Please join us for the next installment of Crypto Day on Friday, April 17 at Northeastern University.

Location:
103 Churchill Hall
Northeastern University Boston, MA 02115

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Leo Reyzin, BU
Wyner’s Wire-Tap Channel, Forty Years Later
11:30 – 12:30. Christopher Fletcher, MIT
Onion ORAM: A Constant Bandwidth ORAM using Additively Homomorphic Encryption
12:30 – 2:00. Lunch (provided)
2:00 – 3:00. Daniele Micciancio, UCSD
FHEW: Bootstrapping Homomorphic Encryption in less than a second
3:30 – 4:30. Kobbi Nissim, Ben-Gurion University and CRCS@Harvard
Learning under Differential Privacy

Abstracts:

Speaker: Leo Reyzin

Wyner’s Wire-Tap Channel, Forty Years Later

Wyner’s information theory paper “The Wire-Tap Channel” turns forty this year. Its importance is underappreciated in cryptography, where its intellectual progeny includes pseudorandom generators, privacy amplification, information reconciliation, and many flavors of randomness extractors (including plain, strong, fuzzy, robust, nonmalleable, source-private, local, and reusable). Focusing mostly on privacy amplification and fuzzy extractors, I will demonstrate the connection from Wyner’s paper to today’s research, including work on program obfuscation. I will conclude with some recent results on the feasibility of fuzzy extractors, based on joint work with Benjamin Fuller and Adam Smith.

 

Speaker: Christopher Fletcher

Title: Onion ORAM: A Constant Bandwidth ORAM using Additively Homomorphic Encryption

Oblivious RAM (ORAM) is a cryptographic primitive that obfuscates a client’s access pattern (address, data, read/write) to an untrusted memory source. In addition to its traditional application to outsourced storage, ORAM has proven to be an important component in the Cryptographic “swiss army knife” — finding uses in Garbled RAM, Secure Computation, Proofs of Retrievability, and more.

In this talk I will discuss Onion ORAM, a constant bandwidth ORAM that uses poly-logarithmic server computation to circumvent the well-known logarithmic lower bound in ORAM bandwidth. In addition to being constant bandwidth, Onion ORAM achieves constant client and server storage blowups — asymptotically optimal for each category — and does so without relying on Fully Homomorphic Encryption. In particular, we only require an Additively Homomorphic Encryption scheme with constant ciphertext blowup such as the Damgard-Jurik cryptosystem. We will extend the scheme to be secure against a malicious server using standard assumptions. To the best of our knowledge, Onion ORAM is the first concrete instantiation of a constant-bandwidth ORAM with poly-logarithmic computation (even for the semi-honest setting).

Joint work with Ling Ren, Srini Devadas, Marten van Dijk, Elaine Shi and Daniel Wichs

 

Speaker: Daniele Micciancio

Title: FHEW: Bootstrapping Homomorphic Encryption in less than a second

The main bottleneck affecting the efficiency of all known fully homomorphic encryption (FHE) schemes is Gentry’s bootstrapping procedure, which is required to refresh noisy ciphertexts and keep computing on encrypted data. We present a new method to homomorphically compute simple bit operations, and refresh (bootstrap) the resulting output, which runs on a personal computer in just about half a second.

Join work with Leo Ducas, to appear in Eurocrypt 2015

 

Speaker: Kobbi Nissim

Title: Learning under Differential Privacy

Learning is a task that abstracts many of the computations performed over large collections of sensitive individual information, hence natural to examine in conjunction with differential privacy. Predating differential privacy, in 2005 Blum, Dwork, McSherry and Nissim showed that any concept class that is learnable in Kearns’ model of statistical queries is also learnable with privacy. The concept of Private Learning formalized by Kasiviswanathan et al. in 2008 as the conjunction of PAC learning and differential privacy. They showed that any concept class |C| can be learned privately with O(log|C|) samples, via a construction that is somewhat analogous to the Occam Razor (non-private) learner.

