Skip to main content

David Galindo

Universidad de los Andes (Colombia), Ingeniería Eléctrica y Electrónica, Graduate Student

Followers

16

Following

5

Public Views

Address: Colombia

less

Harvard University

American University in Cairo

Kansas State University

Armando Marques-Guedes

UNL - New University of Lisbon

Dublin Institute of Technology

Oxford Brookes University

Roshan Chitrakar

Nepal College of Information Technology

Graduate Center of the City University of New York

University of Technology Sydney

Tribeni Prasad Banerjee

West Bengal University Of Technology

InterestsView All (6)

Uploads

Papers by David Galindo

Efficient and Segure Elliptic Curve Cryptosystem from Point Doubling

An instantiation of the Cramer-Shoup encryption paradigm using bilinear map groups

A new instantiation of the Cramer-Shoup paradigm for secure encryption is presented, which is bui... more A new instantiation of the Cramer-Shoup paradigm for secure encryption is presented, which is built using bilinear map groups. The security is based on the Bilinear Decisional Diffie-Hellman assumption. The recent efficiency improvements introduced in [KD04,GS04] are also applied to our constructions. One of the schemes thereby obtained presents efficiency similar to the most efficient encryption schemes with chosen-ciphertext security in the standard model proposed in the literature. Our new scheme presents advantages compared to a trivial Cramer-Shoup instantiation using bilinear map groups, which we also describe here for the first time. Only three practical instantiations of the Cramer-Shoup framework were previously known.

Pseudonymized Data Sharing

In this chapter pseudonymisation and pseudonym intersection algorithms are proposed and analyzed.... more In this chapter pseudonymisation and pseudonym intersection algorithms are proposed and analyzed. These two procedures combined make pseudonymized data sharing possible. Pseudonymized data sharing is used by organizations, that typically do not share information, to build and provide pseudonymized copies of their private databases to third parties-called researchers. Some basic security properties are satisfied: pseudonymity, meaning that it is infeasible to relate a pseudonym to its identity; and unlinkability, meaning that it is infeasible to decide if pseudonyms belonging to different researchers correspond to the same identity. Computing the equijoin of pseudonymized databases held by researchers A and B is enabled provided that they are given proper cryptographic keys. The outcome of the equijoin protocol between A and B is that party A learns virtually nothing, while party B learns the equijoin of A and B's pseudonymized databases. We are able to prevent that malicious researchers abuse equijoin transitivity in the following sense: colluding researchers A, B,C cannot use equijoin keys for (A, B) and (B,C) to compute the equijoin of (A,C). As a prominent application of these algorithms we discuss the privacy-enhanced secondary usage of electronic health records.

An Accountable Decryption System Based on Privacy-Preserving Smart Contracts

Lecture Notes in Computer Science, 2020

Accountability is a fundamental after-the-fact approach to detect and punish illegal actions duri... more Accountability is a fundamental after-the-fact approach to detect and punish illegal actions during the execution of a warrant for accessing users' sensitive data. To achieve accountability in a security protocol, a trusted authority is required, denoted as judge, to faithfully cooperate with the rest of the entities in the system. However, malicious judges or uncooperative protocol participants may void the accountability mechanism in practice, for example by fabricating fake evidence or by refusing to provide any evidence at all. To provide remediation to these issues, in this paper we propose Fialka, a novel accountable decryption system based on privacy-preserving smart contracts (PPSC). The neutrality that is inherent to a secure blockchain platform is inherited by PPSC which are then used in our approach as an accountable key manager as well as a transparent judge. To the best of our knowledge, we present the first PPSC-based accountable decryption system to increase the transparency of warrant execution with formal definitions and proofs. Furthermore, we provide and evaluate a prototype implementation using the PPSC-enabled platform Oasis Devnet, which additionally demonstrates the feasibility of Fialka.

Fully Distributed Verifiable Random Functions and their Application to Decentralised Random Beacons

2021 IEEE European Symposium on Security and Privacy (EuroS&P), 2021

Implementation of a leakage-resilient ElGamal key encapsulation mechanism

Journal of Cryptographic Engineering, 2016

Leakage-resilient cryptography aims to extend the rigorous guarantees achieved through the provab... more Leakage-resilient cryptography aims to extend the rigorous guarantees achieved through the provable security paradigm to physical implementations. The constructions designed on basis of this new approach inevitably suffer from an Achilles heel: a bounded leakage assumption is needed. Currently, a huge gap exists between the theory of such designs and their implementation to confirm the leakage resilience in practice. The present work tries to narrow this gap for the leakage-resilient bilinear ElGamal key encapsulation mechanism (BEG-KEM) proposed by Kiltz and Pietrzak in 2010. Our first contribution is a variant of the bounded leakage and the only-computation-leaks model that is closer to practice. We weaken the restriction on the image size of the leakage functions in these models and only

A Leakage-Resilient Pairing-Based Variant of the Schnorr Signature Scheme

Lecture Notes in Computer Science, 2013

Leakage-resilient cryptography aims at capturing side-channel attacks within the provable securit... more Leakage-resilient cryptography aims at capturing side-channel attacks within the provable security framework. Currently there exists a plethora of schemes with provably secure guarantees against a variety of side-channel attacks. However, meeting the strongest security levels (resilience against continual leakage attacks) under the weakest assumptions leads currently to costly schemes. Additionally, recent results show the impossibility to achieve the strongest leakage-resilient security levels for cryptosystems whose secret key is uniquely determined by its public key. The above justies the use of stronger assumptions to achieve simpler, more ecient schemes, since most deployed and practical cryptosystems satisfy the above-mentioned uniqueness of the secret key property. In particular, the Schnorr-based leakage-resilient digital signature schemes proposed up to now are built by gluing together-copies of the basic signature scheme, resulting in a public key that admits exponentiallymany secret keys. Furthermore, the space needed to store the secret key material is proportional to the leakage tolerated by these schemes. We aim at designing a leakage-resilient variant of the Schnorr signature scheme whose secret key's storage space is constant, independently of the amount of leakage that it can tolerate. We assume that at any given time only the parts of the memory in use leak (split-state/only computation leaks information model); we ease the problem of exhibiting a security reduction by relying on generic groups (generic bilinear group model). We proceed by rst proposing a pairing analogue of the Schnorr signature scheme, that we next transform to include split signing key updates. We give a leakage-resilience lower bound in generic bilinear groups against continual leakage attacks for the new scheme.

