Search

A non-malleable code is an unkeyed randomized encoding scheme that offers the strong guarantee that decoding a tampered codeword either results in the original message, or in an unrelated message. We consider the simplest possible construction in the computational split-state model, which simply encodes a message m as k||Ek(m) for a uniformly random key k, where E is a block cipher. This construction is comparable to, but greatly simplifies over, the one of Kiayias et al. (ACM CCS 2016), who eschewed this simple scheme in fear of related-key attacks on E. In this work, we prove this construction to be a strong non-malleable code as long as E is (i) a pseudorandom permutation under leakage and (ii) related-key secure with respect to an arbitrary but fixed key relation. Both properties are believed to hold for “good” block ciphers, such as AES-128, making this non-malleable code very efficient with short codewords of length |m|+2τ (where τ is the security parameter, e.g., 128 bits), without significant security penalty., IACR Transactions on Symmetric Cryptology, Volume 2018, Issue 1

We present column parity mixers (CPM), a generalization of the Θ mixing layer that is used in Keccak. Thanks to our description using matrix arithmetic, we can easily derive algebraic, diffusion, and mask propagation properties, leading to a surprising distinction between two types of CPMs. We compare CPMs to other popular types of mixing layers and argue that CPMs can be more efficient. While Keccak has a bit-oriented structure, we make the case that CPMs are also suitable for nibble- or byte-oriented designs. We outline a general substitution-permutation-network-based design strategy using a CPM, for which we show how one can attain strong bounds for differential and linear trails. We apply this strategy concretely to design a 256-bit permutation with an efficient inverse and strong trail bounds. Our permutation design uses a number of ideas that are of independent interest and allows a fast bitsliced implementation that compares quite well with other established ciphers and permutations., IACR Transactions on Symmetric Cryptology, Volume 2018, Issue 1

This paper is about distances between (or, metrics on) probability distributions. It considers the total variation and Kantorovich distance for discrete distributions, and also the trace distance for quantum distributions. Both concrete and abstract results are presented, showing similarities between classical (discrete) probability and quantum probability. The concrete results involve distances between joint distributions and the product of their marginals, as measure of correlation. It is shown that the discrete and quantum case are not that different. The abstract results address metric aspects of ‘state-and-effect’ triangles that capture the essential semantic structures at hand.

The distinguishing feature of the Internet of Things is that many devices get interconnected. The threat of side-channel attacks in this setting is less understood than the threat of traditional network and software exploitation attacks that are perceived to be more powerful. This work is a case study of Thread, an emerging network and transport level stack designed to facilitate secure communication between heterogeneous IoT devices. We perform the first side-channel vulnerability analysis of the Thread networking stack. We leverage various network mechanisms to trigger manipulations of the security material or to get access to the network credentials. We choose the most feasible attack vector to build a complete attack that combines network specific mechanisms and Differential Electromagnetic Analysis. When successfully applied on a Thread network, the attack gives full network access to the adversary. We evaluate the feasibility of our attack in a TI CC2538 setup running OpenThread, a certified open-source implementation of the stack. The full attack does not succeed in our setting. The root cause for this failure is not any particular security feature of the protocol or the implementation, but a side-effect of a feature not related to security. We summarize the problems that we find in the protocol with respect to side-channel analysis, and suggest a range of countermeasures to prevent our attack and the other attack vectors we identified during the vulnerability analysis. In general, we demonstrate that elaborate security mechanisms of Thread make a side-channel attack not trivial to mount. Similar to a modern software exploit, it requires chaining multiple vulnerabilities. Nevertheless, such attacks are feasible. Being perhaps too expensive for settings like smart homes, they pose a relatively higher threat to the commercial setting. We believe our experience provides a useful lesson to designers of IoT protocols and devices., IACR Transactions on Cryptographic Hardware and Embedded Systems, Volume 2018, Issue 1

Recently a lot of attention is paid to the search for efficiently implementable MDS matrices for lightweight symmetric primitives. Most previous work concentrated on locally optimizing the multiplication with single matrix elements. Separate from this line of work, several heuristics were developed to find shortest linear straightline programs. Solving this problem actually corresponds to globally optimizing multiplications by matrices. In this work we combine those, so far largely independent lines of work. As a result, we achieve implementations of known, locally optimized, and new MDS matrices that significantly outperform all implementations from the literature. Interestingly, almost all previous locally optimized constructions behave very similar with respect to the globally optimized implementation. As a side effect, our work reveals the so far best implementation of the Aes Mix- Columns operation with respect to the number of XOR operations needed.

