Band 17, Heft 1

Plactic key agreement is a new type of cryptographic key agreement that uses Knuth’s multiplication of semistandard tableaux from combinatorial algebra. The security of plactic key agreement relies on the difficulty of some computational problems, particularly the division of semistandard tableaux. Tableau division can be used to find the private key from its public key or to find the shared secret from the two exchanged public keys. Monico found a fast division algorithm, which could be a polynomial time in the length of the tableaux. Monico’s algorithm solved a challenge that had been previously estimated to cost 2 128 steps to break, which is an infeasibly large number for any foreseeable computing power on earth. Monico’s algorithm solves this challenge in only a few minutes. Therefore, Monico’s attack likely makes the plactic key agreement insecure. If it were not for Monico’s attack, plactic key agreement with 1,000-byte public keys might perhaps have provided 128-bit security, with a runtime of a millisecond. But Monico’s attack breaks these public keys’ sizes in minutes.

In this article, we analyze two digital signature schemes, proposed in Moldovyan et al., that use finite noncommutative associative algebras as underlying platforms. We prove that these schemes do not possess the claimed property of being quantum safe. We also show that in many cases these schemes are, in fact, vulnerable to “classical” algebraic cryptanalysis.

In CANDARW ’18, Isobe et al. proposed a secure encryption protocol on non-abelian groups based on the Anshel–Anshel–Goldfeld key exchange protocol. There have remained two weak points on the protocol: one is that the protocol is indistinguishable against adaptive chosen ciphertext attack (IND-CCA) in a slightly restricted sense, what they call IND-rCCA secure, and the other is that the conditions imposed on groups and hashing schemes are too strict to make the protocol practical. In this article, we propose an IND-CCA secure protocol that resolves those problems. The key idea is to employ some specific semidirect product as platform groups, so that we can achieve the exact IND-CCA security from concise conditions on groups and hashing schemes. Our protocol is not dependent on any computational assumptions on abelian subgroups.

A key encapsulation mechanism ( KEM {\mathsf{KEM}} ) that takes as input an arbitrary string, i.e., a tag, is known as tag- KEM {\mathsf{KEM}} , while a scheme that combines signature and encryption is called signcryption. In this article, we present a code-based signcryption tag- KEM {\mathsf{KEM}} scheme. We utilize a code-based signature and an IND - CCA2 {\mathsf{IND}}\hspace{0.1em}\text{-}\hspace{0.1em}{\mathsf{CCA2}} (adaptive chosen ciphertext attack) secure version of McEliece’s encryption scheme. The proposed scheme uses an equivalent subcode as a public code for the receiver, making the NP-completeness of the subcode equivalence problem be one of our main security assumptions. We then base the signcryption tag- KEM {\mathsf{KEM}} to design a code-based hybrid signcryption scheme. A hybrid scheme deploys asymmetric- as well as symmetric-key encryption. We give security analyses of both our schemes in the standard model and prove that they are secure against IND - CCA2 {\mathsf{IND}}\hspace{0.1em}\text{-}\hspace{0.1em}{\mathsf{CCA2}} (indistinguishability under adaptive chosen ciphertext attack) and SUF - CMA {\mathsf{SUF}}\hspace{0.1em}\text{-}\hspace{0.1em}{\mathsf{CMA}} (strong existential unforgeability under chosen message attack).

Recent lightweight hardware-based stream cipher designs keep an external non-volatile internal state that is not part of the cipher’s hardware module. The purpose of these so-called small-state ciphers is to keep the size of the hardware and the power consumption low. We propose a random oracle model for stream ciphers. This will allow us to analyse the recent small-state stream cipher designs’ resistance against generic attacks and, in particular, time-memory-data tradeoff attacks. We analyse the conventional construction underlying stream ciphers like Grain and Trivium, constructions continuously using the external non-volatile secret key during keystream generation like Sprout, Plantlet, Fruit, and Atom, constructions continuously using the external non-volatile IV, and constructions using a combination of the IV and the key like DRACO. We show the tightness of all bounds by first presenting the time-memory-data tradeoff attacks on the respective constructions, establishing the upper bound on security, and then presenting the proof of security to establish the lower bound on security. In this work, we extend the theoretical work done by Hamann et al. who introduced the DRACO stream cipher at FSE 2023. We use the same random oracle model as the aforementioned work and apply it to the earlier work by Hamann et al. presented at SAC 2019, which showed security for two of the four constructions we consider in this work. Our model is equivalent but allows for a much simpler proof of security. Furthermore, we provide a proof of security for stream ciphers continuously using the secret key during keystream generation, giving upper and lower bounds for all four generic stream cipher constructions proposed so far.

In this article, all multipartite access structures obtained from uniform integer polymatroids were investigated using the method developed by Farràs, Martí-Farré, and Padró. They are matroid ports, i.e., they satisfy the necessary condition to be ideal. Moreover, each uniform integer polymatroid defines some ideal access structures. Some objects in this family can be useful for the applications of secret sharing. The method presented in this article is universal and can be continued with other classes of polymatroids in further similar studies. Here, we are especially interested in hierarchy of participants determined by the access structure, and we distinguish two main classes: they are compartmented and hierarchical access structures. The main results obtained for access structures determined by uniform integer polymatroids and a monotone increasing family Δ \Delta can be summarized as follows. If the increment sequence of the polymatroid is non-constant, then the access structure is connected. If Δ \Delta does not contain any singletons or the height of the polymatroid is maximal and its increment sequence is not constant starting from the second element, then the access structure is compartmented. If Δ \Delta is generated by a singleton or the increment sequence of the polymatroid is constant starting from the second element, then the obtained access structures are hierarchical. They are proven to be ideal, and their hierarchical orders are completely determined. Moreover, if the increment sequence of the polymatroid is constant and ∣ Δ ∣ > 1 | \Delta | \gt 1 , then the hierarchical order is not antisymmetric, i.e., some different blocks are equivalent. The hierarchical order of access structures obtained from uniform integer polymatroids is always flat, that is, every hierarchy chain has at most two elements.

The notion of confusion coefficient (CC) is a property that attempts to characterize the confusion property of cryptographic algorithms against differential power analysis. In this article, we establish a relationship between CC and the transparency order (TO) for any Boolean function and deduce some relationships between the sum-of-squares of CC, signal-to-noise ratio, and TO. We also give a tight upper bound and a tight lower bound on the sum-of-squares of CC for balanced s-plateaued functions. Finally, the results generalized a lower bound on the sum-of-squares of CC of Boolean functions with the Hamming weight k .