Search

In this work we study a new information theoretic problem, called online merging, that has direct applications for constructing public-state accumulators and registration-based encryption schemes. An {online merger} receives the sequence of sets {1}, {2}, … in an online way, and right after receiving {i}, it can re-partition the elements 1,…,i into T₁,…,T_{m_i} by merging some of these sets. The goal of the merger is to balance the trade-off between the maximum number of sets wid = max_{i ∈ [n]} m_i that co-exist at any moment, called the width of the scheme, with its depth dep = max_{i ∈ [n]} d_i, where d_i is the number of times that the sets that contain i get merged. An online merger can be used to maintain a set of Merkle trees that occasionally get merged. An online merger can be directly used to obtain public-state accumulators (using collision-resistant hashing) and registration-based encryptions (relying on more assumptions). Doing so, the width of an online merger translates into the size of the public-parameter of the constructed scheme, and the depth of the online algorithm corresponds to the number of times that parties need to update their "witness" (for accumulators) or their decryption key (for RBE). In this work, we construct online mergers with poly(log n) width and O(log n / log log n) depth, which can be shown to be optimal for all schemes with poly(log n) width. More generally, we show how to achieve optimal depth for a given fixed width and to achieve a 2-approximate optimal width for a given depth d that can possibly grow as a function of n (e.g., d = 2 or d = log n / log log n). As applications, we obtain accumulators with O(log n / log log n) number of updates for parties' witnesses (which can be shown to be optimal for accumulator digests of length poly(log n)) as well as registration based encryptions that again have an optimal O(log n / log log n) number of decryption updates, resolving the open question of Mahmoody, Rahimi, Qi [TCC'22] who proved that Ω(log n / log log n) number of decryption updates are necessary for any RBE (with public parameter of length poly(log n)). More generally, for any given number of decryption updates d = d(n) (under believable computational assumptions) our online merger implies RBE schemes with public parameters of length that is optimal, up to a constant factor that depends on the security parameter. For example, for any constant number of updates d, we get RBE schemes with public parameters of length O(n^{1/(d+1)})., LIPIcs, Vol. 267, 4th Conference on Information-Theoretic Cryptography (ITC 2023), pages 15:1-15:23

The idea of Smart contracts foresees the possibility of automating contractual clauses using hardware and software tools and devices. One of the main perspectives of their implementation is the automation of interactions such as bets, collaterals, prediction markets, insurances. As blockchain platforms, such as Ethereum, offer very strong guarantees of untampered, deterministic execution, that can be exploited as smart contracts substrate, the problem of how to provide reliable information from the “outside world” into the contracts becomes central. In this article, we propose a system based on a Merkle tree representation of structured documents (such as all XML), with which it is possible to generate compact proofs on the content of web documents. The proofs can then be efficiently checked on-chain by a smart contract, to trigger contract action. We provide an end-to-end proof of concept, applying it to real use case scenarios, which allows us to give an estimate of the costs.

Given 2n-to-n compression functions h₁,h₂,h₃, we build a new 5n-to-n compression function T₅, using only 3 compression calls: T₅(m₁, m₂, m₃, m₄, m₅) : = h₃(h₁(m₁, m₂)⊕ m₅ , h₂(m₃, m₄)⊕ m₅) ⊕ m₅ We prove that this construction matches Stam’s bound, by providing Õ(q²/2ⁿ) collision security and O(q³/2^{2n}+ nq/2ⁿ) preimage security (the latter term dominates in the region of interest, when q < 2^{n/2}). In particular, it provides birthday security for hashing 5 inputs using three 2n-to-n compression calls, instead of only 4 inputs in prior constructions. Thus, we get a sequential variant of the Merkle-Damgård (MD) hashing, where t message blocks are hashed using only 3t/4 calls to the 2n-to-n compression functions; a 25% saving over traditional hash function constructions. This time reduces to t/4 (resp. t/2) sequential calls using 3 (resp. 2) parallel execution units; saving a factor of 4 (resp. 2) over the traditional MD-hashing, where parallelism does not help to process one message. We also get a novel variant of a Merkle tree, where t message blocks can be processed using 0.75(t-1) compression function calls and depth 0.86 log₂ t, thereby saving 25% in the number of calls and 14% in the update time over Merkle trees. We provide two modes for a local opening of a particular message block: conservative and aggressive. The former retains the birthday security, but provides longer proofs and local verification time than the traditional Merkle tree. For the aggressive variant, we reduce the proof length to a 29% overhead compared to Merkle trees (1.29log₂ t vs log₂ t), but the verification time is now 14% faster (0.86log₂ t vs log₂ t). However, birthday security is only shown under a plausible conjecture related to the 3-XOR problem, and only for the (common, but not universal) setting where the root of the Merkle tree is known to correspond to a valid t-block message., LIPIcs, Vol. 199, 2nd Conference on Information-Theoretic Cryptography (ITC 2021), pages 24:1-24:23