Normalisation in probability theory turns a subdistribution into a proper distribution. It is a partial operation, since it is undefined for the zero subdistribution. This partiality makes it hard to reason equationally about normalisation. A novel description of normalisation is given as a mathematically well-behaved total function. The output of this `hyper' normalisation operation is a distribution of distributions. It improves reasoning about normalisation. After developing the basics of this theory of (hyper) normalisation, it is put to use in a similarly new description of conditioning, producing a distribution of conditional distributions. This is used to give a clean abstract reformulation of refinement in quantitative information flow., Logical Methods in Computer Science ; Volume 13, Issue 3 ; 1860-5974

Cryptographic modes built on top of a blockcipher usually rely on the assumption that this primitive behaves like a pseudorandom permutation (PRP). For many of these modes, including counter mode and GCM, stronger security guarantees could be derived if they were based on a PRF design. We propose a heuristic method of transforming a dedicated blockcipher design into a dedicated PRF design. Intuitively, the method consists of evaluating the blockcipher once, with one or more intermediate state values fed-forward. It shows strong resemblance with the optimally secure EDMD construction by Mennink and Neves (CRYPTO 2017), but the use of internal state values make their security analysis formally inapplicable. In support of its security, we give the rationale of relying on the EDMD function (as opposed to alternatives), and present analysis of simplified versions of our conversion method applied to the AES. We conjecture that our main proposal AES-PRF, AES with a feed-forward of the middle state, achieves close to optimal security. We apply the design to GCM and GCM-SIV, and demonstrate how it entails significant security improvements. We furthermore demonstrate how the technique extends to tweakable blockciphers and allows for security improvements in, for instance, PMAC1., IACR Transactions on Symmetric Cryptology, Volume 2017, Issue 3

In the semantics of programming languages one can view programs as state transformers, or as predicate transformers. Recently the author has introduced state-and-effect triangles which capture this situation categorically, involving an adjunction between state- and predicate-transformers. The current paper exploits a classical result in category theory, part of Jon Beck's monadicity theorem, to systematically construct such a state-and-effect triangle from an adjunction. The power of this construction is illustrated in many examples, covering many monads occurring in program semantics, including (probabilistic) power domains., Logical Methods in Computer Science ; Volume 13, Issue 2 ; 1860-5974

In 1973 Paschke defined a factorization for completely positive maps between C*-algebras. In this paper we show that for normal maps between von Neumann algebras, this factorization has a universal property, and coincides with Stinespring's dilation for normal maps into B(H)., Comment: In Proceedings QPL 2016, arXiv:1701.00242

Contains fulltext : 178504.pdf (Publisher’s version ) (Open Access)

Contains fulltext : 179176pub.pdf (Publisher’s version ) (Open Access) 10 p.

Contains fulltext : 204182.pdf (Publisher’s version ) (Open Access) Radboud University, 01 juli 2019 Promotor : Batina, L. xxvi, 264 p.

Contains fulltext : 166141.pdf (Publisher’s version ) (Open Access)

At the heart of the Conway-Kochen Free Will Theorem and Kochen and Specker’s argument against non-contextual hidden variable theories is the existence of a Kochen-Specker (KS) system: a set of points on the sphere that has no {0,1}-coloring such that at most one of two orthogonal points are colored 1 and of three pairwise orthogonal points exactly one is colored 1. In public lectures, Conway encouraged the search for small KS systems. At the time of writing, the smallest known KS system has 31 vectors.

Contains fulltext : 158069.pdf (Publisher’s version ) (Open Access)

Effectuses have recently been introduced as categorical models for quantum computation, with probabilistic and Boolean (classical) computation as special cases. These 'probabilistic' models are called commutative effectuses. All known examples of such commutative effectuses are Kleisli categories of a monad. This paper answers the open question what properties a monad should satisfy so that its Kleisli category is a (commutative) effectus. The relevant properties are: strong affineness and partial additivity, together with some non-triviality conditions.