A Generic Construction for Token-Controlled Public Key Encryption

Lecture Notes in Computer Science, 2006

Token-controlled public key encryption (TCPKE) schemes, introduced in [1], offer many possibiliti... more Token-controlled public key encryption (TCPKE) schemes, introduced in [1], offer many possibilities of application in financial or legal scenarios. Roughly speaking, in a TCPKE scheme messages are encrypted by using a public key together with a secret token, in such a way that the receiver is not able to decrypt this ciphertext until the token is published or released. The communication overhead for releasing the token is small in comparison with the ciphertext size. However, the fact that the same ciphertext could decrypt to different messages under different tokens was not addressed in the original work. In our opinion this is an essential security property that limits the use of this primitive in practice. In this work, we formalize this natural security goal and show that the schemes in [1] are insecure under this notion. In the second place, we propose a very simple and efficient generic construction of TCPKE schemes, starting from any trapdoor partial oneway function. This construction is obtained from a slight but powerful modification of the celebrated Fujisaki-Okamoto transformation [7]. We prove that the resulting schemes satisfy all the required security properties, in the random oracle model. Previous to this work, only particular instantiations of TCPKE schemes were proposed.

Securing Data Accountability in Decentralized Systems

Lecture Notes in Computer Science, 2006

We consider a decentralized setting in which agents exchange data along with usage policies. Agen... more We consider a decentralized setting in which agents exchange data along with usage policies. Agents may violate the policies, although later on auditing authorities may verify the agents' accountability with respect to the used data. Using (provably secure) time-stamping and signature schemes, we design and analyze an efficient cryptographic protocol that generates the sufficient communication evidences which auditing authorities need to carry out their auditing. Finally, we describe an extension providing policy confidentiality against eavesdroppers timestamping servers.

Non-interactive distributed encryption: A new primitive for revocable privacy

Proceedings of the ACM Conference on Computer and Communications Security, 2011

In this paper we introduce and instantiate a new cryptographic primitive, called non-interactive ... more In this paper we introduce and instantiate a new cryptographic primitive, called non-interactive distributed encryption, that allows a receiver to decrypt a ciphertext only if a minimum number of different senders encrypt the same plaintext. The new functionality can be seen as the dual of the functionality provided by threshold cryptosystems. It is shown that this primitive can be used to solve real-world problems balancing security and privacy needs. In particular it is used to solve the canvas cutters problem (introduced below), that might be of independent interest.

Extended security arguments for signature schemes

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2012

The well-known forking lemma by Pointcheval and Stern has been used to prove the security of the ... more The well-known forking lemma by Pointcheval and Stern has been used to prove the security of the so-called generic signature schemes. These signature schemes are obtained via the Fiat-Shamir transform from three-pass identification schemes. A number of five-pass identification protocols have been proposed in the last few years. Extending the forking lemma and the Fiat-Shamir transform would allow to obtain new signature schemes since, unfortunately, these newly proposed schemes fall outside the original framework. In this paper, we provide an extension of the forking lemma in order to assess the security of what we call n-generic signature schemes. These include signature schemes that are derived from certain (2n + 1)-pass identification schemes. We thus obtain a generic methodology for proving the security of a number of signature schemes derived from recently published five-pass identification protocols, and potentially for (2n + 1)-pass identification schemes to come.

A killer application for pairings: Authenticated key establishment in underwater wireless sensor networks

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2008

Wireless sensors are low power devices which are highly constrained in terms of computational cap... more Wireless sensors are low power devices which are highly constrained in terms of computational capabilities, memory, and communication bandwidth. While battery life is their main limitation, they require considerable energy to communicate data. The latter is specially dramatic in underwater wireless sensor networks (UWSN), where the acoustic transmission mechanisms are less reliable and more energydemanding. Saving in communication is thus the primary concern in underwater wireless sensors. With this constraint in mind, we argue that non-interactive identity-based key agreement built on pairings provides the best solution for key distribution in large UWSN when compared to the state of the art. At first glance this claim is surprising, since pairing computation is very demanding. Still, pairing-based non-interactive key establishment requires minimal communication and at the same time enjoys excellent properties when used for key distribution.

A Provably Secure Elliptic Curve Scheme with Fast Encryption

Progress in Cryptology - INDOCRYPT 2004, 2004

We present a new elliptic curve cryptosystem with fast encryption and key generation, which is pr... more We present a new elliptic curve cryptosystem with fast encryption and key generation, which is provably secure in the standard model. The scheme uses arithmetic modulo n 2 , where n is an RSA modulus, and merges ideas from Paillier and Rabin related schemes. Despite the typical bit length of n, our encryption algorithm is faster than El Gamal elliptic curve cryptosystems. The one-wayness of the new cryptosystem is as hard as factoring n while the semantic security is proved under a reasonable decisional assumption. Two new length-preserving trapdoor permutations equivalent to factoring are also described.

