Journal of Mathematical Cryptology

ISSN: 1862-2984

First published: January 25, 2007

Editor-in-chief: Timothy Hodges

About this journal

Objective
The Journal of Mathematical Cryptology (JMC) is a forum for original research articles in the area of mathematical cryptology. JMC is a fully peer-reviewed, open access, electronic-only journal publishing works of wide significance, originality and relevance. Works in the theory of cryptology and articles linking mathematics with cryptology (including quantum cryptology) are welcome. Submissions from all areas of mathematics significant for cryptology are invited, including but not limited to, algebra, algebraic geometry, coding theory, combinatorics, number theory, probability and stochastic processes

The scope includes mathematical results of algorithmic or computational nature that are of interest to cryptology. While JMC does not cover information security as a whole, the submission of manuscripts on information security with a strong mathematical emphasis is explicitly encouraged.

Topics

Mathematical cryptology
Information security
Theory of cryptology
Quantum cryptology
Algebra
Algebraic geometry
Coding theory
Combinatorics and Graph Theory
Number theory
Probability and stochastic processes
theory of cryptology
work linking math to cryptology
work in the mathematical foundations of crypto

Article formats
Original research articles

Information on Submission Process

Your Benefits

Beginning in January 2021 all articles published in the JMC will be subject to a voluntary Article Processing Charge (APC). There are NO submission charges. Article Processing Charges will apply after the acceptance of a manuscript. For more details please check Article Processing Charges.

Your benefits

Authors benefit from critical peer review and promotion of published papers to readers and citers.
The journal uses a continuous publication model - accepted manuscripts are published quickly after acceptance.
Thanks to Open Access, all articles are freely available to the academic community worldwide without any restrictions. Authors also benefit from more liberal policies on copyrights (authors retain copyright) and on self-archiving (no embargo periods).
The journal is archived in Portico.

Abstracting and Indexing

Journal of Mathematical Cryptology is covered by the following services:

Baidu Scholar
Cabells Journalytics
Chronos Hub
CNKI Scholar (China National Knowledge Infrastructure)
CNPIEC - cnpLINKer
DBLP Computer Science Bibliography
Dimensions
DOAJ (Directory of Open Access Journals)
EBSCO (relevant databases)
EBSCO Discovery Service
Engineering Village
Genamics JournalSeek
Google Scholar
Inspec
Japan Science and Technology Agency (JST)
J-Gate
JournalGuide
JournalTOCs
KESLI-NDSL (Korean National Discovery for Science Leaders)
Mathematical Reviews (MathSciNet)
Microsoft Academic
MyScienceWork
Naver Academic
Naviga (Softweco)
Norwegian Register for Scientific Journals, Series and Publishers
Primo Central (ExLibris)
ProQuest (relevant databases)
Publons
QOAM (Quality Open Access Market)
ReadCube
Reaxys
SCImago (SJR)
SCOPUS
Semantic Scholar
Sherpa/RoMEO
Summon (ProQuest)
TDNet
Ulrich's Periodicals Directory/ulrichsweb
WanFang Data
Web of Science - Emerging Sources Citation Index
WorldCat (OCLC)
Yewno Discover
zbMATH Open

Supplementary Materials

Topics

External Links

Volume 15 Issue 1

January 2021

MathCrypt 2019

Editor’s Preface for the Second Annual MathCrypt Proceedings Volume

Jung Hee Cheon, Kristin Lauter, Yongsoo Song November 17, 2020 Page range: 1-3

Cite
Open Access PDF PDF

A trade-off between classical and quantum circuit size for an attack against CSIDH

Jean-François Biasse, Xavier Bonnetain, Benjamin Pring, André Schrottenloher, William Youmans November 17, 2020 Page range: 4-17

More Cite
Open Access PDF PDF

Abstract

We propose a heuristic algorithm to solve the underlying hard problem of the CSIDH cryptosystem (and other isogeny-based cryptosystems using elliptic curves with endomorphism ring isomorphic to an imaginary quadratic order 𝒪). Let Δ = Disc(𝒪) (in CSIDH, Δ = −4 p for p the security parameter). Let 0 < α < 1/2, our algorithm requires: A classical circuit of size 2O˜log(|Δ|)1−α. $2^{\tilde{O}\left(\log(|\Delta|)^{1-\alpha}\right)}.$ A quantum circuit of size 2O˜log(|Δ|)α. $2^{\tilde{O}\left(\log(|\Delta|)^{\alpha}\right)}.$ Polynomial classical and quantum memory. Essentially, we propose to reduce the size of the quantum circuit below the state-of-the-art complexity 2O˜log(|Δ|)1/2 $2^{\tilde{O}\left(\log(|\Delta|)^{1/2}\right)}$ at the cost of increasing the classical circuit-size required. The required classical circuit remains subexponential, which is a superpolynomial improvement over the classical state-of-the-art exponential solutions to these problems. Our method requires polynomial memory, both classical and quantum.