This paper introduces a novel type theory and logic for probabilistic reasoning. Its logic is quantitative, with fuzzy predicates. It includes normalisation and conditioning of states. This conditioning uses a key aspect that distinguishes our probabilistic type theory from quantum type theory, namely the bijective correspondence between predicates and side-effect free actions (called instrument, or assert, maps). The paper shows how suitable computation rules can be derived from this predicate-action correspondence, and uses these rules for calculating conditional probabilities in two well-known examples of Bayesian reasoning in (graphical) models. Our type theory may thus form the basis for a mechanisation of Bayesian inference., Comment: 38 pages

It has already been established that the properties required of an abstract sequential product as introduced by Gudder and Greechie are not enough to characterise the standard sequential product $a\circ b = \sqrt{a}b\sqrt{a}$ on an operator algebra. We give three additional properties, each of which characterises the standard sequential product on either a von Neumann algebra or a Euclidean Jordan algebra. These properties are (1) invariance under application of unital order isomorphisms, (2) symmetry of the sequential product with respect to a certain inner product, and (3) preservation of invertibility of the effects. To give these characterisations we first have to study convex $\sigma$-sequential effect algebras. We show that these objects correspond to unit intervals of spectral order unit spaces with a homogeneous positive cone., Comment: 18 pages + 2 page appendix

The significance of understanding blockcipher security in the multi-key setting is highlighted by the extensive literature on attacks, and how effective key size can be significantly reduced. Nevertheless, little attention has been paid in formally understanding the design of multi-key secure blockciphers. In this work, we formalize the multi-key security of tweakable blockciphers in case of general key derivation functions. We show an equivalence between blockcipher multi-key security and tweakable blockcipher security. Our equivalence connects two objects of study, the iterated Even–Mansour (EUROCRYPT 2012) and the iterated Tweakable Even–Mansour (CRYPTO 2015), which establishes that results in both areas are, to a certain extent, transferable. Using our novel equivalence relation, we derive new bounds for both constructions, pave the path towards the solution of two well-studied conjectures, and show that, contrary to common knowledge, key derivation functions need not necessarily be pseudorandom functions in order to provide security: for the iterated Even–Mansour universal hash functions suffice.

Contains fulltext : 184423.pdf (Publisher’s version ) (Open Access)

Contains fulltext : 191716.pdf (Publisher’s version ) (Open Access)

We describe categorical models of a circuit-based (quantum) functional programming language. We show that enriched categories play a crucial role. Following earlier work on QWire by Paykin et al., we consider both a simple first-order linear language for circuits, and a more powerful host language, such that the circuit language is embedded inside the host language. Our categorical semantics for the host language is standard, and involves cartesian closed categories and monads. We interpret the circuit language not in an ordinary category, but in a category that is enriched in the host category. As an extended example, we recall an earlier result that the category of W*-algebras is dcpo-enriched, and we use this model to extend the circuit language with some recursive types.

News consumers expect news outlets to be objective and balanced in their reports of events and opinions. However, there is a growing body of evidence of bias in the media caused by underlying political and socio-economic viewpoints. Previous studies have tried to classify the partiality of the media, but there is little work on quantifying it, and less still on the nature of this partiality. The vast amount of content published in social media enables us to quantify the inclination of the press to pre-defined sides of the socio-political spectrum. To describe such tendencies, we use tweets to automatically compute a news outlet's political and socio-economic orientation. Results show that the media have a measurable bias, and illustrate this by showing the favoritism of Chilean media for the ruling political parties in the country. This favoritism becomes clearer as we empirically observe a shift in the position of the mass media when there is a change in government. Even though relative differences in bias between news outlets can be observed, public awareness of the bias of the media landscape as a whole appears to be limited by the political space defined by the news that we receive as a population. We found that the nature of the bias is reflected in the vocabulary used and the entities mentioned by different news outlets. A survey conducted among news consumers confirms that media bias has an impact on the coverage of controversial topics and that this is perceivable by the general audience. Having a more accurate method to measure and characterize media bias will help readers position outlets in the socio-economic landscape, even when a (sometimes opposite) self-declared position is stated. This will empower readers to better reflect on the content provided by their news outlets of choice.