Identity-Based Encryption with Master Key-Dependent Message Security and Leakage-Resilience

Computer Security – ESORICS 2012, 2012

We introduce the concept of identity-based encryption (IBE) with master key-dependent chosenplain... more We introduce the concept of identity-based encryption (IBE) with master key-dependent chosenplaintext (mKDM-sID-CPA) security. These are IBE schemes that remain secure even after the adversary sees encryptions, under some initially selected identities, of functions of the master secret key(s). We then propose a generic construction of chosen-ciphertext secure key-dependent encryption (KDM-CCA) schemes in the public key setting starting from mKDM-sID-CPA secure IBE schemes. This is reminiscent to the celebrated work by Canetti, Halevi and Katz (Eurocrypt 2004) on the traditional key-oblivious setting. Previously only one generic construction of KDM-CCA secure public key schemes was known, due to Camenisch, Chandran and Shoup (Eurocrypt 2009), and it required non-interactive zero knowledge proofs (NIZKs). Our transformation shows that NIZKs are not intrinsic to KDM-CCA public key encryption. Additionally, we are able to instantiate our new concept under the Rank assumption on pairing groups and for affine functions of the secret keys. The scheme builds on previous work by Boneh, Halevi, Hamburg and Ostrovsky (Crypto 2008). Our concrete schemes are only able to provide security against a bounded number of encryption queries, which is enough in some practical scenarios. As a corollary we obtain a KDM-CCA secure public key encryption scheme, in the standard model, whose security reduction to a static assumption is independent of the number of challenge queries. As an independent contribution, we give new and better reductions between the Rank problem (previously named as Matrix DDH problem) and the Decisional Linear and the Decisional 3-Party Diffie-Hellman problems. 1 Introduction Until recently public key encryption (PKE) schemes were only required to provide confidentiality against adversaries that see encryptions of plaintexts that depend solely on public information. That is, it was assumed (and even advocated) that an encryption scheme would never be used to encrypt its own decryption key. This requirement is certainly reasonable for many applications, but it has been challenged both by practical and foundational reasons [1, 14]. The paradigmatic case is the scenario of circular encryptions, where for n ≥ 2 public/secret key pairs (pk 1 , sk 1),. .. , (pk n , sk n), the adversary is given the ciphertexts Enc pk 1 (sk 2), Enc pk 2 (sk 3),. .. , Enc pkn (sk 1), and still semantic security shall hold. Thus a dedicated stronger security notion called key-dependent message security has emerged in the last few years [5]. Roughly speaking, it is required that semantic security holds even if the adversary sees encryptions of plaintexts that depend on the decryption keys. For the motivation, applications and history of key-dependent message security we refer to the excellent survey by Teranishi, Malkin and Yung [23]. The first breakthrough was due to Boneh, Halevi, Hamburg and Ostrovsky (BHHO) [9], who proposed a public key encryption scheme with indistinguishability against key-dependent chosen-plaintext attacks (KDM-CPA) in the standard model under the Decisional Diffie-Hellman assumption for affine functions of the secret key. Shortly after Applebaum, Cash, Peikert, and Sahai [3] proposed an efficient KDM-CPA secure scheme for affine functions under the Learning Parity with Noise assumption. Brakerski and Goldwasser [11] extended the BHHO scheme to a suite of KDM-CPA schemes secure under subgroup indistinguishability assumptions. Camenisch, Chandran and Shoup [13] proposed a generic construction of chosen-ciphertext secure keydependent encryption (KDM-CCA) schemes in the public key setting, that requires in particular a KDM-CPA secure scheme and specialized non-interactive zero knowledge proofs (NIZKs). By applying their transformation to (a variation of) the BHHO scheme, they obtained a KDM-CCA secure scheme under the Decision Linear assumption on pairing groups. This was the only generic construction of KDM-CCA secure public key encryption schemes in the standard model before our work. Concurrently to our work, Hofheinz [20]

Constructing Strong KEM from Weak KEM (or How to Revive the KEM/DEM Framework)

Lecture Notes in Computer Science, 2008

Page 1. Constructing Strong KEM from Weak KEM (or How to Revive the KEM/DEM Framework) Joonsang B... more

Public-Key Encryption with Non-Interactive Opening: New Constructions and Stronger Definitions

Lecture Notes in Computer Science, 2010

Public-key encryption schemes with non-interactive opening (PKENO) allow a receiver to non-intera... more Public-key encryption schemes with non-interactive opening (PKENO) allow a receiver to non-interactively convince third parties that a ciphertext decrypts to a given plaintext or, alternatively, that such a ciphertext is invalid. Two practical generic constructions for PKENO have been proposed so far, starting from either identity-based encryption or public-key encryption with witness-recovering decryption (PKEWR). We show that the known transformation from PKEWR to PKENO fails to provide chosen-ciphertext security; only the transformation from identity-based encryption remains thus valid. Next, we prove that PKENO can be built out of robust non-interactive threshold publickey cryptosystems, a primitive seemingly weaker than identity-based encryption. Using the new transformation, we construct two efficient PKENO schemes: one based on the Decisional Diffie-Hellman assumption (in the Random Oracle Model) and one based on the Decisional Linear assumption (in the standard model). Last but not least, we propose new applications of PKENO in protocol design. Motivated by these applications, we reconsider proof soundness for PKENO and put forward new definitions that are stronger than those considered so far. We give a taxonomy of all definitions and demonstrate them to be satisfiable.

Easy Verifiable Primitives and Practical Public Key Cryptosystems

Lecture Notes in Computer Science, 2003

At Crypto'99, Fujisaki and Okamoto [8] presented a nice generic transformation from weak asymmetr... more At Crypto'99, Fujisaki and Okamoto [8] presented a nice generic transformation from weak asymmetric and symmetric schemes into an IND-CCA hybrid encryption scheme in the Random Oracle Model. Two specific candidates for standardization were designed from this transformation: PSEC-2 [14] and EPOC-2 [7], based on El Gamal and Okamoto-Uchiyama primitives, respectively. Since then, several cryptanalysis of EPOC have been published, one in the Chosen Ciphertext Attack game, and others making use of a poor implementation that is vulnerable to reject timing attacks. The aim of this work is to prevent such attacks from generic transformation by identifying the properties that an asymmetric scheme must have in order to obtain a secure hybrid scheme. To achieve this, some ambiguities in the proof of the generic transformation [8] which could lead to false claims are described. As a result, the original conversion is modified and the class of asymmetric primitives that can be used is shortened. Secondly, the concept of Easy Verifiable Primitive is formalized, showing its connection with Gap problems. Using these ideas, a new security proof for the modified transformation is given. The good news is that the reduction is tight, improving the concrete security claimed in the original work for the Easy Verifiable Primitives. For the rest of primitives, the concrete security is improved at the cost of stronger assumptions. Finally, the new conversion's resistance to reject timing attacks is addressed.

