Search

RSA (Rivest-Shamir-Adleman) cryptosystem is the most popular asymmetric key cryptographic algorithm used in computer science and information security. Recently, an RSA-like cryptosystem was proposed using a novel product that arises from a cubic field connected to the cubic Pell equation. The relevant key equation is e d ≡ 1 mod ( p 2 + p + 1 ) ( q 2 + q + 1 ) with N = p q . This RSA variant is claimed to be robust against the Wiener's attack and hence the bit-size of the private key could be shorter, namely d N 1 / 4 . In this paper, we explore the further security analysis and investigate the potential small private exponent attack. We show that such RSA variant is particularly vulnerable to the lattice-based method. To be specific, we can carry out the lattice-based small private exponent attack if d N 2 − 2 , which is less secure than the standard RSA. Furthermore, we conduct numerical experiments to verify the validity of the proposed attack.

Although most of the quantum signatures can be verified by a designated receiver, they do not match the classical designated verifier signature since an indistinguishable signature cannot be efficiently simulated. To adapt quantum signatures in specific environments like E-voting and E-bidding, several quantum designated verifier signature (QDVS) schemes have been proposed. However, it is still too complicated and infeasible to implement existing QDVS schemes in practice. In this paper, we propose a practical QDVS scheme without entanglement for E-voting applications. It only involves the quantum processing part of the underlying quantum key distribution (QKD) to generate correlated key strings, which protects the communication against potential eavesdroppers. The proposed scheme can be easily and efficiently deployed over the existing QKD network without complicated quantum operations. We further show that our QDVS scheme satisfies the required main security requirements and has the capability against several common attacks.

The quantum key distribution (QKD) protocol provides an absolutely secure way to distribute secret keys, where security can be guaranteed by quantum mechanics. To raise the key generation rate of classical BB84 QKD protocol, Hwang et al. (Phys Lett A 244(6):489–494, 1998) proposed a subtle variation (Hwang protocol), in which a pre-shared secret string is used to generate the consistent basis. Although the security of Hwang protocol has been verified in ideal condition, its practicality is still being studied in more depth. In this work, we propose a simple attack strategy to obtain all preparation basis by stealing partial information in each round. To eliminate this security threat, we further propose an improved QKD protocol using the idea of iteratively updating the basis. Furthermore, we apply our improved method to decoy-state QKD protocol and double its key generation rate.

Field-programmable gate arrays (FPGAs) are widely used in many fields because of their low power consumption, easy design and good performance. For applications running on FPGAs, security is very important. A lot of researches have been done on the security issue of FPGA implementations, many attacks and countermeasures have been proposed. The dual complementary strategy is a countermeasure designed to thwart side channel attacks. In this paper, we perform Correlation Power Analysis (CPA) against dual complementary AES implemented on the SAKURA-G FPGA board. For dual complementary AES with constant Hamming Weight (HW) value, which is demonstrated to be robust against CPA based on HW model, we successfully recover the secret key using Hamming Distance (HD) and Switching Distance (SD) models with 2,000 power traces. For dual complementary AES with constant HD, 16,000 resp. 10,000 power traces are required to recover the key with HD resp. SD model.

Since Kocher (CRYPTO’96) proposed timing attack, side channel analysis (SCA) has shown great potential to break cryptosystems via physical leakage. Recently, deep learning techniques are widely used in SCA and show equivalent and even better performance compared to traditional methods. However, it remains unknown why and when deep learning techniques are effective and efficient for SCA. Masure et al. (IACR TCHES 2020(1):348–375) illustrated that deep learning paradigm is suitable for evaluating implementations against SCA from a worst-case scenario point of view, yet their work is limited to balanced data and a specific loss function. Besides, deep learning metrics are not consistent with side channel metrics. In most cases, they are deceptive in foreseeing the feasibility and complexity of mounting a successful attack, especially for imbalanced data. To mitigate the gap between deep learning metrics and side channel metrics, we propose a novel Cross Entropy Ratio (CER) metric to evaluate the performance of deep learning models for SCA. CER is closely related to traditional side channel metrics Guessing Entropy (GE) and Success Rate (SR) and fits to deep learning scenario. Besides, we show that it works stably while deep learning metrics such as accuracy becomes rather unreliable when the training data tends to be imbalanced. However, estimating CER can be done as easy as natural metrics in deep learning algorithms with low computational complexity. Furthermore, we adapt CER metric to a new kind of loss function, namely CER loss function, designed specifically for deep learning in side channel scenario. In this way, we link directly the SCA objective to deep learning optimization. Our experiments on several datasets show that, for SCA with imbalanced data, CER loss function outperforms Cross Entropy loss function in various conditions., IACR Transactions on Cryptographic Hardware and Embedded Systems, Volume 2020, Issue 3

