Self configuring VLSI technology architectures offer a new environment for creating novel security functions. Two such functions for physical security architectures are proposed to be generated autonomously as unknown/secret internal functions. A cell-based FPGA technology architecture is deployed for generating two classes of self-constructed one-way physical secret functions, one representing a hash function and the other a ciphering function. The Hash function is a non-invertible mapping, where the cipher function should be invertible. The two sample architectures of the functions are inspired from the programmable cell structure of the selected FPGA technology. As the functions are internally created, their mapping structures can be kept completely secret and even unknown to anybody. Such units could be efficiently deployed for a novel physical security even when nothing is known about their exact architecture and mapping functions. Several new attractive application scenarios are demonstrated including a type of zero-knowledge proof of identity and clone-resistant physical units as well as secured dependency functions. It is also shown that such security mechanisms can be kept operational for some useful applications even if the secret-unknown functions are allowed to evolve and develop additional time-dependent and individual properties. Such security functions became recently possible after self-configuring VLSI architectures are available as a part of real microelectronic systems. Keywords-Identification; secret unknown hardware functions; clone-resitant units; secret-unknown physicalcipher, secret unknown hash-functions. 1.
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
We use an idea of linear representations of the symmetric group to reduce the number of communication rounds in the verification protocol, proposed in Crypto 2005 by Peng et al., of a shuffling. We assume Paillier encryption scheme with which we can apply some known zero-knowledge proofs following the same line of approaches of Peng et al. Incidence matrices of 1-subsets and 2-subsets of a finite set is intensively used for the implementation, and the idea of <TEX>$\lambda$</TEX>-designs is employed for the improvement of the computational complexity.
We put forth a new computational notion of entropy, which measures the (in)feasibility of sampling high entropy strings that are consistent with a given protocol. Specifically, we say that the i'th round of a protocol (A,B) has *accessible entropy* at most k, if no polynomial-time strategy A* can generate messages for A such that the entropy of its message in the i'th round has entropy greater than k when conditioned both on prior messages of the protocol and on prior coin tosses of A*. We say that the protocol has *inaccessible entropy* if the total accessible entropy (summed over the rounds) is noticeably smaller than the real entropy of A's messages, conditioned only on prior messages (but not the coin tosses of A). As applications of this notion, we -- Give a much simpler and more efficient construction of statistically hiding commitment schemes from arbitrary one-way functions. -- Prove that constant-round statistically hiding commitments are necessary for constructing constant-round zero-knowledge proof systems for NP that remain secure under parallel composition (assuming the existence of one-way functions).
Abstract : University of North Texas (UNT) is collaborating with the Air Force Research Laboratory (AFRL) in the design and development of ZKP protocol and in investigating its suitability for airborne networks. During this project, we accomplished the following tasks: (1) Implemented a prototype version of graph isomorphism based ZKP protocol. (2) Analyzed the implementation complexity of the ZKP protocol. (3) Investigated the selection of graphs that are suitable for ZKP implementation. Our experiments related to task (3) indicate that the graphs selected for ZKP implementation must possess specific characteristics. While we developed the basic guidelines for this selection, our results are inconclusive and require additional experiments.
Nowadays it is widely accepted to formulate the security of a protocol carrying out a given task via the "trusted-party paradigm," where the protocol execution is compared with an ideal process where the outputs are computed by a trusted party that sees all the inputs. A protocol is said to securely carry out a given task if running the protocol with a realistic adversary amounts to "emulating" the ideal process with the appropriate trusted party. In the Universal Composability (UC) framework the program run by the trusted party is called an ideal functionality. While this simulation-based security formulation provides strong security guarantees, its usefulness is contingent on the properties and correct specification of the ideal functionality, which, as demonstrated in recent years by the coexistence of complex, multiple functionalities for the same task as well as by their "unstable" nature, does not seem to be an easy task. In this paper we address this problem, by introducing a general methodology for the sound specification of ideal functionalities. First, we introduce the class of canonical ideal functionalities for a cryptographic task, which unifies the syntactic specification of a large class of cryptographic tasks under the same basic template functionality. Furthermore, this representation enables the isolation of the individual properties of a cryptographic task as separate members of the corresponding class. By endowing the class of canonical functionalities with an algebraic structure we are able to combine basic functionalities to a single final canonical functionality for a given task. Effectively, this puts forth a bottom-up approach for the specification of ideal functionalities: first one defines a set of basic constituent functionalities for the task at hand, and then combines them into a single ideal functionality taking advantage of the algebraic structure. In our framework, the constituent functionalities of a task can be derived either directly or, following a translation strategy we introduce, from existing game-based definitions; such definitions have in many cases captured desired individual properties of cryptographic tasks, albeit in less adversarial settings than universal composition. Our translation methodology entails a sequence of steps that derive a corresponding canonical functionality given a game-based definition. In this way, we obtain a well-defined mapping of game-based security properties to their corresponding UC counterparts. Finally, we demonstrate the power of our approach by applying our methodology to a variety of basic cryptographic tasks, including commitments, digital signatures, zero-knowledge proofs, and oblivious transfer. While in some cases our derived canonical functionalities are equivalent to existing formulations, thus attesting to the validity of our approach, in others they differ, enabling us to "debug" previous definitions and pinpoint their shortcomings.