Investigating the gap between the sample complexity and computational complexity of private and non-private learners resulted in a rich picture that we will highlight in the talk. In particular, we will examine some of the lower bound and upper bound techniques used in this context, and explore some of the ways to mitigate the costs of private learners. Time permitting, we will see relationships between private learning and other tasks, such as median computation and data sanitization.

Based on joint works with: Amos Beimel, Avrim Blum, Hai Brenner, Mark Bun, Cynthia Dwork, Shiva Kasiviswanathan, Homin Lee, Frank McSherry, Sofya Raskhodnikova, Adam Smith, Uri Stemmer, and Salil Vadhan.

Advertisements

Please join us for the next installment of Crypto Day on Friday, February 20 at Microsoft Research, New England.

Location and Arrival Instructions:
Microsoft New England Research and Development Center
One Memorial Drive, Cambridge MA 02142

Upon arrival, be prepared to show a picture ID and sign the Building Visitor Log when approaching the Lobby Floor Security Desk. Alert them to the name of the event, and ask them to direct you to the appropriate floor. The talks will be held the First Floor Conference Center, in the Horace Mann Conference Room. Detailed guidance on directions, via car or public transportation, is available here. Parking will be available for the on-site parking garage for $27/day.

Program:

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Tal Malkin, Columbia
The Power of Negations in Cryptography
11:30 – 12:30. Rachel Lin, USCB
Constant-Round Concurrent Zero-knowledge from Indistinguishability Obfuscation
12:30 – 2:00. Lunch (provided)
2:00 – 3:00. Alessandra Scaffuro, BU and Northeastern
Garbled RAM From One-Way Functions
3:30 – 4:30. Henry Corrigan-Gibbs, Stanford
Building Anonymous Messaging Systems that ‘Hide the Metadata’

Abstracts:

Speaker: Tal Malkin
Title: The Power of Negations in Cryptography

The study of monotonicity and negation complexity for Boolean functions has been prevalent in complexity theory as well as in computational learning theory, but little attention has been given to it in the cryptographic context. Recently, Goldreich and Izsak (2012) have initiated a study of whether cryptographic primitives can be monotone, and showed that one-way functions can be monotone (assuming they exist), but a pseudorandom generator cannot.

In this work, we start by filling in the picture and proving that many other basic cryptographic primitives cannot be monotone. We then initiate a quantitative study of the power of negations, asking how many negations are required. We provide several lower bounds, some of them tight, for various cryptographic primitives and building blocks including one-way permutations, pseudorandom functions, small-bias generators, hard-core predicates, error-correcting codes, and randomness extractors. Among our results, we highlight the following.

i) Unlike one-way functions, one-way permutations cannot be monotone.

ii) We prove that pseudorandom functions require log n−O(1) negations (which is optimal up to the additive term).

iii) Error-correcting codes with optimal distance parameters require log n−O(1) negations (again, optimal up to the additive term).

iv) We prove a general result for monotone functions, showing a lower bound on the depth of any circuit with t negations on the bottom that computes a monotone function f in terms of the monotone circuit depth of f. This result addresses a question posed by Koroth and Sarma (2014) in the context of the circuit complexity of the Clique problem.

Joint work with Siyao Guo, Igor Carboni Oliveira, and Alon Rosen.

Speaker: Rachel Lin
Title: Constant-Round Concurrent Zero-knowledge from Indistinguishability Obfuscation

We present a constant-round concurrent zero-knowledge protocol for NP. Our protocol relies on the existence of families of collision-resistant hash functions, one-way permutations, and indistinguishability obfuscators for P/poly (with slightly super-polynomial security).

Speaker: Alessandra Scafuro
Title: Garbled RAM From One-Way Functions

Yao’s garbled circuit construction is a fundamental construction in cryptography and recent efficiency optimizations have brought it much closer to practice. However these constructions work only for circuits and garbling a RAM program involves the inefficient process of first converting it into a circuit. Towards avoiding this inefficiency, Lu and Ostrovsky [Eurocrypt 2013] introduced the notion of “garbled RAM” as a method to garble RAM programs directly. It can be seen as a RAM analogue of Yao’s garbled circuits such that, the size of the garbled program and the time it takes to create and evaluate it, is proportional only to the running time on the RAM program rather than its circuit size.
Known realizations of this primitive, either rely on stronger computational assumptions such as the existence of
Identity-Based Encryption, or rely on one-way functions only but do not achieve the aforementioned efficiency [Gentry, Halevi, Lu, Ostrovsky, Raykova and Wichs, EUROCRYPT 2014].