On the energy cost of authenticated key agreement in wireless sensor networks

Wireless Communications and Mobile Computing, 2010

Wireless sensors are battery-powered devices which are highly constrained in terms of computation... more Wireless sensors are battery-powered devices which are highly constrained in terms of computational capabilities, memory, and communication bandwidth. While battery life is their main limitation, they require considerable energy to communicate data. Due to this, it turns out that the energy saving of computationally inexpensive primitives (like symmetric key cryptography) can be nullified by the bigger amount of data they require to be sent. In this work we study the energy cost of key agreement protocols between peers in a network using asymmetric key cryptography. Our main concern is to reduce the amount of data to be exchanged, which can be done by using special cryptographic paradigms like identitybased and self-certified cryptography. The main news is that an intensive computational primitive for resource-constrained devices, such as non-interactive identity-based authenticated key exchange (AKE), performs comparably or even better than traditional AKE in a variety of scenarios. Moreover, protocols based in this primitive can provide better security properties in real deployments than other simple protocols based on symmetric cryptography. Our findings illustrate to what extent the latest implementation advancements push the efficiency boundaries of public key cryptography in wireless sensor networks.

Direct chosen-ciphertext secure identity-based key encapsulation without random oracles

Theoretical Computer Science, 2009

We describe a new and practical identity-based key encapsulation mechanism that is secure in the ... more We describe a new and practical identity-based key encapsulation mechanism that is secure in the standard model against chosen-ciphertext (CCA2) attacks. Since our construction is direct and not based on hierarchical identity-based encryption, it is more efficient than all previously proposed schemes. Furthermore, we give the first chosen-ciphertext secure identity-based key encapsulation mechanism with threshold key delegation and decryption in the standard model. 1 Introduction Identity-Based Encryption and Key Encapsulation. An Identity-Based Encryption (IBE) scheme is a public-key encryption scheme where any string is a valid public key. In particular, email addresses and dates can be public keys. The ability to use identities as public keys avoids the need to distribute public key certificates. Instead of providing the full functionality of an IBE scheme, in many applications it is sufficient to let sender and receiver agree on a common random session key. This can be accomplished with an identity-based key encapsulation mechanism (IB-KEM) as formalized in [7]. Any IB-KEM can be updated to a full IBE scheme by adding a symmetric encryption scheme with appropriate security properties. After Shamir proposed the concept of IBE in 1984 [39] it remained an open problem for almost two decades to come up with a satisfying construction for it. In 2001, Boneh and Franklin [11] proposed formal security notions for IBE systems and designed a fully functional secure IBE scheme using bilinear maps. This scheme and the tools developed in its design have been successfully applied in numerous cryptographic settings, transcending by far the identity based cryptography framework. IBE is currently in the process of getting standardized-from February 2006 on the new IEEE P1363.3 standard for "Identity-Based Cryptographic Techniques using Pairings" [29] accepts submissions. An alternative but less efficient IBE construction was proposed by Cocks [19] based on quadratic residues. Both IBE schemes (through the Fujisaki-Okamoto [24] transformation) provide security against chosen-ciphertext attacks. In a chosen ciphertext attack, the adversary is given access to a decryption oracle that allows him to obtain the decryptions of ciphertexts of his choosing. Intuitively, security in this setting means that an adversary obtains (effectively) no information about encrypted messages, provided the corresponding ciphertexts are never submitted to the decryption oracle. For different reasons, the notion of chosen-ciphertext security has emerged as the "right" notion of security for encryption schemes. We stress that, in general, chosen-ciphertext security is a much stronger security requirement than chosen-plaintext attacks [4], where in the latter an attacker is not given access to the decryption oracle. The drawback of the IBE scheme from Boneh-Franklin and Cocks is that security can only be guaranteed in the random oracle model [5], i.e. in an idealized world where all parties magically get black-box access to a truly random function. Unfortunately a proof in the random oracle model can only serve as a heuristic argument and has proved to possibly lead to insecure schemes when the random oracles are implemented in the standard model (see, e.g., [15]). Waters' IBE. To fill this gap Waters [45] presents the first efficient Identity-Based Encryption scheme that is chosen-plaintext secure without random oracles. The proof of his scheme makes use of an algebraic method first used by Boneh and Boyen [8] and security of the scheme is based on the Bilinear Decisional Diffie-Hellman (BDDH) assumption. However, Waters' plain IBE scheme only guarantees chosen-plaintext security. From 2-level Hierarchical IBE to chosen-chipertext secure IBE. Hierarchical identitybased encryption (HIBE) [28, 26] is a generalization of IBE allowing for hierarchical delegation of decryption keys. Recent results from Canetti, Halevi, and Katz [16], further improved upon by Boneh and Katz [13] show a generic and practical transformation from any chosen-plaintext secure 2-level HIBE scheme to a chosen-ciphertext secure IBE scheme. Since Waters' IBE scheme can naturally be extended to a 2-level HIBE this implies the first chosen-ciphertext secure IBE in the standard model. Key size, as well as the security reduction of the resulting scheme are comparable to the ones from Waters' IBE. However, the transformation involves some symmetric overhead to the ciphertext in form of a one-time signature or a MAC with their respective keys.