Updating a probability distribution in the light of new evidence is a very basic operation in Bayesian probability theory. It is also known as state revision or simply as conditioning. This paper recalls how locally updating a joint state can equivalently be described via inference using the channel extracted from the state (via disintegration). This paper also investigates the quantum analogues of conditioning, and in particular the analogues of this equivalence between updating a joint state and inference. The main finding is that in order to obtain a similar equivalence, we have to distinguish two forms of quantum conditioning, which we call lower and upper conditioning. They are known from the literature, but the common framework in which we describe them and the equivalence result are new., Comment: In Proceedings QPL 2018, arXiv:1901.09476

Contains fulltext : 141407.pdf (Publisher’s version ) (Open Access)

Effect algebras have been introduced in the 1990s in the study of the foundations of quantum mechanics, as part of a quantum-theoretic version of probability theory. This paper is part of that programme and gives a systematic account of Lebesgue integration for [0,1]-valued functions in terms of effect algebras and effect modules. The starting point is the 'indicator' function for a measurable subset. It gives a homomorphism from the effect algebra of measurable subsets to the effect module of [0,1]-valued measurable functions which preserves countable joins.It is shown that the indicator is free among these maps: any such homomorphism from the effect algebra of measurable subsets can be thought of as a generalised probability measure and can be extended uniquely to a homomorphism from the effect module of [0,1]-valued measurable functions which preserves joins of countable chains. The extension is the Lebesgue integral associated to this probability measure. The preservation of joins by it is the monotone convergence theorem.

It is well known that the C*-algebra of an ordered pair of qubits is M_2 (x) M_2. What about unordered pairs? We show in detail that M_3 (+) C is the C*-algebra of an unordered pair of qubits. Then we use Schur-Weyl duality to characterize the C*-algebra of an unordered n-tuple of d-level quantum systems. Using some further elementary representation theory and number theory, we characterize the quantum cycles. We finish with a characterization of the von Neumann algebra for unordered words., Comment: In Proceedings QPL 2015, arXiv:1511.01181

We present the syntax and rules of deduction of QPEL (Quantum Program and Effect Language), a language for describing both quantum programs, and properties of quantum programs - effects on the appropriate Hilbert space. We show how semantics may be given in terms of state-and-effect triangles, a categorical setting that allows semantics in terms of Hilbert spaces, C*-algebras, and other categories. We prove soundness and completeness results that show the derivable judgements are exactly those provable in all state-and-effect triangles., In Proceedings QPL 2014, arXiv:1412.8102

Contains fulltext : 166138.pdf (Publisher’s version ) (Open Access)

Weak bisimulations are typically used in process algebras where silent steps are used to abstract from internal behaviours. They facilitate relating implementations to specifications. When an implementation fails to conform to its specification, pinpointing the root cause can be challenging. In this paper we provide a generic characterisation of branching-, delayed-, $\eta$- and weak-bisimulation as a game between Spoiler and Duplicator, offering an operational understanding of the relations. We show how such games can be used to assist in diagnosing non-conformance between implementation and specification. Moreover, we show how these games can be extended to distinguish divergences., Logical Methods in Computer Science ; Volume 13, Issue 4 ; 1860-5974

Constraint automata (CA) constitute a coordination model based on finite automata on infinite words. Originally introduced for modeling of coordinators, an interesting new application of CAs is implementing coordinators (i.e., compiling CAs into executable code). Such an approach guarantees correctness-by-construction and can even yield code that outperforms hand-crafted code. The extent to which these two potential advantages materialize depends on the smartness of CA-compilers and the existence of proofs of their correctness. Every transition in a CA is labeled by a "data constraint" that specifies an atomic data-flow between coordinated processes as a first-order formula. At run-time, compiler-generated code must handle data constraints as efficiently as possible. In this paper, we present, and prove the correctness of two optimization techniques for CA-compilers related to handling of data constraints: a reduction to eliminate redundant variables and a translation from (declarative) data constraints to (imperative) data commands expressed in a small sequential language. Through experiments, we show that these optimization techniques can have a positive impact on performance of generated executable code.