In recent years, there has been a substantial amount of research on quantum computers – machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult or intractable for conventional computers. The possibility of quantum attacks formed a new chapter in cryptology field – postquantum cryptology, where DSA schemes became one of the main research vectors. The most representative samples are schemes based on hash transformations. Hash-based signature schemes were developed as one-time signature schemes in the late 1970s by Lamport and extended to more signatures by Merkle. In further more complicated schemes were introduced. NIST declared about the competition of new postquantum standards both for encryption (key generation) and signatures As for the 2nd round there are 9 Digital signature candidates. SPHINCS+ (former SPHINCS) is in the list. The algorithm can be briefly described as a stateless hash-based signature scheme. It uses many components from XMSS but works with larger keys and signature to eliminate state. The scheme can be used with different hash functions. The main goal of this paper is to analyze the application of the national standard hash function the scheme of the NIST submission candidate SPHINCS+. The research showed the national standard hash could be applied to the seed randomness generation and hashing the input message. Since Kupyna function returns fixed-size output, its application looks similar to SHA-256 hashes., В последние годы проведено значительное количество исследований по квантовым компьютерам, использующим квантово-механические явления для решения математических задач, которые являются сложными или неразрешимыми для обычных компьютеров. Возможность квантовых атак сформировала новую главу в области криптологии – постквантовую криптологию, где схемы ЭЦП стали одним из основных векторов исследований. Наиболее представительными выборками являются схемы, основанные на хэш-преобразованиях. Схемы подписи на основе хэша разработаны Лемпортом в качестве схемы одноразовой подписи в конце 1970-х годов и расширены для большего числа подписей Мерклом. В дальнейшем были введены более сложные схемы. NIST объявил о конкурсе новых стандартов постквантовой криптографии как для шифрования (генерации ключей), так и для подписей. На 2-й тур претендуют 9 кандидатов цифровой подписи. SPHINCS + (бывший SPHINCS) находится в списке. Алгоритм может быть кратко описан как схема подписи на основе хэша без сохранения состояния. Он использует много компонентов из XMSS, но работает с большими ключами и сигнатурой для устранения состояния. Схема может быть использована с различными хеш-функциями. Цель статьи – проанализировать применение хэш-функции национального стандарта в схеме кандидата NIST-кандидата SPHINCS +. Исследование показало, что хэш национального стандарта может быть применен к генерации случайных чисел и хешированию входного сообщения. Поскольку функция Kupyna возвращает выходные данные фиксированного размера, ее применение выглядит подобно хэш-функции SHA-256., В останні роки проведено значну кількість досліджень квантових комп'ютерів – машин, які використовують квантові механічні явища для вирішення математичних задач, важких або нерозв'язних для звичайних комп'ютерів. Можливість квантових атак сформувала нову главу в галузі криптології – постквантову криптологію, де схеми DSA стали одним з основних векторів досліджень. Найбільш репрезентативними вибірками є схеми, засновані на хеш-перетвореннях. Схеми підписів Лемпорта на основі хешу були розроблені як одноразові схеми підпису в кінці 1970-х і розширені Меркле на багаторазові підписи. Надалі були запроваджені складніші схеми. NIST заявив про конкуренцію нових стандартів potquantum як для шифрування (генерації ключів), так і для підписів. У ІІ турі є 9 кандидатів у цифровий підпис. SPHINCS + (колишній SPHINCS) є у списку. Алгоритм можна коротко охарактеризувати як схему підписів без збереження стану. Він використовує багато компонентів з XMSS, але працює з більшими ключами та підписом для усунення стану. Схему можна використовувати з різними хеш-функціями. Мета роботи – проаналізувати застосування національної стандартної хеш-функції схеми кандидата, що подає NIST SPHINCS +. Дослідження показало, що національний стандарт хеш може бути застосований до генерації випадкових випадків насіння та хешування вхідного повідомлення. Оскільки Fuction fuction повертає вихід фіксованого розміру, його застосування виглядає аналогічно хешам SHA-256.

