, showing that an LTDF that loses only a noticeable fraction of a single bit can be used in a black-box way to build CCA-secure PKE. To show our result, we build on the recent result of Rosen and Segev (TCC 2009) that showed how to achieve CCA security from functions whose products are oneway on particular types of correlated inputs. Lastly, we give an example construction of a slightly lossy TDF based on the assumption that it is hard to distinguish the product of two primes from the product of three primes. 1 By CCA-secure we mean CCA2-secure. See for a good overview of all the ways currently used to achieve CCA security.
Despite having evolved as two distinct research areas, cryptography and coding theory have mature... more Despite having evolved as two distinct research areas, cryptography and coding theory have matured in parallel, deeply influencing each other leading to a long and successful intertwined history. This thesis explores further the connection between the two fields by demonstrating how borrowing appropriate tools from coding theory can have significant implications to cryptography. Concretely, we present three results, all motivated by cryptographic applications. First, we prove that CCA-security, the standard security goal for publickey encryption, is implied by Lossy Trapdoor Functions (LTDFs) with minimal lossiness. LTDFs, introduced by Peikert and Waters (STOC 2008), have been extremely successful in cryptography. In a surprising application of LTDFs, Peikert and Waters show how to build CCA-secure encryption generically from LTDFs that xi lose a (1−1/ω(log n)) fraction of their input bits. We drastically lower the lossiness required, showing that any LTDF that loses only a noticeable fraction of a single bit suffices. The key idea behind our result is the use of Reed-Solomon codes to appropriately instantiate a recent CCA-secure construction by Rosen and Segev (TCC 2009). Second, we present powerful and general sample preserving search to decision reductions for the Learning With Errors (LWE) problem, introduced by Regev (STOC 2005), and used to substantially expand the scope of lattice based cryptography. Such reductions are of paramount importance in cryptography, bridging the gap between constructions, which require hard decisional problems, and hardness assumptions, which rely on search problems. Our proof draws upon recently developed techniques that generalize the list-decoding algorithm of Goldreich and Levin (STOC 89) to Hadamard codes over larger alphabets. In our last result, we use Learning Parity with Noise (LPN), a problem closely related to that of decoding random linear codes, to construct a simple and efficient 3-round symmetric authentication protocol that is secure against active attacks. Symmetric authentication has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. Compared to existing LPN-based protocols, ours achieves a better security-efficiency tradeoff leading to smaller communication complexity and key sizes for the same level of security. xii
We consider the NTRU encryption scheme as lately suggested for use, and study the con- nection be... more We consider the NTRU encryption scheme as lately suggested for use, and study the con- nection between inverting the NTRU primitive (i.e., the one-way function over the message and the blinding information which underlies the NTRU scheme) and recovering the NTRU secret key (univer- sal breaking). We model the inverting algorithms as black-box oracles and do not take any advantage
Instant messengers (IMs) have become a very popular and convenient tool for communication. Having... more Instant messengers (IMs) have become a very popular and convenient tool for communication. Having started with simple presence protocols, IMs now support exchange of text, sound, video, even game playing. Tons of information are being daily exchanged through IMs. Still, it seems that IMs favor functionality over security. Most popular IMs (MSN, Yahoo! messenger, ICQ etc...) send data as plaintext which, as such, can be recovered using a simple sniffing tool. In this study, we investigate security issues in the authentication and message transmission of popular IM protocols. Our investigation is twofold. The first part is evaluating the protocols and the second evaluating the specific implementations of them by popular clients. We also describe sniffing, Man in the Middle and fake server attacks and evaluate the resistance of the protocols against them. We discuss ways to exploit the current vulnerabilities, and give reasons for their birth. Finally we discuss how the current vulnerabilities can be fixed and how future ones can be avoided.
Aggregation of entities is a widely observed phenomenon in economics, sociology, biology and othe... more Aggregation of entities is a widely observed phenomenon in economics, sociology, biology and other fields. It is natural to ask how diverse and competitive entities can achieve high levels of aggregation. In order to answer this question we provide a game-theoretical model for aggregation. We consider natural classes of strategies for the individuals and show how this affects aggregation by studying the price of anarchy of the resulting game. Our analysis highlights the advantages of populations with diverse strategies (heterogeneous populations) over populations where all individuals share the same strategy (homogeneous populations). In particular, we prove that a simple heterogeneous population composed of leaders (individuals that tend to invest) and followers (individuals that look for short-term rewards) achieves asymptotically lower price of anarchy compared to any homogeneous population, no matter how elaborate its strategy is. This sets forth the question of how diversity affects the problem solving abilities of populations in general. We hope that our work will lead to further research in games with diverse populations and in a better understanding of aggregation games.