In this work we provide the first construction with strictly poly-logarithmic overhead in both space and time based only on the minimal assumption
that one-way functions exist.

Join work with Sanjam Garg, Steve Lu and Rafail Ostrovsky.

Speaker:
Henry Corrigan-Gibbs

Title: Building Anonymous Messaging Systems that ‘Hide the Metadata’

Encryption can protect the contents of a message being sent over an open network. In many situations, though, hiding the contents of a communication is not enough: parties to a conversation want to conceal the fact that they ever communicated. In this talk, I will explain how anonymity-preserving messaging systems can help ‘hide the metadata’ pertaining to a conversation and I will survey the state of the art in anonymous messaging protocols.

A limitation of existing protocols is that they exhibit computation and communication costs that scale linearly with the number of users (i.e., the anonymity set size) or they require expensive zero-knowledge proofs. In recent work, we have designed Riposte, a new system for anonymous messaging that applies private-information-retrieval and secure multi-party computation techniques to circumvent these limitations.

An implementation and experimental evaluation of Riposte demonstrates that, for latency-tolerant applications, the system can provide near-ideal anonymity for groups of millions of users—two orders of magnitude more than current systems support. I will conclude the talk with a discussion of open problems and directions for future work.

Joint work with: Dan Boneh and David Mazières

Please join us for the next installment of Crypto Day on Friday, December 5 at Boston University.

Location: 111 Cummington Mall Room 180. [directions]

Parking: There’s a pay lot across the street and 4-hour meters on Bay State Road.

Schedule

9:30 – 10:00. Introduction/Coffee
10:00 – 11:00.
Yuval Ishai, Technion
Circuits Resilient to Additive Attacks, with Applications to Secure Computation
11:30 – 12:30. Omer Paneth, Boston University
Publicly-Verifiable Non-Interactive Arguments for Delegating Computations
12:30 – 2:00. Lunch (provided)
2:00 – 3:00. Elaine Shi, University of Maryland
Programs to Circuits: Towards a Programming Language for Cryptography
3:30 – 4:30. Sergey Gorbunov, MIT
Leveled Fully Homomorphic Signatures from Standard Lattices

Thanks: NSF Frontier Grant: Modular Approach to Cloud Security (MACS), Hariri Institute for Computing and Center for RISCS.

Special thanks to Leo Reyzin, Debbie Lehto, and Lauren Dupee for help with organization

Abstracts:

Speaker: Yuval Ishai
Title: Circuits Resilient to Additive Attacks, with Applications to Secure Computation

We study the question of protecting arithmetic circuits against additive attacks that can add an arbitrary fixed value to each wire in the circuit. We show how to transform an arithmetic circuit C into a functionally equivalent, randomized circuit C’ of comparable size, such that the effect of any additive attack on the wires of C’ can be simulated (up to a small statistical distance) by an additive attack on just the inputs and outputs of C.

Our study of this question is motivated by the goal of simplifying and improving protocols for secure multiparty computation (MPC). It is typically the case that securing MPC protocols against active adversaries is much more difficult than securing them against passive adversaries. We observe that in simple MPC protocols that were designed to protect circuit evaluation only against passive adversaries, the effect of any active adversary corresponds precisely to an additive attack on the circuit’s wires. Thus, to securely evaluate a circuit C in the presence of active adversaries, it suffices to apply the passive-case protocol to a corresponding circuit C’ which is secure against additive attacks. We use this methodology to simplify feasibility results and obtain efficiency improvements in several standard MPC models.

Joint work with Daniel Genkin, Manoj Prabhakaran, Amit Sahai, and Eran Tromer.