A note on an IND-CCA2 secure Paillier-based cryptosystem

Information Processing Letters, 2013

ABSTRACT Recently an IND-CCA2 secure Paillier-based cryptosystem has been proposed (Das and Adhik... more ABSTRACT Recently an IND-CCA2 secure Paillier-based cryptosystem has been proposed (Das and Adhikari, 2012 [1]). In this note we show that Das and Adhikari do not present any original result: their scheme is a rewriting of the well-known Fujisaki–Okamoto IND-CPA to IND-CCA2 transformation applied to the Paillier scheme.

Efficient and Segure Elliptic Curve Cryptosystem from Point Doubling

An instantiation of the Cramer-Shoup encryption paradigm using bilinear map groups

A new instantiation of the Cramer-Shoup paradigm for secure encryption is presented, which is bui... more A new instantiation of the Cramer-Shoup paradigm for secure encryption is presented, which is built using bilinear map groups. The security is based on the Bilinear Decisional Diffie-Hellman assumption. The recent efficiency improvements introduced in [KD04,GS04] are also applied to our constructions. One of the schemes thereby obtained presents efficiency similar to the most efficient encryption schemes with chosen-ciphertext security in the standard model proposed in the literature. Our new scheme presents advantages compared to a trivial Cramer-Shoup instantiation using bilinear map groups, which we also describe here for the first time. Only three practical instantiations of the Cramer-Shoup framework were previously known.

Pseudonymized Data Sharing

In this chapter pseudonymisation and pseudonym intersection algorithms are proposed and analyzed.... more In this chapter pseudonymisation and pseudonym intersection algorithms are proposed and analyzed. These two procedures combined make pseudonymized data sharing possible. Pseudonymized data sharing is used by organizations, that typically do not share information, to build and provide pseudonymized copies of their private databases to third parties-called researchers. Some basic security properties are satisfied: pseudonymity, meaning that it is infeasible to relate a pseudonym to its identity; and unlinkability, meaning that it is infeasible to decide if pseudonyms belonging to different researchers correspond to the same identity. Computing the equijoin of pseudonymized databases held by researchers A and B is enabled provided that they are given proper cryptographic keys. The outcome of the equijoin protocol between A and B is that party A learns virtually nothing, while party B learns the equijoin of A and B's pseudonymized databases. We are able to prevent that malicious researchers abuse equijoin transitivity in the following sense: colluding researchers A, B,C cannot use equijoin keys for (A, B) and (B,C) to compute the equijoin of (A,C). As a prominent application of these algorithms we discuss the privacy-enhanced secondary usage of electronic health records.

An Accountable Decryption System Based on Privacy-Preserving Smart Contracts

Lecture Notes in Computer Science, 2020

Accountability is a fundamental after-the-fact approach to detect and punish illegal actions duri... more Accountability is a fundamental after-the-fact approach to detect and punish illegal actions during the execution of a warrant for accessing users' sensitive data. To achieve accountability in a security protocol, a trusted authority is required, denoted as judge, to faithfully cooperate with the rest of the entities in the system. However, malicious judges or uncooperative protocol participants may void the accountability mechanism in practice, for example by fabricating fake evidence or by refusing to provide any evidence at all. To provide remediation to these issues, in this paper we propose Fialka, a novel accountable decryption system based on privacy-preserving smart contracts (PPSC). The neutrality that is inherent to a secure blockchain platform is inherited by PPSC which are then used in our approach as an accountable key manager as well as a transparent judge. To the best of our knowledge, we present the first PPSC-based accountable decryption system to increase the transparency of warrant execution with formal definitions and proofs. Furthermore, we provide and evaluate a prototype implementation using the PPSC-enabled platform Oasis Devnet, which additionally demonstrates the feasibility of Fialka.

Fully Distributed Verifiable Random Functions and their Application to Decentralised Random Beacons

2021 IEEE European Symposium on Security and Privacy (EuroS&P), 2021

Implementation of a leakage-resilient ElGamal key encapsulation mechanism

Journal of Cryptographic Engineering, 2016

Leakage-resilient cryptography aims to extend the rigorous guarantees achieved through the provab... more Leakage-resilient cryptography aims to extend the rigorous guarantees achieved through the provable security paradigm to physical implementations. The constructions designed on basis of this new approach inevitably suffer from an Achilles heel: a bounded leakage assumption is needed. Currently, a huge gap exists between the theory of such designs and their implementation to confirm the leakage resilience in practice. The present work tries to narrow this gap for the leakage-resilient bilinear ElGamal key encapsulation mechanism (BEG-KEM) proposed by Kiltz and Pietrzak in 2010. Our first contribution is a variant of the bounded leakage and the only-computation-leaks model that is closer to practice. We weaken the restriction on the image size of the leakage functions in these models and only

A Leakage-Resilient Pairing-Based Variant of the Schnorr Signature Scheme

Lecture Notes in Computer Science, 2013

Leakage-resilient cryptography aims at capturing side-channel attacks within the provable securit... more Leakage-resilient cryptography aims at capturing side-channel attacks within the provable security framework. Currently there exists a plethora of schemes with provably secure guarantees against a variety of side-channel attacks. However, meeting the strongest security levels (resilience against continual leakage attacks) under the weakest assumptions leads currently to costly schemes. Additionally, recent results show the impossibility to achieve the strongest leakage-resilient security levels for cryptosystems whose secret key is uniquely determined by its public key. The above justies the use of stronger assumptions to achieve simpler, more ecient schemes, since most deployed and practical cryptosystems satisfy the above-mentioned uniqueness of the secret key property. In particular, the Schnorr-based leakage-resilient digital signature schemes proposed up to now are built by gluing together-copies of the basic signature scheme, resulting in a public key that admits exponentiallymany secret keys. Furthermore, the space needed to store the secret key material is proportional to the leakage tolerated by these schemes. We aim at designing a leakage-resilient variant of the Schnorr signature scheme whose secret key's storage space is constant, independently of the amount of leakage that it can tolerate. We assume that at any given time only the parts of the memory in use leak (split-state/only computation leaks information model); we ease the problem of exhibiting a security reduction by relying on generic groups (generic bilinear group model). We proceed by rst proposing a pairing analogue of the Schnorr signature scheme, that we next transform to include split signing key updates. We give a leakage-resilience lower bound in generic bilinear groups against continual leakage attacks for the new scheme.