The purpose of this diploma thesis is the study both of the mathematical background on lattice th... more The purpose of this diploma thesis is the study both of the mathematical background on lattice theory and of the corresponding applications to the RSA Cryptosystem. In bibliography, there are two quite different mathematical structures that are usually called lattices. The first one has to do with partially ordered sets while the other has to do with regular arrangements of points in space. In this thesis we exclusively consider the second case. Historically, lattices were investigated since the late 18th century by mathematicians such as Lagrange and Gauss. In the 19th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. The evolution of computer science in the 20th century led to lattice applications in various theoretical areas such as factorization of integer polynomials, integer programming and Public-Key Cryptography. In the latter area, lattice theory has played a crucial role in the definition of new cryptosystems, in the study of cryptographic primitives and in cryptanalysis. The main goal of a cryptosystem is to guarantee the exchange of information between the legitimate sender and the legitimate receivers, ensuring at the same time, that any unauthorized party is unable to recover part of the information. In the thesis in hand, we focus exclusively on RSA Cryptosystem, which is probably the most widespread Public-Key Cryptosystem. Since its publication, in 1977, RSA has been used in plenty of applications ranging from digital signatures to electronic credit-card payment systems. After almost 30 years of existence, RSA has been extensively analyzed for vulnerabilities by many researchers. In the first chapter we give some basic background on lattices while, in the second, we introduce the notion of lattice basis reduction with emphasis to LLL reduction and the corresponding algorithm. The third chapter describes the use of lattices in finding small roots to polynomial equations. In the fourth chapter, we present RSA and a positive lattice related application to it. Finally, in the fifth chapter, we present an overview of the most representative lattice-based attacks mounted against RSA since its publication.
High throughput and fairness consist two desirable properties when scheduling traffic in an Input... more High throughput and fairness consist two desirable properties when scheduling traffic in an Input-Queued crossbar switch. Unfortunately, these two goals are conflicting which makes the job of most scheduling algorithms that want to achieve both hard. Here, we investigate the trade offs between throughput and fairness for iSLIP, one of the most well-studied algorithms introduced in [4]. We study iSLIP's behavior under several traffic patterns both for persistent and for Bernoulli arrivals and compare its throughput to the throughput achieved by a maximum matching algorithm which is less efficient and completely ignores fairness. We conclude that iSLIP's superiority in fairness comes with only a minor degradation of throughput. Hence iSLIP seems to achieve a great balance between performance, throughput and fairness.
Secret-key authentication is the task of one party proving to another party that they share the s... more Secret-key authentication is the task of one party proving to another party that they share the same key. The problem has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. This paper revisits and improves upon the large body of work on secret-key authentication in two different ways. On the definitional side, we show that the notion of active security, the strongest attained by existing lightweight protocols, is too weak and can be satisfied by protocols completely insecure with respect to seemingly much weaker notions. We provide new, more apt definitions of active security, and investigate relations among them, within a new general framework for fine-grained modeling of the security of secret-key authentication protocols of independent interest. Moreover, we prove that previous protocols following the so-called challenge-response paradigm remain secure with respect to our new definitions as long as they are actively secure with respect to the old one. In the second part of our paper, however, we also provide concrete evidence of the benefits of going beyond this paradigm: We present new generic constructions of authentication protocols which deviate from the challenge-response blueprint. On the one hand, we devise an actively-secure threeround protocol based on a very weak MAC which only needs to be secure against a forger on a random message when evaluated on random messages. The protocol admits efficient LPN-and CDH-based instantiations. On the other hand, we provide a two-round generic construction of a Man-in-the-Middle secure protocol based on weak MACs which enjoys an efficient instantiation based on the qSDH assumption.