Most recent CRDT techniques rely on a causal broadcast primitive to provide guarantees on the delivery of operation deltas. Such a primitive is unfortunately hard to implement efficiently in large open networks, whose membership is often difficult to track. As an alternative, we argue in this paper that pure state-based CRDTs can be efficiently implemented by encoding states as specialized Merkle trees, and that this approach is well suited to open networks where many nodes may join and leave. At the core of our contribution lies a new kind of Merkle tree, called Merkle Search Tree (MST), that implements a balanced search tree while maintaining key ordering. This latter property makes it particularly efficient in the case of updates on sets of sequential keys, a common occurrence in many applications. We use this new data structure to implement a distributed event store, and show its efficiency in very large systems with low rates of updates. In particular, we show that in some scenarios our approach is able to achieve both a 66% reduction of bandwidth cost over a vector-clock approach, as well as a 34% improvement in consistency level. We finally suggest other uses of our construction for distributed databases in open networks.

Классические подходы к построению режимов работы хэш-функций, основанные на использовании итеративных процедур, не позволяют обеспечить эффективную обработку больших объемов данных и не могут быть адаптированы к параллельным вычислительным архитектурам. Это касается как российского криптографического стандарта ГОСТ Р 34.11-2012, определяющего алгоритм и процедуру вычисления хэш-функции, так и многих других зарубежных стандартов (например, SHA-3). Отсутствие действующих стандартов в части режимов работы хэш-функций ГОСТ Р 34.11-2012 создает острую необходимость разработки отечественного стандарта параллелизуемого режима выработки хэш-кода. Настоящая статья посвящена исследованию и разработке новых режимов выработки хэш-кода, допускающих эффективное распараллеливание процесса вычислений и обеспечивающих криптографическую стойкость, удовлетворяющую современным требованиям. Данная работа продолжает исследования, проводимые авторами, и предлагает принципиально новый универсальный древовидный режим выработки хэш-кода («FT-режим»), построенный на основе l-арных деревьев хэширования и позволяющий применять в качестве механизма формирования узлов дерева любое сжимающее отображение. При этом стойкость режима полностью определяется стойкостью соответствующего сжимающего отображения. Так, в частности, для формирования узлов дерева хэширования, наряду с функциями сжатия и хэш-функциями, FT-режим допускает использование блочных шифров, подстановочных преобразований и т.д. В дополнение к этому FT-режим исключает основные функциональные недостатки известных древовидных режимов выработки хэш-кода, влияющие на их эксплуатационно-технические и криптографические качества. В рамках настоящих исследований вычислен ряд характеристик FT-режима, а также проведен сравнительный анализ временной и вычислительной трудоемкостей реализаций FT-режима и некоторых иностранных режимов древовидного хэширования, по результатам которого разработанный режим не уступает ни одному из рассмотренных., Classical approaches to the construction of hash function modes, based on the using of iterative procedures, do not allow efficient processing of large amounts of data and can’t be adapted to parallel computing architectures. It applies to both the Russian cryptographic standard GOST R 34.11-2012, which determines the algorithm and procedure for calculating the hash function, as well as many other foreign standards (for example, SHA-3). The absence of standards for parallelized modes for the hash functions of GOST R 34.11-2012 creates an urgent need for the development of the domestic standard of the parallelized mode of hash code. This article is devoted to the research and development of new modes of hash code generation that allow efficient parallelization of the computation process and provide cryptographic resistance satisfying modern requirements. This work continues the research carried out by the authors, and offers a fundamentally new tree mode of hash code generation ("FT-mode"), based on l-ary hash trees and allowed to use any compression mapping for a mechanism of forming tree nodes. The resistance of the mode is completely determined by the resistance of the corresponding compressive mapping. In particular, the FT-mode allows using block ciphers and substitution transformations to form nodes of a hash tree along with compression functions and hash functions. In addition, the FT-mode excludes the main functional disadvantages of the known tree modes of hash code generation that affect their operational, technical and cryptographic quality. Within the framework of the present research a number of characteristics of FT-mode are calculated, and a comparative analysis of the time and computational complexity of implementations of FT-mode and some foreign tree hash modes is carried out. The corresponding results showed that the developed mode is not inferior to any of the considered modes., №2 (2018)