A Generic Construction for Token-Controlled Public Key Encryption

Lecture Notes in Computer Science, 2006

Token-controlled public key encryption (TCPKE) schemes, introduced in [1], offer many possibiliti... more Token-controlled public key encryption (TCPKE) schemes, introduced in [1], offer many possibilities of application in financial or legal scenarios. Roughly speaking, in a TCPKE scheme messages are encrypted by using a public key together with a secret token, in such a way that the receiver is not able to decrypt this ciphertext until the token is published or released. The communication overhead for releasing the token is small in comparison with the ciphertext size. However, the fact that the same ciphertext could decrypt to different messages under different tokens was not addressed in the original work. In our opinion this is an essential security property that limits the use of this primitive in practice. In this work, we formalize this natural security goal and show that the schemes in [1] are insecure under this notion. In the second place, we propose a very simple and efficient generic construction of TCPKE schemes, starting from any trapdoor partial oneway function. This construction is obtained from a slight but powerful modification of the celebrated Fujisaki-Okamoto transformation [7]. We prove that the resulting schemes satisfy all the required security properties, in the random oracle model. Previous to this work, only particular instantiations of TCPKE schemes were proposed.

Securing Data Accountability in Decentralized Systems

Lecture Notes in Computer Science, 2006

We consider a decentralized setting in which agents exchange data along with usage policies. Agen... more We consider a decentralized setting in which agents exchange data along with usage policies. Agents may violate the policies, although later on auditing authorities may verify the agents' accountability with respect to the used data. Using (provably secure) time-stamping and signature schemes, we design and analyze an efficient cryptographic protocol that generates the sufficient communication evidences which auditing authorities need to carry out their auditing. Finally, we describe an extension providing policy confidentiality against eavesdroppers timestamping servers.

Non-interactive distributed encryption: A new primitive for revocable privacy

Proceedings of the ACM Conference on Computer and Communications Security, 2011

In this paper we introduce and instantiate a new cryptographic primitive, called non-interactive ... more In this paper we introduce and instantiate a new cryptographic primitive, called non-interactive distributed encryption, that allows a receiver to decrypt a ciphertext only if a minimum number of different senders encrypt the same plaintext. The new functionality can be seen as the dual of the functionality provided by threshold cryptosystems. It is shown that this primitive can be used to solve real-world problems balancing security and privacy needs. In particular it is used to solve the canvas cutters problem (introduced below), that might be of independent interest.

Extended security arguments for signature schemes

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2012

The well-known forking lemma by Pointcheval and Stern has been used to prove the security of the ... more The well-known forking lemma by Pointcheval and Stern has been used to prove the security of the so-called generic signature schemes. These signature schemes are obtained via the Fiat-Shamir transform from three-pass identification schemes. A number of five-pass identification protocols have been proposed in the last few years. Extending the forking lemma and the Fiat-Shamir transform would allow to obtain new signature schemes since, unfortunately, these newly proposed schemes fall outside the original framework. In this paper, we provide an extension of the forking lemma in order to assess the security of what we call n-generic signature schemes. These include signature schemes that are derived from certain (2n + 1)-pass identification schemes. We thus obtain a generic methodology for proving the security of a number of signature schemes derived from recently published five-pass identification protocols, and potentially for (2n + 1)-pass identification schemes to come.

A killer application for pairings: Authenticated key establishment in underwater wireless sensor networks

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2008

Wireless sensors are low power devices which are highly constrained in terms of computational cap... more Wireless sensors are low power devices which are highly constrained in terms of computational capabilities, memory, and communication bandwidth. While battery life is their main limitation, they require considerable energy to communicate data. The latter is specially dramatic in underwater wireless sensor networks (UWSN), where the acoustic transmission mechanisms are less reliable and more energydemanding. Saving in communication is thus the primary concern in underwater wireless sensors. With this constraint in mind, we argue that non-interactive identity-based key agreement built on pairings provides the best solution for key distribution in large UWSN when compared to the state of the art. At first glance this claim is surprising, since pairing computation is very demanding. Still, pairing-based non-interactive key establishment requires minimal communication and at the same time enjoys excellent properties when used for key distribution.

A Provably Secure Elliptic Curve Scheme with Fast Encryption

Progress in Cryptology - INDOCRYPT 2004, 2004

We present a new elliptic curve cryptosystem with fast encryption and key generation, which is pr... more We present a new elliptic curve cryptosystem with fast encryption and key generation, which is provably secure in the standard model. The scheme uses arithmetic modulo n 2 , where n is an RSA modulus, and merges ideas from Paillier and Rabin related schemes. Despite the typical bit length of n, our encryption algorithm is faster than El Gamal elliptic curve cryptosystems. The one-wayness of the new cryptosystem is as hard as factoring n while the semantic security is proved under a reasonable decisional assumption. Two new length-preserving trapdoor permutations equivalent to factoring are also described.