Password-based authenticated key exchange (PAKE) protocols allow two users who share only a short, low-entropy password to establish a consistent cryptographically strong session key. In 2009, Katz and Vaikuntanathan gave the first lattice-base PAKE from approximate smooth projective hash function (ASPHF) which is a variant of smooth projective hash function (SHPF). In 2017, Zhang and Yu introduced a two-round PAKE based on splittable PKEs. An error-correcting code (ECC) was used in these protocols to deal with the errors intrinsically in learning with errors (LWE) assumption, and the protocol is asymmetric as the session key is decided be just one user. In this paper, an error correcting technique called reconciliation mechanism, which was first introduced to construct a key exchange protocol from lattice, is adopted to construct more efficient lattice-based PAKEs with reduced computation complexity and communication complexity. Moreover, the new PAKEs are symmetric.

In this paper, we address the security evaluation issue of the RSA cryptosystem with implicitly related private keys. We formulate the attack scenario and propose a novel implicit-key attack using the lattice-based method. When given public information \((N_1,e_1)\), \((N_2,e_2)\) and the amount of shared bits of the private keys \(d_1\) and \(d_2\), one can conduct the implicit-key attack to factor \(N_1, N_2\) in polynomial time under a certain condition. We show that the RSA cryptosystem is more insecure when taking the implicitly related keys into consideration. The experimental results are provided to verify the validity of our proposed attack.

Quadratic functions F_p,n defined from F_p^n to F_p with coefficients in F_p, have been studied in several papers. In 2014, Meidl, Roy and Topuzoglu gave three methods for enumeration of such functions with prescribed Walsh spectrum. They obtained the generating functions for the counting functions when n is odd and relatively prime to p, or when n = 2m for odd m and p = 2. In 2015, Cesmelioglu and Meidl presented the generating functions when n is even and relatively prime to p for odd p. In this paper, we extend previous results and propose the generic generating functions for the counting functions for arbitrary n and p. In particular, the respective numbers of bent functions and semi-bent functions are determined.

In this paper, we consider a variant of RSA schemes called Prime Power RSA with modulus N = prq for r ≥ 2, where p, q are of the same bit-size. May showed that when private exponent \(d < {N^{\frac{r}{{{{\left( {r + 1} \right)}^2}}}}}\) or \(d < {N^{{{\left( {\frac{{r - 1}}{{r + 1}}} \right)}^2}}}\), N can be factored in polynomial time in PKC 2004. Later in 2014, Sarkar improved the bound for r ≤ 5. We propose a new cryptanalytic method to attack this RSA variant when given two pairs of public and private exponents, namely (e1, d1) and (e2, d2) with the same modulus N. Suppose that we know d1 < Nδ1 and d2 < Nδ2. Our results show that when \({\delta _1}{\delta _2} < {\left( {\frac{{r - 1}}{{r + 1}}} \right)^3}\), Prime Power RSA is insecure.

In this paper, we study the security of multi-prime RSA with small prime difference and propose two improved factoring attacks. The modulus involved in this variant is the product of r distinct prime factors of same bit-size. Zhang and Takagi (ACISP 2013) showed a Fermat-like factoring attack on multi-prime RSA. In order to improve the previous result, we gather more information about the prime factors to derive r simultaneous modular equations. The first attack is based on combining r equations to solve one multivariate modular equation by a generic lattice approach. Since the equation form is similar to multi-prime \(\varPhi \)-hiding problem, we propose the second attack by applying the optimal linearization technique. We also show that our attacks can achieve better bounds in the experiments.

In this paper, we demonstrate that there exist weak keys in the RSA public-key cryptosystem with the public exponent $e=N^\alpha\leq N^{0.5}$. In 1999, Boneh and Durfee showed that when $\alpha\approx 1$ and the private exponent $d=N^\beta＜N^{0.292}$, the system is insecure. Moreover, their attack is still effective for $0.5＜\alpha＜1.875$. We propose a generalized cryptanalytic method to attack the RSA cryptosystem with $\alpha\leq 0.5$. For $c=\lfloor\frac{1-\alpha}{\alpha}\rfloor$ and $e^{\gamma c}\equiv d\pmod{e^c}$, when $\gamma$, $\beta$ satisfy $\gamma ＜ 1+\frac{1}{c}-\frac{1}{2\alpha c}$ and $\beta ＜\alpha c+\frac{7}{6}-\alpha\gamma c-\frac{1}{3}\sqrt{6\alpha+6\alpha c+1-6\alpha\gamma c}$, we can perform cryptanalytic attacks based on the LLL algorithm. The basic idea is an application of Coppersmiths techniques and we further adapt the technique of unravelled linearization, which leads to an optimized lattice. Our advantage is that we achieve new attacks on RSA with $\alpha\leq0.5$ and consequently, there exist weak keys in RSA for most $\alpha$.