To achieve high availability in the face of network partitions, many distributed databases adopt eventual consistency, allow temporary conflicts due to concurrent writes, and use some form of per-key logical clock to detect and resolve such conflicts. Furthermore, nodes synchronize periodically to ensure replica convergence in a process called anti-entropy, normally using Merkle Trees. We present the design of DottedDB, a Dynamo-like key-value store, which uses a novel node-wide logical clock framework, overcoming three fundamental limitations of the state of the art: (1) minimize the metadata per key necessary to track causality, avoiding its growth even in the face of node churn; (2) correctly and durably delete keys, with no need for tombstones; (3) offer a lightweight anti-entropy mechanism to converge replicated data, avoiding the need for Merkle Trees. We evaluate DottedDB against MerkleDB, an otherwise identical database, but using per-key logical clocks and Merkle Trees for anti-entropy, to precisely measure the impact of the novel approach. Results show that: causality metadata per object always converges rapidly to only one id-counter pair; distributed deletes are correctly achieved without global coordination and with constant metadata; divergent nodes are synchronized faster, with less memory-footprint and with less communication overhead than using Merkle Trees., This work is financed by the ERDF – European Regional Development Fund through the Operational Programme for Competitiveness and Internationalisation - COMPETE 2020 Programme within project «POCI-01-0145-FEDER-006961», and by National Funds through the Portuguese funding agency, FCT - Fundação para a Ciência e a Tecnologia as part of project «UID/EEA/50014/2013»., info:eu-repo/semantics/publishedVersion

Discussions about the choice of a tree hash mode of operation for a standardization have recently been undertaken. It appears that a single tree mode cannot address adequately all possible uses and specifications of a system. In this paper, we review the tree modes which have been proposed, we discuss their problems and propose solutions. We make the reasonable assumption that communicating systems have different specifications and that software applications are of different types (securing stored content or live-streamed content). Finally, we propose new modes of operation that address the resource usage problem for three representative categories of devices and we analyse their asymptotic behavior., IACR Transactions on Symmetric Cryptology, Volume 2017, Issue 4

Master's thesis in Computer science INTRODUCTION: Although hash functions are nothing new, these are not limited to cryptographic purposes. One important field is data fingerprinting. Here, the purpose is to generate a digest which serves as a fingerprint (or a license plate) that uniquely identifies a file. More recently, fuzzy fingerprinting schemes — which will scrap the avalanche effect in favour of detecting local changes — has hit the spotlight. The main purpose of this project is to find ways to classify text tables, and discover where potential changes or inconsitencies have happened. METHODS: Large parts of this report can be considered applied discrete mathematics — and finite fields and combinatorics have played an important part. Rabin’s fingerprinting scheme was tested extensively and compared against existing cryptographic algorithms, CRC and FNV. Moreover, a self-designed fuzzy hashing algorithm with the preliminary name No-Frills Hash has been created and tested against Nilsimsa and Spamsum. NFHash is based on Mersenne primes, and uses a sliding window to create a fuzzy hash. Futhermore, the usefullness of lookup tables (with partial seeds) were also explored. The fuzzy hashing algorithm has also been combined with a k-NN classifier to get an overview over it’s ability to classify files. In addition to NFHash, Bloom filters combined with Merkle Trees have been the most important part of this report. This combination will allow a user to see where a change was made, despite the fact that hash functions are one-way. Large parts of this project has dealt with the study of other open-source libraries and applications, such as Cassandra and SSDeep — as well as how bitcoins work. Optimizations have played a crucial role as well; different approaches to a problem might lead to the same solution, but resource consumption can be very different. RESULTS: The results have shown that the Merkle Tree-based approach can track changes to a table very quickly and efficiently, due to it being conservative when it comes to CPU resources. Moreover, the self-designed algorithm NFHash also does well in terms of file classification when it is coupled with a k-NN classifyer. CONCLUSION: Hash functions refers to a very diverse set of algorithms, and not just algorithms that serve a limited purpose. Fuzzy Fingerprinting Schemes can still be considered to be at their infant stage, but a lot has still happened the last ten years. This project has introduced two new ways to create and compare hashes that can be compared to similar, yet not necessarily identical files — or to detect if (and to what extent) a file was changed. Note that the algorithms presented here should be considered prototypes, and still might need some large scale testing to sort out potential flaws