We present new techniques to efficiently scan the space of high-probability differential trails in bit-oriented ciphers. Differential trails consist in sequences of state patterns that we represent as ordered lists of basic components in order to arrange them in a tree. The task of generating trails with probability above some threshold starts with the traversal of the tree. Our choice of basic components allows us to efficiently prune the tree based on the fact that we can tightly bound the probability of all descendants for any node. Then we extend the state patterns resulting from the tree traversal into longer trails using similar bounding techniques. We apply these techniques to the 4 largest Keccak-f permutations, for which we are able to scan the space of trails with weight per round of 15. This space is orders of magnitude larger than previously best result published on Keccak-f[1600] that reached 12, which in turn is orders of magnitude larger than any published results achieved with standard tools, that reached at most 9. As a result we provide new and improved bounds for the minimum weight of differential trails on 3, 4, 5 and 6 rounds. We also report on new trails that are, to the best of our knowledge, the ones with the highest known probability., IACR Transactions on Symmetric Cryptology, Volume 2017, Issue 1

This work implements and evaluates the recent complete addition formulae for the prime order elliptic curves of Renes, Costello and Batina on an FPGA platform. We implement three different versions:(1) an unprotected architecture; (2) an architecture protected through coordinate randomization; and (3) an architecture with both coordinate randomization and scalar splitting in place. The evaluation is done through timing analysis and test vector leakage assessment (TVLA). The results show that applying an increasing level of countermeasures leads to an increasing resistance against side-channel attacks. This is the first work looking into side-channel security issues of hardware implementations of the complete formulae.

Contains fulltext : 181250.pdf (Publisher’s version ) (Open Access) EEWC-FORUM 2017: Enterprise Engineering Working Conference Forum

This discussion note does three things: (1) it explains the notion of ‘legal protection by design’ in relation to data-driven infrastructures that form the backbone of our new ‘onlife world’, (2) it explains how the notion of ‘by design’ relates to the relational nature of what an environment affords its inhabitants, referring to the work of James Gibson, and (3) it explains how this affects our understanding of human capabilities in relation to the affordances of changing environments. Finally, this brief note argues that ‘safer by design’ in the case of nanotechnology will require legal protection by design to make sure that human capabilities are reinvented and sustained in nano-technical environments.

Contains fulltext : 173203.pdf (Publisher’s version ) (Open Access)

Energy consumption analysis of IT-controlled systems can play a major role in minimising the overall energy consumption of such IT systems, during the development phase, or for optimisation in the field. Recently, a precise energy analysis was developed, with the property of being parametric in the hardware. In principle, this creates the opportunity to analyse which is the best software implementation for given hardware, or the other way around: choose the best hardware for a given algorithm. The precise analysis was introduced for a very limited language: ECA. In this paper, several important steps are taken towards practical energy analysis. The ECA language is extended with common programming language features. The application domain is further explored, and threats to the validity are identified and discussed. Altogether, this constitutes an important step towards analysing energy consumption of IT-controlled systems in practice., In Proceedings DICE-FOPARA 2017, arXiv:1704.05169

Contains fulltext : 175862.pdf (Publisher’s version ) (Open Access) Radboud University, 03 oktober 2017 Promotor : Jacobs, B.P.F. i, 267 p.

Contains fulltext : 176475.pdf (Publisher’s version ) (Open Access) Radboud University, 09 oktober 2017 Promotor : Jacobs, B.P.F. Co-promotor : Hoepman, J.H. xvi, 219 p.

Contains fulltext : 178461pre.pdf (Author’s version preprint ) (Open Access) Contains fulltext : 178461pub.pdf (Publisher’s version ) (Open Access)

Coordination languages simplify design and development of concurrent systems. Particularly, exogenous coordination languages, like BIP and Reo, enable system designers to express the interactions among components in a system explicitly. A formal relation between exogenous coordination languages comprises the basis for a solid comparison and consolidation of their fundamental concepts. In this paper we establish a formal relation between BI(P) (i.e., BIP without the priority layer) and Reo, by defining transformations between their semantic models. We show that these transformations preserve all properties expressible in a common semantics. We use these transformations to define data-sensitive BIP architectures and their composition.

Contains fulltext : 166122.pdf (Publisher’s version ) (Open Access)

This paper presents software demonstrating that the 20-year-old NTRU cryptosystem is competitive with more recent lattice-based cryptosystems in terms of speed, key size, and ciphertext size. We present a slightly simplified version of textbook NTRU, select parameters for this encryption scheme that target the 128-bit post-quantum security level, construct a KEM that is CCA2-secure in the quantum random oracle model, and present highly optimized software targeting Intel CPUs with the AVX2 vector instruction set. This software takes only 307 914 cycles for the generation of a keypair, 48 646 for encapsulation, and 67 338 for decapsulation. It is, to the best of our knowledge, the first NTRU software with full protection against timing attacks.