Identity-Based Encryption with Master Key-Dependent Message Security and Leakage-Resilience

Computer Security – ESORICS 2012, 2012

We introduce the concept of identity-based encryption (IBE) with master key-dependent chosenplain... more We introduce the concept of identity-based encryption (IBE) with master key-dependent chosenplaintext (mKDM-sID-CPA) security. These are IBE schemes that remain secure even after the adversary sees encryptions, under some initially selected identities, of functions of the master secret key(s). We then propose a generic construction of chosen-ciphertext secure key-dependent encryption (KDM-CCA) schemes in the public key setting starting from mKDM-sID-CPA secure IBE schemes. This is reminiscent to the celebrated work by Canetti, Halevi and Katz (Eurocrypt 2004) on the traditional key-oblivious setting. Previously only one generic construction of KDM-CCA secure public key schemes was known, due to Camenisch, Chandran and Shoup (Eurocrypt 2009), and it required non-interactive zero knowledge proofs (NIZKs). Our transformation shows that NIZKs are not intrinsic to KDM-CCA public key encryption. Additionally, we are able to instantiate our new concept under the Rank assumption on pairing groups and for affine functions of the secret keys. The scheme builds on previous work by Boneh, Halevi, Hamburg and Ostrovsky (Crypto 2008). Our concrete schemes are only able to provide security against a bounded number of encryption queries, which is enough in some practical scenarios. As a corollary we obtain a KDM-CCA secure public key encryption scheme, in the standard model, whose security reduction to a static assumption is independent of the number of challenge queries. As an independent contribution, we give new and better reductions between the Rank problem (previously named as Matrix DDH problem) and the Decisional Linear and the Decisional 3-Party Diffie-Hellman problems. 1 Introduction Until recently public key encryption (PKE) schemes were only required to provide confidentiality against adversaries that see encryptions of plaintexts that depend solely on public information. That is, it was assumed (and even advocated) that an encryption scheme would never be used to encrypt its own decryption key. This requirement is certainly reasonable for many applications, but it has been challenged both by practical and foundational reasons [1, 14]. The paradigmatic case is the scenario of circular encryptions, where for n ≥ 2 public/secret key pairs (pk 1 , sk 1),. .. , (pk n , sk n), the adversary is given the ciphertexts Enc pk 1 (sk 2), Enc pk 2 (sk 3),. .. , Enc pkn (sk 1), and still semantic security shall hold. Thus a dedicated stronger security notion called key-dependent message security has emerged in the last few years [5]. Roughly speaking, it is required that semantic security holds even if the adversary sees encryptions of plaintexts that depend on the decryption keys. For the motivation, applications and history of key-dependent message security we refer to the excellent survey by Teranishi, Malkin and Yung [23]. The first breakthrough was due to Boneh, Halevi, Hamburg and Ostrovsky (BHHO) [9], who proposed a public key encryption scheme with indistinguishability against key-dependent chosen-plaintext attacks (KDM-CPA) in the standard model under the Decisional Diffie-Hellman assumption for affine functions of the secret key. Shortly after Applebaum, Cash, Peikert, and Sahai [3] proposed an efficient KDM-CPA secure scheme for affine functions under the Learning Parity with Noise assumption. Brakerski and Goldwasser [11] extended the BHHO scheme to a suite of KDM-CPA schemes secure under subgroup indistinguishability assumptions. Camenisch, Chandran and Shoup [13] proposed a generic construction of chosen-ciphertext secure keydependent encryption (KDM-CCA) schemes in the public key setting, that requires in particular a KDM-CPA secure scheme and specialized non-interactive zero knowledge proofs (NIZKs). By applying their transformation to (a variation of) the BHHO scheme, they obtained a KDM-CCA secure scheme under the Decision Linear assumption on pairing groups. This was the only generic construction of KDM-CCA secure public key encryption schemes in the standard model before our work. Concurrently to our work, Hofheinz [20]

Constructing Strong KEM from Weak KEM (or How to Revive the KEM/DEM Framework)

Lecture Notes in Computer Science, 2008

Page 1. Constructing Strong KEM from Weak KEM (or How to Revive the KEM/DEM Framework) Joonsang B... more

Public-Key Encryption with Non-Interactive Opening: New Constructions and Stronger Definitions

Lecture Notes in Computer Science, 2010

Public-key encryption schemes with non-interactive opening (PKENO) allow a receiver to non-intera... more Public-key encryption schemes with non-interactive opening (PKENO) allow a receiver to non-interactively convince third parties that a ciphertext decrypts to a given plaintext or, alternatively, that such a ciphertext is invalid. Two practical generic constructions for PKENO have been proposed so far, starting from either identity-based encryption or public-key encryption with witness-recovering decryption (PKEWR). We show that the known transformation from PKEWR to PKENO fails to provide chosen-ciphertext security; only the transformation from identity-based encryption remains thus valid. Next, we prove that PKENO can be built out of robust non-interactive threshold publickey cryptosystems, a primitive seemingly weaker than identity-based encryption. Using the new transformation, we construct two efficient PKENO schemes: one based on the Decisional Diffie-Hellman assumption (in the Random Oracle Model) and one based on the Decisional Linear assumption (in the standard model). Last but not least, we propose new applications of PKENO in protocol design. Motivated by these applications, we reconsider proof soundness for PKENO and put forward new definitions that are stronger than those considered so far. We give a taxonomy of all definitions and demonstrate them to be satisfiable.

Easy Verifiable Primitives and Practical Public Key Cryptosystems

Lecture Notes in Computer Science, 2003

At Crypto'99, Fujisaki and Okamoto [8] presented a nice generic transformation from weak asymmetr... more At Crypto'99, Fujisaki and Okamoto [8] presented a nice generic transformation from weak asymmetric and symmetric schemes into an IND-CCA hybrid encryption scheme in the Random Oracle Model. Two specific candidates for standardization were designed from this transformation: PSEC-2 [14] and EPOC-2 [7], based on El Gamal and Okamoto-Uchiyama primitives, respectively. Since then, several cryptanalysis of EPOC have been published, one in the Chosen Ciphertext Attack game, and others making use of a poor implementation that is vulnerable to reject timing attacks. The aim of this work is to prevent such attacks from generic transformation by identifying the properties that an asymmetric scheme must have in order to obtain a secure hybrid scheme. To achieve this, some ambiguities in the proof of the generic transformation [8] which could lead to false claims are described. As a result, the original conversion is modified and the class of asymmetric primitives that can be used is shortened. Secondly, the concept of Easy Verifiable Primitive is formalized, showing its connection with Gap problems. Using these ideas, a new security proof for the modified transformation is given. The good news is that the reduction is tight, improving the concrete security claimed in the original work for the Easy Verifiable Primitives. For the rest of primitives, the concrete security is improved at the cost of stronger assumptions. Finally, the new conversion's resistance to reject timing attacks is addressed.