Speaker: Omer Paneth
Title: Publicly-Verifiable Non-Interactive Arguments for Delegating Computations

We construct publicly verifiable non-interactive arguments that can be used to delegate polynomial time computations. These computationally sound proof systems are completely non-interactive in the common reference string model. The verifier’s running time is nearly-linear in the input length, and poly-logarithmic in the complexity of the delegated computation. Our protocol is based on graded encoding schemes, introduced by Garg, Gentry and Halevi (Eurocrypt 2012). Security is proved under a falsifiable and arguably simple cryptographic assumption about graded encodings. All prior publicly verifiable non-interactive argument systems were based on non-falsifiable knowledge assumptions. Our new result builds on the beautiful recent work of Kalai, Raz and Rothblum (STOC 2014), who constructed privately verifiable 2-message arguments. While building on their techniques, our protocols avoid no-signaling PCPs, and we obtain a simplified and modular analysis.

As a second contribution, we also construct a publicly verifiable non-interactive argument for (logspace-uniform) computations of bounded depth. The verifier’s complexity grows with the depth of the circuit. This second protocol is adaptively sound, and its security is based on a falsifiable assumption about the hardness of a search problem on graded encodings (a milder cryptographic assumption). This result builds on the interactive proof of Goldwasser, Kalai and Rothblum (STOC 2008), using graded encodings to construct a non-interactive version of their protocol.

Joint work with Guy Rothblum.

Speaker: Elaine Shi
Title: Programs to Circuits: Towards a Programming Language for Cryptography

Modern cryptography (e.g., secure multi-party computation, fully-homomorphic encryption, program obfuscation) commonly models computation as “circuits”. To make modern cryptography work for real-world programs, it is necessary to compile “programs” into compact “circuits”. The key difficulty is that programs make dynamic memory accesses, whereas circuits have static wiring. To address this challenge, we need efficient Oblivious RAM and oblivious algorithms.

In this talk, I will first describe Circuit ORAM, a new ORAM scheme that yields very small circuit size. Circuit ORAM shows the tightness of certain stronger interpretations of the well-known Goldreich-Ostrovsky lower bound.

Next, I will describe ObliVM, a programming framework that compiles real-life programs into compact circuits, while offering formal security guarantees.

Speaker: Sergey Gorbunov
Title: Leveled Fully Homomorphic Signatures from Standard Lattices

In a homomorphic signature scheme, a user Alice signs some large dataset x using her secret signing key and uploads the signed data to an untrusted remote server. The server can then run some computation y=f(x) over the signed data and homomorphically derive a short signature \sigma_{f,y} certifying that y is the correct output of the computation f. Anybody can verify the tuple (f, y, \sigma_{f,y}) using Alice’s public verification key and become convinced of this fact without having to retrieve the entire underlying data.

In this work, we construct the first (leveled) fully homomorphic signature schemes that can evaluate arbitrary circuits over signed data. Only the maximal depth d of the circuits needs to be fixed a-priori at setup, and the size of the evaluated signature grows polynomially in d, but is otherwise independent of the circuit size or the data size. Our solution is based on the (sub-exponential) hardness of the small integer solution (SIS) problem in standard lattices. In the standard model, we get a scheme with large public parameters whose size exceeds the total size of a dataset. In the random-oracle model, we get a scheme with short public parameters. In both cases, the schemes can be used to sign many different datasets. The complexity of verifying a signature for a computation f is at least as large as that of computing f, but can be amortized when verifying the same computation over many different datasets. Furthermore, the signatures can be made context-hiding so as not to reveal anything about the data beyond the outcome of the computation.

These results offer a significant improvement in capabilities and assumptions over the best prior homomorphic signature schemes, which were limited to evaluating polynomials of constant degree.

As a building block of independent interest, we introduce and construct a new object called homomorphic trapdoor functions (HTDF) which conceptually unites homomorphic encryption and signatures.

Joint work with Vinod Vaikuntanathan (MIT) and Daniel Wichs (Northeastern).


The Charles River Crypto Day is back! We now plan to make it a regular event held about once every two months. Please join us on Friday, October 24 at MIT for the first Crypto Day of 2014-2015.

Location: MIT Stata Center Building 32 Gates Tower, 8th floor Room G-882 (Hewlett).