Side-channel attacks represent a very frequent and severe type of attack against implementations ... more Side-channel attacks represent a very frequent and severe type of attack against implementations of cryptographic protocols. Most countermeasures proposed until recently are ad-hoc, offer only partial remedy and fail to capture the problem in its entirety. In light of this, the last few years the cryptographic community has tried to set the theoretical foundations in order to formally address the problem of side-channel attacks. These efforts led to the development of Leakage Resilient Cryptography the goal of which is to design cryptographic protocols that remain secure in the presence of arbitrary, yet bounded, information about the secret key. In this survey, we review recent advances towards this direction. We first present an abstract and general framework that captures a wide range of side-channel attacks. We then present some of the most influential models from the literature as special cases of the general framework and describe how standard (leakage-free) security notions translate in the presence of leakage. Finally, we discuss the extent to which practical attacking scenarios are captured by the existing models and suggest some interesting directions for future research.
Neural networks and tree ensembles are state-of-the-art learners, each with its unique statistica... more Neural networks and tree ensembles are state-of-the-art learners, each with its unique statistical and computational advantages. We aim to combine these advantages by introducing a new layer for neural networks, composed of an ensemble of differentiable decision trees (a.k.a. soft trees). While differentiable trees demonstrate promising results in the literature, they are typically slow in training and inference as they do not support conditional computation. We mitigate this issue by introducing a new sparse activation function for sample routing, and implement true conditional computation by developing specialized forward and backward propagation algorithms that exploit sparsity. Our efficient algorithms pave the way for jointly training over deep and wide tree ensembles using first-order methods (e.g., SGD). Experiments on 23 classification datasets indicate over 10x speed-ups compared to the differentiable trees used in the literature and over 20x reduction in the number of para...
The purpose of this diploma thesis is the study both of the mathematical background on lattice th... more The purpose of this diploma thesis is the study both of the mathematical background on lattice theory and of the corresponding applications to the RSA Cryptosystem. In bibliography, there are two quite different mathematical structures that are usually called lattices. The first one has to do with partially ordered sets while the other has to do with regular arrangements of points in space. In this thesis we exclusively consider the second case. Historically, lattices were investigated since the late 18th century by mathematicians such as Lagrange and Gauss. In the 19th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. The evolution of computer science in the 20th century led to lattice applications in various theoretical areas such as factorization of integer polynomials, integer programming and Public-Key Cryptography. In the latter area, lattice theory has played a crucial role in the definition of new cryptosys...
Abstract. Side-channel attacks represent a very frequent and severe type of attack against implem... more Abstract. Side-channel attacks represent a very frequent and severe type of attack against implementations of cryptographic protocols. Most countermeasures proposed until recently are ad-hoc, offer only partial remedy and fail to capture the problem in its entirety. In light of this, the last few years the cryptographic community has tried to set the theoretical foundations in order to formally address the problem of side-channel attacks. These efforts led to the development of Leakage Resilient Cryptography the goal of which is to design cryptographic protocols that remain secure in the presence of arbitrary, yet bounded, information about the secret key. In this survey, we review recent advances towards this direction. We first present an abstract and general framework that captures a wide range of side-channel attacks. We then present some of the most influential models from the literature as special cases of the general framework and describe how standard (leakage-free) security...
Outline What is a Lattice? Informally: A infinite regular arrangement of points in space. Outline... more Outline What is a Lattice? Informally: A infinite regular arrangement of points in space. Outline Where are the lattices used? O In late 18 th and 19 th century mathematicians such as Lagrange, Gauss and Hermite used lattices in the field of algebraic number theory. O In the 19 th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. O More recently, lattices have become a topic of active research in Computer Science. Outline Where are the lattices used? O In late 18 th and 19 th century mathematicians such as Lagrange, Gauss and Hermite used lattices in the field of algebraic number theory. O In the 19 th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. O More recently, lattices have become a topic of active research in Computer Science. Lattices have found applications both in Cryptography, where hard lattice problems are used to design secure cryp...