On the energy cost of authenticated key agreement in wireless sensor networks

Wireless Communications and Mobile Computing, 2010

Wireless sensors are battery-powered devices which are highly constrained in terms of computation... more Wireless sensors are battery-powered devices which are highly constrained in terms of computational capabilities, memory, and communication bandwidth. While battery life is their main limitation, they require considerable energy to communicate data. Due to this, it turns out that the energy saving of computationally inexpensive primitives (like symmetric key cryptography) can be nullified by the bigger amount of data they require to be sent. In this work we study the energy cost of key agreement protocols between peers in a network using asymmetric key cryptography. Our main concern is to reduce the amount of data to be exchanged, which can be done by using special cryptographic paradigms like identitybased and self-certified cryptography. The main news is that an intensive computational primitive for resource-constrained devices, such as non-interactive identity-based authenticated key exchange (AKE), performs comparably or even better than traditional AKE in a variety of scenarios. Moreover, protocols based in this primitive can provide better security properties in real deployments than other simple protocols based on symmetric cryptography. Our findings illustrate to what extent the latest implementation advancements push the efficiency boundaries of public key cryptography in wireless sensor networks.

Direct chosen-ciphertext secure identity-based key encapsulation without random oracles

Theoretical Computer Science, 2009

We describe a new and practical identity-based key encapsulation mechanism that is secure in the ... more We describe a new and practical identity-based key encapsulation mechanism that is secure in the standard model against chosen-ciphertext (CCA2) attacks. Since our construction is direct and not based on hierarchical identity-based encryption, it is more efficient than all previously proposed schemes. Furthermore, we give the first chosen-ciphertext secure identity-based key encapsulation mechanism with threshold key delegation and decryption in the standard model. 1 Introduction Identity-Based Encryption and Key Encapsulation. An Identity-Based Encryption (IBE) scheme is a public-key encryption scheme where any string is a valid public key. In particular, email addresses and dates can be public keys. The ability to use identities as public keys avoids the need to distribute public key certificates. Instead of providing the full functionality of an IBE scheme, in many applications it is sufficient to let sender and receiver agree on a common random session key. This can be accomplished with an identity-based key encapsulation mechanism (IB-KEM) as formalized in [7]. Any IB-KEM can be updated to a full IBE scheme by adding a symmetric encryption scheme with appropriate security properties. After Shamir proposed the concept of IBE in 1984 [39] it remained an open problem for almost two decades to come up with a satisfying construction for it. In 2001, Boneh and Franklin [11] proposed formal security notions for IBE systems and designed a fully functional secure IBE scheme using bilinear maps. This scheme and the tools developed in its design have been successfully applied in numerous cryptographic settings, transcending by far the identity based cryptography framework. IBE is currently in the process of getting standardized-from February 2006 on the new IEEE P1363.3 standard for "Identity-Based Cryptographic Techniques using Pairings" [29] accepts submissions. An alternative but less efficient IBE construction was proposed by Cocks [19] based on quadratic residues. Both IBE schemes (through the Fujisaki-Okamoto [24] transformation) provide security against chosen-ciphertext attacks. In a chosen ciphertext attack, the adversary is given access to a decryption oracle that allows him to obtain the decryptions of ciphertexts of his choosing. Intuitively, security in this setting means that an adversary obtains (effectively) no information about encrypted messages, provided the corresponding ciphertexts are never submitted to the decryption oracle. For different reasons, the notion of chosen-ciphertext security has emerged as the "right" notion of security for encryption schemes. We stress that, in general, chosen-ciphertext security is a much stronger security requirement than chosen-plaintext attacks [4], where in the latter an attacker is not given access to the decryption oracle. The drawback of the IBE scheme from Boneh-Franklin and Cocks is that security can only be guaranteed in the random oracle model [5], i.e. in an idealized world where all parties magically get black-box access to a truly random function. Unfortunately a proof in the random oracle model can only serve as a heuristic argument and has proved to possibly lead to insecure schemes when the random oracles are implemented in the standard model (see, e.g., [15]). Waters' IBE. To fill this gap Waters [45] presents the first efficient Identity-Based Encryption scheme that is chosen-plaintext secure without random oracles. The proof of his scheme makes use of an algebraic method first used by Boneh and Boyen [8] and security of the scheme is based on the Bilinear Decisional Diffie-Hellman (BDDH) assumption. However, Waters' plain IBE scheme only guarantees chosen-plaintext security. From 2-level Hierarchical IBE to chosen-chipertext secure IBE. Hierarchical identitybased encryption (HIBE) [28, 26] is a generalization of IBE allowing for hierarchical delegation of decryption keys. Recent results from Canetti, Halevi, and Katz [16], further improved upon by Boneh and Katz [13] show a generic and practical transformation from any chosen-plaintext secure 2-level HIBE scheme to a chosen-ciphertext secure IBE scheme. Since Waters' IBE scheme can naturally be extended to a 2-level HIBE this implies the first chosen-ciphertext secure IBE in the standard model. Key size, as well as the security reduction of the resulting scheme are comparable to the ones from Waters' IBE. However, the transformation involves some symmetric overhead to the ciphertext in form of a one-time signature or a MAC with their respective keys.

A note on an IND-CCA2 secure Paillier-based cryptosystem

Information Processing Letters, 2013

ABSTRACT Recently an IND-CCA2 secure Paillier-based cryptosystem has been proposed (Das and Adhik... more ABSTRACT Recently an IND-CCA2 secure Paillier-based cryptosystem has been proposed (Das and Adhikari, 2012 [1]). In this note we show that Das and Adhikari do not present any original result: their scheme is a rewriting of the well-known Fujisaki–Okamoto IND-CPA to IND-CCA2 transformation applied to the Paillier scheme.