Program:

9:00 – 9:30. Introduction/Coffee
9:30 – 10:30.
Ron Rivest, MIT
Spritz—A spongy RC4-like stream cipher and hash function
Slides
11:00 – 12:00. Allison Bishop Lewko, Columbia
Witness Encryption and Indistinguishability Obfuscation from the Multilinear Subgroup Elimination Assumption
Slides
12:00 – 2:00. Lunch (provided)
2:00 – 3:00. Alessandro Chiesa, ETH Zurich
Scalable Zero Knowledge via Cycles of Elliptic Curves
3:30 – 4:30. Alon Rosen, IDC Herzlia
An Algebraic Approach to Non-Malleability
Slides

Abstracts:


Speaker: Ron Rivest (MIT)
Title/Abstract:  Spritz—A spongy RC4-like stream cipher and hash function

Abtract: We reconsider the design of the stream cipher RC4, and proposes an improved variant, which we call “Spritz”.

Our work leverages the considerable cryptanalytic work done on the original RC4 and its proposed variants. It also uses simulations extensively to search for biases and to guide the selection of intermediate expressions.

We estimate that Spritz can produce output with about 24 cycles/byte of computation. Furthermore, our statistical tests suggest that about 2^81 bytes of output are needed before one can reasonably distinguish Spritz output from random output; this is a marked improvement over RC4.

In addition, we formulate Spritz as a “sponge (or sponge-like) function,” (see Bertoni et al), which can Absorb new data at any time, and from which one can Squeeze pseudorandom output sequences of arbitrary length. Spritz can thus be easily adapted for use as a cryptographic hash function, an encryption algorithm, or a message-authentication code generator. (However, in hash-function mode, Spritz is rather slow.)

Joint work with Jacob Schuldt.


Speaker: Allison Bishop Lewko (Cloumbia U)
Title: Witness encryption and indistinguishability obfuscation from the multilinear subgroup elimination assumption

Abstract:
We present constructions of witness encryption and indistinguishability obfuscation along with security reductions to the multilinear subgroup elimination assumption. This assumption is a natural multilinear extension of the subgroup decision assumptions used in bilineargroups.

This talk is based on joint works with Gentry and Waters and with Gentry, Sahai and Waters.


Speaker: Alessandro Chiesa (ETH Zurich)
Title: Scalable Zero Knowledge via Cycles of Elliptic Curves

Abstract: Non-interactive zero-knowledge proofs for general NP statements are a powerful cryptographic primitive. Recent work has achieved theoretical constructions and working implementations of zero-knowledge proofs that are short and easy to verify.

Alas, all prior implementations suffer from severe scalability limitations: the proving key’s size and the prover’s space complexity grow with the size of the computation being proved.

The bootstrapping technique of Bitansky et al. (STOC 2013), following Valiant (TCC 2008), offers an approach to scalability, by recursively composing proofs, but it has never been realized in practice, due to enormous computational cost.

In this work, by leveraging new elliptic-curve cryptographic techniques, we achieve the first practical implementation of recursive proof composition, and thereby achieve the first implementation of *scalable zero knowledge*.

Joint work with Eli Ben-Sasson, Eran Tromer, and Madars Virza.


Speaker: Alon Rosen (IDC Herzliya)
Title: An Algebraic Approach to Non-Malleability

Abstract: I will present a new technique for constructing non-malleable protocols with only a single “slot”. Two direct byproducts of our ideas are a four round non-malleable commitment and a four round non-malleable zero-knowledge argument, the latter matching the round complexity of the best known zero-knowledge arguments (without the non-malleability requirement). The protocols are based on the existence of one-way functions and admit very efficient instantiations via standard homomorphic commitments and sigma protocols.

Our analysis relies on algebraic reasoning, and makes use of error correcting codes in order to ensure that committers’ tags differ in many coordinates. One way of viewing our construction is as a method for combining many atomic sub-protocols in a way that simultaneously amplifies soundness and non-malleability, thus requiring much weaker guarantees to begin with, and resulting in a protocol which is much trimmer in complexity compared to the existing ones.

Joint work with Vipul Goyal, Silas Richelson and Margarita Vald.