We present a length doubler, LDT, that turns an n-bit tweakable block cipher into an efficient and secure cipher that can encrypt any bit string of length [n..2n − 1]. The LDT mode is simple, uses only two cryptographic primitive calls (while prior work needs at least four), and is a strong length-preserving pseudorandom permutation if the underlying tweakable block ciphers are strong tweakable pseudorandom permutations. We demonstrate that LDT can be used to neatly turn an authenticated encryption scheme for integral data into a mode for arbitrary-length data., IACR Transactions on Symmetric Cryptology, Volume 2017, Issue 3

Searching in digital video data for high-level events, such as a parade or a car accident, is challenging when the query is textual and lacks visual example images or videos. Current research in deep neural networks is highly beneficial for the retrieval of high-level events using visual examples, but without examples it is still hard to (1) determine which concepts are useful to pre-train ( Vocabulary challenge ) and (2) which pre-trained concept detectors are relevant for a certain unseen high-level event ( Concept Selection challenge ). In our article, we present our Semantic Event Retrieval System which (1) shows the importance of high-level concepts in a vocabulary for the retrieval of complex and generic high-level events and (2) uses a novel concept selection method ( i-w2v ) based on semantic embeddings. Our experiments on the international TRECVID Multimedia Event Detection benchmark show that a diverse vocabulary including high-level concepts improves performance on the retrieval of high-level events in videos and that our novel method outperforms a knowledge-based concept selection method.

Energy consumption analysis of IT-controlled systems can play a major role in minimising the overall energy consumption of such IT systems, during the development phase, or for optimisation in the field. As software is increasingly embedded in our daily life, with IT using more and more energy, the software industry should become aware of their energy footprint, and methods must be developed to assist in reducing this footprint.Recently, we developed a precise energy analysis, to analyse software in conjunction with hardware. It has the property of being parametric with regard to the hardware. In principle, this creates the opportunity to investigate which is the best software implementation for given hardware, or the other way around: choose the best hardware for a given algorithm.

Contains fulltext : 181649.pdf (Publisher’s version ) (Open Access) 65 p.

Following on from the notion of (first-order) causality, which generalises the notion of being tracepreserving from CP-maps to abstract processes, we give a characterization for the most general kind of map which sends causal processes to causal processes. These new, second-order causal processes enable us to treat the input processes as 'local laboratories' whose causal ordering needs not be fixed in advance. Using this characterization, we give a fully-diagrammatic proof of a non-trivial theorem: namely that being causality-preserving on separable processes implies being 'completely' causality preserving. That is, causality is preserved even when the 'local laboratories' are allowed to have ancilla systems. An immediate consequence is that preserving causality is separable processes is equivalence to preserving causality for strongly non-signalling (a.k.a. localizable) processes., Comment: In Proceedings QPL 2016, arXiv:1701.00242

Contains fulltext : 175985.pdf (Publisher’s version ) (Open Access) Radboud University, 09 oktober 2017 Promotor : Batina, L. Co-promotor : Hoepman, J.H. XXV, 203 p.

At the heart of the Conway-Kochen Free Will theorem and Kochen and Specker's argument against non-contextual hidden variable theories is the existence of a Kochen-Specker (KS) system: a set of points on the sphere that has no 0,1-coloring such that at most one of two orthogonal points are colored 1 and of three pairwise orthogonal points exactly one is colored 1. In public lectures, Conway encouraged the search for small KS systems. At the time of writing, the smallest known KS system has 31 vectors. Arends, Ouaknine and Wampler have shown that a KS system has at least 18 vectors, by reducing the problem to the existence of graphs with a topological embeddability and non-colorability property. The bottleneck in their search proved to be the sheer number of graphs on more than 17 vertices and deciding embeddability. Continuing their effort, we prove a restriction on the class of graphs we need to consider and develop a more practical decision procedure for embeddability to improve the lower bound to 22., Comment: In Proceedings QPL 2014, arXiv:1412.8102