This dissertation proposes an efficient representation of a sparse Merkle tree (SMT): an authenticated data structure that supports logarithmic insertion, removal, and look-up in a verifiable manner. The proposal is general in the sense that it can be implemented using a variety of underlying non-authenticated data structures, and it allows trading time for space by the use of an abstract model which represents caching strategies. Both theoretical evaluations and performance results from a proof-of-concept implementation are provided, and the proposed SMT is applied to another authenticated data structure referred to as Balloon. The resulting Balloon has preserved efficiency in the expected case, and is improved with respect to worst case scenarios.

During the past few years, computer systems (Cloud Computing, embedded systems...) have become ubiquitous. Most of these systems use unreliable or untrusted storage (flash, RAM...)to store code or data. The confidentiality and integrity of these data can be threaten by hardware (spying on the communication bus between the processing component and the storage component) or software attacks. These attacks can disclose sensitive information to the adversary or disturb the behavior of the system. In this thesis, in the context of embedded systems, we focused on the attacks that threaten the confidentiality and integrity of data that are transmittedover the memory bus or that are stored inside the memory. Several primitives used to protect the confidentiality and integrity of data have been proposed in the literature, including Merkle trees, a data structure that can protect the integrity of data including against replay attacks. However, these trees have a large impact on the performances and the memory footprint of the system. In this thesis, we propose a solution based on variants of Merkle trees (hollow trees) and a modified cache management mechanism to greatly reduce the impact of the verification of the integrity. The performances of this solution have been evaluated both theoretically and in practice using simulations. In addition, a proof a security equivalence with regular Merkle treesis given. Finally, this solution has been implemented in the SecBus architecture which aims at protecting the integrity and confidentiality of the content of external memories in an embedded system. A prototype of this architecture has been developed and the results of its evaluation are given., Ces dernières années, les systèmes informatiques (Cloud Computing, systèmes embarqués, etc.) sont devenus omniprésents. La plupart de ces systèmes utilisent des espaces de stockage (flash,RAM, etc.) non fiables ou non dignes de confiance pour stocker du code ou des données. La confidentialité et l’intégrité de ces données peuvent être menacées par des attaques matérielles (espionnage de bus de communication entre le composant de calcul et le composant de stockage) ou logicielles. Ces attaques peuvent ainsi révéler des informations sensibles à l’adversaire ou perturber le bon fonctionnement du système. Dans cette thèse, nous nous sommes focalisés, dans le contexte des systèmes embarqués, sur les attaques menaçant la confidentialité et l’intégrité des données qui transitent sur le bus de communication avec la mémoire ou qui sont stockées dans celle-ci.Plusieurs primitives de protection de confidentialité et d’intégrité ont déjà été proposées dans la littérature, et notamment les arbres de Merkle, une structure de données protégeant efficacement l’intégrité des données notamment contre les attaques par rejeu. Malheureusement,ces arbres ont un impact important sur les performances et sur l’empreinte mémoire du système.Dans cette thèse, nous proposons une solution basée sur des variantes d’arbres de Merkle (arbres creux) et un mécanisme de gestion adapté du cache afin de réduire grandement l’impact de la vérification d’intégrité d’un espace de stockage non fiable. Les performances de cette solution ont été évaluées théoriquement et à l’aide de simulations. De plus, une preuve est donnée de l’équivalence, du point de vue de la sécurité, avec les arbres de Merkle classiques.Enfin, cette solution a été implémentée dans le projet SecBus, une architecture matérielle et logicielle ayant pour objectif de garantir la confidentialité et l’intégrité du contenu des mémoires externes d’un système à base de microprocesseurs. Un prototype de cette architecture a été réalisé et les résultats de l’évaluation de ce dernier sont donnés.