This paper present an alternative scheme to key escrow scheme which allows probabilistic law enforcement access to reveal the encrypted communications. Namely, key escrow authority can reveal the information between communication parties partially. Our scheme allows law enforcement access with probability p for each message. The scheme in this paper is basically the complemented scheme of Mihir Bellare and Ronald L. Rivest [2], and combine a publicly verifiable encryption technique and translucent cryptography based on non-interactive fractional oblivious transfer. This protocol allows such access with probability for each message, for a parameter between 0 and 1, which should be chosen to provide an appropriate balance between concerns for individual privacy and the need for such law enforcement access by government. This paper induct a set of distributed key escrow authorities(DEA). The scheme is based on the El-Gamal encryption, a proof scheme of knowledge of common exponent in publicly verifiable El-Gamal public-key encryption, and a set of distributed escrow authorities. In session key recovery phase by DEA, use only partial parameters from each key escrow authorities required for session key recovery that have been passed through zero-knowledge(ZK) interactive proof protocol. The scheme allows both the law enforcement access with probability and DEA to recover the session key used to encrypt communication by User A.
In order to prevent the fault wire-key probing attacks from the malicious mobile code generators for enhancing the confidentiality of executors’inputs in Zhong-Yang protocol,a verifiable multiplying subsidiary circuit is proposed and used to extend the garbled circuit in Zhong-Yang protocol.The extended protocol replaces executors’input-wires with the multiplying subsidiary circuits for resisting fault wire-key probing attacks,and ensures the correctness of the construction of the subsidiary circuit by the committed garbled circuit technology of Jarecki and Shmatikov and the third-party challenged zero-knowledge proof protocols.The analyses show that,when more than two-thirds of the third-party servers are honest,the extended protocol can prevent the tampering wire-key attacks of the malicious third-party servers and the fault wire-key probing attacks of the malicious generators simultaneously,meet the non-interactive request of mobile code environment,and add polynomial communication and computation complexity.The extended protocol ensures the complete confidentiality of executors’inputs in malicious mobile code environment.
We put forward the concepts of universal authentication, restrictive authentication and designated authentication. We then revisit a popular signcryption scheme using a technique similar to the one developed in Schnorr's signature, allowing it respects the restrictive authentication property. Comparing with the modification suggested by Baek et al in 2007, which uses a zero-knowledge proof run between the recipient and the third party, our scheme saves about 1/2 cost. Besides, the security of the revisited scheme can be reduced to that of Schnorr's signature.
Reuse of intellectual property (IP) of VLSI physical design facilitates integration of more components on a single chip in shrinking time-to-market. For intellectual property protection (IPP), various kinds of IP marks are embedded into the design for establishing the veracity of a legal owner. However, public verification of IP marks is not leakage-proof. Current techniques include a sufficiently large set of public marks containing a header and a message body in addition to private ones to facilitate only public verification at the cost of significant increase in design overhead. But these techniques are not effective, as attackers manage to obtain potential clues to tamper public marks rendering public verification invalid and may also suitably override the marks to include own signature resulting in wrong public identification of IP owner. Here we propose a zero-knowledge protocol to ensure robust and absolutely leakage proof convincing public verification with the help of private marks. We have tested our protocol for FPGA benchmarks. The results on overhead and robustness are encouraging.
Physical Unclonable Functions (PUFs) and Hardware Security
In this paper, we proposed a new signature scheme based on elliptic curve cryptography. We combined the two problems, factoring and logarithm problem into both signing and verifying equations. We also give a kind of algorithm of the zero-knowledge proof of proposed digital signature. The new scheme was shown to be secure against the known attacks for signature schemes. This algorithm has characteristics which has little computation, high reliability, and easy to be realized.
Abstract. In the setting of secure computation, a set of parties wish to securely compute some function of their inputs, in the presence of an adversary. The adversary in question may be static (meaning that it con-trols a predetermined subset of the parties) or adaptive (meaning that it can choose to corrupt parties during the protocol execution and based on what it sees). In this paper, we study two fundamental questions relating to the basic zero-knowledge and oblivious transfer protocol problems: – Adaptive zero-knowledge proofs: We ask whether it is possible to con-struct adaptive zero-knowledge proofs (with unconditional sound-ness). Beaver (STOC 1996) showed that known zero-knowledge proofs are not adaptively secure, and in addition showed how to construct zero-knowledge arguments (with computational soundness). – Adaptively secure oblivious transfer: All known protocols for adap-tively secure oblivious transfer rely on seemingly stronger hardness assumptions than for the case of static adversaries. We ask whether this is inherent, and in particular, whether it is possible to construct adaptively secure oblivious transfer from enhanced trapdoor permu-tations alone. We provide surprising answers to the above questions, showing that achieving adaptive security is sometimes harder than achieving static se-curity, and sometimes not. First, we show that assuming the existence of one-way functions only, there exist adaptive zero-knowledge proofs for all languages in NP. In order to prove this, we overcome the problem that all adaptive zero-knowledge protocols known until now used equivocal commitments (which would enable an all-powerful prover to cheat). Sec-ond, we prove a black-box separation between adaptively secure oblivious transfer and enhanced trapdoor permutations. As a corollary, we derive a black-box separation between adaptively and statically securely obliv-ious transfer. This is the first black-box separation to relate to adaptive security and thus the first evidence that it is indeed harder to achieve security in the presence of adaptive adversaries than in the presence of static adversaries. 1
Abstract. We present a variant of Regev’s cryptosystem first presented in [Reg05], but with a new choice of parameters. By a recent classical re-duction by Peikert we prove the scheme semantically secure based on the worst-case lattice problem GapSVP. From this we construct a threshold cryptosystem which has a very efficient and non-interactive decryption protocol. We prove the threshold cryptosystem secure against passive adversaries corrupting all but one of the players, and againts active ad-versaries corrupting less than one third of the players. We also describe how one can build a distributed key generation protocol. In the final part of the paper we show how one can, in zero-knowledge- prove knowledge of the plaintext contained in a given ciphertext from Regev’s original cryptosystem or our variant. The proof is of size only a constant times the size of the public key. 1