Secret-key authentication is the task of one party proving to another party that they share the s... more Secret-key authentication is the task of one party proving to another party that they share the same key. The problem has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. This paper revisits and improves upon the large body of work on secret-key authentication in two different ways. On the definitional side, we show that the notion of active security, the strongest attained by existing lightweight protocols, is too weak and can be satisfied by protocols completely insecure with respect to seemingly much weaker notions. We provide new, more apt definitions of active security, and investigate relations among them, within a new general framework for fine-grained modeling of the security of secret-key authentication protocols of independent interest. Moreover, we prove that previous protocols following the so-called challenge-response paradigm remain secure with respect to our new ...
We study the pseudorandomness of bounded knapsack functions over arbitrary finite abelian groups.... more We study the pseudorandomness of bounded knapsack functions over arbitrary finite abelian groups. Previous works consider only specific families of finite abelian groups and 0-1 coefficients. The main technical contribution of our work is a new, general theorem that provides sufficient conditions under which pseudorandomness of bounded knapsack functions follows directly from their one-wayness. Our results generalize and substantially extend previous work of Impagliazzo and Naor (J. Cryptology 1996). As an application of the new theorem, we give sample preserving search-to-decision reductions for the Learning With Errors (LWE) problem, introduced by (Regev, STOC 2005) and widely used in lattice-based cryptography. Concretely, we show that, for a wide range of parameters, m LWE samples can be proved indistinguishable from random just under the hypothesis that search LWE is a one-way function for the same number m of samples.
High throughput and fairness consist two desirable properties when scheduling traffic in an Input... more High throughput and fairness consist two desirable properties when scheduling traffic in an Input-Queued crossbar switch. Unfortunately, these two goals are conflicting which makes the job of most scheduling algorithms that want to achieve both hard. Here, we investigate the trade offs between throughput and fairness for iSLIP, one of the most well-studied algorithms introduced in [4]. We study iSLIP's behavior under several traffic patterns both for persistent and for Bernoulli arrivals and compare its throughput to the throughput achieved by a maximum matching algorithm which is less efficient and completely ignores fairness. We conclude that iSLIP's superiority in fairness comes with only a minor degradation of throughput. Hence iSLIP seems to achieve a great balance between performance, throughput and fairness.
, introduced by Peikert and Waters (STOC 2008) have been useful for building many cryptographic p... more , introduced by Peikert and Waters (STOC 2008) have been useful for building many cryptographic primitives. In particular, by using an LTDF that loses a (1 -1/ω(log n)) fraction of all its input bits, it is possible to achieve CCA security using the LTDF as a black-box. Unfortunately, not all candidate LTDFs achieve such a high level of lossiness. In this paper we drastically lower the lossiness required to achieve CCA security, showing that an LTDF that loses only a noticeable fraction of a single bit can be used in a black-box way to build CCA-secure PKE. To show our result, we build on the recent result of Rosen and Segev (TCC 2009) that showed how to achieve CCA security from functions whose products are oneway on particular types of correlated inputs. Lastly, we give an example construction of a slightly lossy TDF based on the assumption that it is hard to distinguish the product of two primes from the product of three primes. 1 By CCA-secure we mean CCA2-secure. See for a good overview of all the ways currently used to achieve CCA security.
Despite having evolved as two distinct research areas, cryptography and coding theory have mature... more Despite having evolved as two distinct research areas, cryptography and coding theory have matured in parallel, deeply influencing each other leading to a long and successful intertwined history. This thesis explores further the connection between the two fields by demonstrating how borrowing appropriate tools from coding theory can have significant implications to cryptography. Concretely, we present three results, all motivated by cryptographic applications. First, we prove that CCA-security, the standard security goal for publickey encryption, is implied by Lossy Trapdoor Functions (LTDFs) with minimal lossiness. LTDFs, introduced by Peikert and Waters (STOC 2008), have been extremely successful in cryptography. In a surprising application of LTDFs, Peikert and Waters show how to build CCA-secure encryption generically from LTDFs that xi lose a (1−1/ω(log n)) fraction of their input bits. We drastically lower the lossiness required, showing that any LTDF that loses only a noticeable fraction of a single bit suffices. The key idea behind our result is the use of Reed-Solomon codes to appropriately instantiate a recent CCA-secure construction by Rosen and Segev (TCC 2009). Second, we present powerful and general sample preserving search to decision reductions for the Learning With Errors (LWE) problem, introduced by Regev (STOC 2005), and used to substantially expand the scope of lattice based cryptography. Such reductions are of paramount importance in cryptography, bridging the gap between constructions, which require hard decisional problems, and hardness assumptions, which rely on search problems. Our proof draws upon recently developed techniques that generalize the list-decoding algorithm of Goldreich and Levin (STOC 89) to Hadamard codes over larger alphabets. In our last result, we use Learning Parity with Noise (LPN), a problem closely related to that of decoding random linear codes, to construct a simple and efficient 3-round symmetric authentication protocol that is secure against active attacks. Symmetric authentication has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. Compared to existing LPN-based protocols, ours achieves a better security-efficiency tradeoff leading to smaller communication complexity and key sizes for the same level of security. xii
We consider the NTRU encryption scheme as lately suggested for use, and study the con- nection be... more We consider the NTRU encryption scheme as lately suggested for use, and study the con- nection between inverting the NTRU primitive (i.e., the one-way function over the message and the blinding information which underlies the NTRU scheme) and recovering the NTRU secret key (univer- sal breaking). We model the inverting algorithms as black-box oracles and do not take any advantage
Instant messengers (IMs) have become a very popular and convenient tool for communication. Having... more Instant messengers (IMs) have become a very popular and convenient tool for communication. Having started with simple presence protocols, IMs now support exchange of text, sound, video, even game playing. Tons of information are being daily exchanged through IMs. Still, it seems that IMs favor functionality over security. Most popular IMs (MSN, Yahoo! messenger, ICQ etc...) send data as plaintext which, as such, can be recovered using a simple sniffing tool. In this study, we investigate security issues in the authentication and message transmission of popular IM protocols. Our investigation is twofold. The first part is evaluating the protocols and the second evaluating the specific implementations of them by popular clients. We also describe sniffing, Man in the Middle and fake server attacks and evaluate the resistance of the protocols against them. We discuss ways to exploit the current vulnerabilities, and give reasons for their birth. Finally we discuss how the current vulnerabilities can be fixed and how future ones can be avoided.
Aggregation of entities is a widely observed phenomenon in economics, sociology, biology and othe... more Aggregation of entities is a widely observed phenomenon in economics, sociology, biology and other fields. It is natural to ask how diverse and competitive entities can achieve high levels of aggregation. In order to answer this question we provide a game-theoretical model for aggregation. We consider natural classes of strategies for the individuals and show how this affects aggregation by studying the price of anarchy of the resulting game. Our analysis highlights the advantages of populations with diverse strategies (heterogeneous populations) over populations where all individuals share the same strategy (homogeneous populations). In particular, we prove that a simple heterogeneous population composed of leaders (individuals that tend to invest) and followers (individuals that look for short-term rewards) achieves asymptotically lower price of anarchy compared to any homogeneous population, no matter how elaborate its strategy is. This sets forth the question of how diversity affects the problem solving abilities of populations in general. We hope that our work will lead to further research in games with diverse populations and in a better understanding of aggregation games.
The purpose of this diploma thesis is the study both of the mathematical background on lattice th... more The purpose of this diploma thesis is the study both of the mathematical background on lattice theory and of the corresponding applications to the RSA Cryptosystem. In bibliography, there are two quite different mathematical structures that are usually called lattices. The first one has to do with partially ordered sets while the other has to do with regular arrangements of points in space. In this thesis we exclusively consider the second case. Historically, lattices were investigated since the late 18th century by mathematicians such as Lagrange and Gauss. In the 19th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. The evolution of computer science in the 20th century led to lattice applications in various theoretical areas such as factorization of integer polynomials, integer programming and Public-Key Cryptography. In the latter area, lattice theory has played a crucial role in the definition of new cryptosystems, in the study of cryptographic primitives and in cryptanalysis. The main goal of a cryptosystem is to guarantee the exchange of information between the legitimate sender and the legitimate receivers, ensuring at the same time, that any unauthorized party is unable to recover part of the information. In the thesis in hand, we focus exclusively on RSA Cryptosystem, which is probably the most widespread Public-Key Cryptosystem. Since its publication, in 1977, RSA has been used in plenty of applications ranging from digital signatures to electronic credit-card payment systems. After almost 30 years of existence, RSA has been extensively analyzed for vulnerabilities by many researchers. In the first chapter we give some basic background on lattices while, in the second, we introduce the notion of lattice basis reduction with emphasis to LLL reduction and the corresponding algorithm. The third chapter describes the use of lattices in finding small roots to polynomial equations. In the fourth chapter, we present RSA and a positive lattice related application to it. Finally, in the fifth chapter, we present an overview of the most representative lattice-based attacks mounted against RSA since its publication.
High throughput and fairness consist two desirable properties when scheduling traffic in an Input... more High throughput and fairness consist two desirable properties when scheduling traffic in an Input-Queued crossbar switch. Unfortunately, these two goals are conflicting which makes the job of most scheduling algorithms that want to achieve both hard. Here, we investigate the trade offs between throughput and fairness for iSLIP, one of the most well-studied algorithms introduced in [4]. We study iSLIP's behavior under several traffic patterns both for persistent and for Bernoulli arrivals and compare its throughput to the throughput achieved by a maximum matching algorithm which is less efficient and completely ignores fairness. We conclude that iSLIP's superiority in fairness comes with only a minor degradation of throughput. Hence iSLIP seems to achieve a great balance between performance, throughput and fairness.
Secret-key authentication is the task of one party proving to another party that they share the s... more Secret-key authentication is the task of one party proving to another party that they share the same key. The problem has recently attracted widespread interest due to the existence of lightweight protocols amenable to implementation on simple architectures, such as RFID tags. This paper revisits and improves upon the large body of work on secret-key authentication in two different ways. On the definitional side, we show that the notion of active security, the strongest attained by existing lightweight protocols, is too weak and can be satisfied by protocols completely insecure with respect to seemingly much weaker notions. We provide new, more apt definitions of active security, and investigate relations among them, within a new general framework for fine-grained modeling of the security of secret-key authentication protocols of independent interest. Moreover, we prove that previous protocols following the so-called challenge-response paradigm remain secure with respect to our new definitions as long as they are actively secure with respect to the old one. In the second part of our paper, however, we also provide concrete evidence of the benefits of going beyond this paradigm: We present new generic constructions of authentication protocols which deviate from the challenge-response blueprint. On the one hand, we devise an actively-secure threeround protocol based on a very weak MAC which only needs to be secure against a forger on a random message when evaluated on random messages. The protocol admits efficient LPN-and CDH-based instantiations. On the other hand, we provide a two-round generic construction of a Man-in-the-Middle secure protocol based on weak MACs which enjoys an efficient instantiation based on the qSDH assumption.
Side-channel attacks represent a very frequent and severe type of attack against implementations ... more Side-channel attacks represent a very frequent and severe type of attack against implementations of cryptographic protocols. Most countermeasures proposed until recently are ad-hoc, offer only partial remedy and fail to capture the problem in its entirety. In light of this, the last few years the cryptographic community has tried to set the theoretical foundations in order to formally address the problem of side-channel attacks. These efforts led to the development of Leakage Resilient Cryptography the goal of which is to design cryptographic protocols that remain secure in the presence of arbitrary, yet bounded, information about the secret key. In this survey, we review recent advances towards this direction. We first present an abstract and general framework that captures a wide range of side-channel attacks. We then present some of the most influential models from the literature as special cases of the general framework and describe how standard (leakage-free) security notions translate in the presence of leakage. Finally, we discuss the extent to which practical attacking scenarios are captured by the existing models and suggest some interesting directions for future research.
Neural networks and tree ensembles are state-of-the-art learners, each with its unique statistica... more Neural networks and tree ensembles are state-of-the-art learners, each with its unique statistical and computational advantages. We aim to combine these advantages by introducing a new layer for neural networks, composed of an ensemble of differentiable decision trees (a.k.a. soft trees). While differentiable trees demonstrate promising results in the literature, they are typically slow in training and inference as they do not support conditional computation. We mitigate this issue by introducing a new sparse activation function for sample routing, and implement true conditional computation by developing specialized forward and backward propagation algorithms that exploit sparsity. Our efficient algorithms pave the way for jointly training over deep and wide tree ensembles using first-order methods (e.g., SGD). Experiments on 23 classification datasets indicate over 10x speed-ups compared to the differentiable trees used in the literature and over 20x reduction in the number of para...
Uploads
Papers by Petros Mol