Towards Isogeny-Based Password-Authenticated Key Establishment

Oleg Taraskin, Vladimir Soukharev, David Jao, Jason T. LeGrow November 17, 2020 Page range: 18-30

More Cite
Open Access PDF PDF

Abstract

Password authenticated key establishment (PAKE) is a cryptographic primitive that allows two parties who share a low-entropy secret (a password) to securely establish cryptographic keys in the absence of public key infrastructure. We propose the first quantum-resistant password-authenticated key exchange scheme based on supersingular elliptic curve isogenies. The scheme is built upon supersingular isogeny Diffie-Hellman [15], and uses the password to generate permutations which obscure the auxiliary points. We include elements of a security proof, and discuss roadblocks to obtaining a proof in the BPR model [1]. We also include some performance results.

Algebraic approaches for solving isogeny problems of prime power degrees

Yasushi Takahashi, Momonari Kudo, Ryoya Fukasaku, Yasuhiko Ikematsu, Masaya Yasuda, Kazuhiro Yokoyama November 17, 2020 Page range: 31-44

More Cite
Open Access PDF PDF

Abstract

Recently, supersingular isogeny cryptosystems have received attention as a candidate of post-quantum cryptography (PQC). Their security relies on the hardness of solving isogeny problems over supersingular elliptic curves. The meet-in-the-middle approach seems the most practical to solve isogeny problems with classical computers. In this paper, we propose two algebraic approaches for isogeny problems of prime power degrees. Our strategy is to reduce isogeny problems to a system of algebraic equations, and to solve it by Gröbner basis computation. The first one uses modular polynomials, and the second one uses kernel polynomials of isogenies. We report running times for solving isogeny problems of 3-power degrees on supersingular elliptic curves over 𝔽 p 2 with 503-bit prime p , extracted from the NIST PQC candidate SIKE. Our experiments show that our first approach is faster than the meet-in-the-middle approach for isogeny degrees up to 3 10 .

Discretisation and Product Distributions in Ring-LWE

Sean Murphy, Rachel Player November 17, 2020 Page range: 45-59

More Cite
Open Access PDF PDF

Abstract

A statistical framework applicable to Ring-LWE was outlined by Murphy and Player (IACR eprint 2019/452). Its applicability was demonstrated with an analysis of the decryption failure probability for degree-1 and degree-2 ciphertexts in the homomorphic encryption scheme of Lyubashevsky, Peikert and Regev (IACR eprint 2013/293). In this paper, we clarify and extend results presented by Murphy and Player. Firstly, we make precise the approximation of the discretisation of a Normal random variable as a Normal random variable, as used in the encryption process of Lyubashevsky, Peikert and Regev. Secondly, we show how to extend the analysis given by Murphy and Player to degree- k ciphertexts, by precisely characterising the distribution of the noise in these ciphertexts.

Approximate Voronoi cells for lattices, revisited

Thijs Laarhoven November 17, 2020 Page range: 60-71

More Cite
Open Access PDF PDF

Abstract

We revisit the approximate Voronoi cells approach for solving the closest vector problem with preprocessing (CVPP) on high-dimensional lattices, and settle the open problem of Doulgerakis–Laarhoven–De Weger [PQCrypto, 2019] of determining exact asymptotics on the volume of these Voronoi cells under the Gaussian heuristic. As a result, we obtain improved upper bounds on the time complexity of the randomized iterative slicer when using less than 20.076d+o(d)$2^{0.076d + o(d)}$ memory, and we show how to obtain time–memory trade-offs even when using less than 20.048d+o(d)$2^{0.048d + o(d)}$ memory. We also settle the open problem of obtaining a continuous trade-off between the size of the advice and the query time complexity, as the time complexity with subexponential advice in our approach scales as dd/2+o(d)$d^{d/2 + o(d)}$ matching worst-case enumeration bounds, and achieving the same asymptotic scaling as average-case enumeration algorithms for the closest vector problem.

(In)Security of Ring-LWE Under Partial Key Exposure

Dana Dachman-Soled, Huijing Gong, Mukul Kulkarni, Aria Shahverdi November 17, 2020 Page range: 72-86

More Cite
Open Access PDF PDF

Abstract

We initiate the study of partial key exposure in Ring-LWE (RLWE)-based cryptosystems. Specifically, we (1) Introduce the search and decision Leaky R-LWE assumptions (Leaky R-SLWE, Leaky R-DLWE), to formalize the hardness of search/decision RLWE under leakage of some fraction of coordinates of the NTT transform of the RLWE secret. (2) Present and implement an efficient key exposure attack that, given certain 1/4-fraction of the coordinates of the NTT transform of the RLWE secret, along with samples from the RLWE distribution, recovers the full RLWE secret for standard parameter settings. (3) Present a search-to-decision reduction for Leaky R-LWE for certain types of key exposure. (4) Propose applications to the security analysis of RLWE-based cryptosystems under partial key exposure.

Towards a Ring Analogue of the Leftover Hash Lemma

Dana Dachman-Soled, Huijing Gong, Mukul Kulkarni, Aria Shahverdi November 17, 2020 Page range: 87-110

More Cite
Open Access PDF PDF

Abstract

The leftover hash lemma (LHL) is used in the analysis of various lattice-based cryptosystems, such as the Regev and Dual-Regev encryption schemes as well as their leakage-resilient counterparts. The LHL does not hold in the ring setting, when the ring is far from a field, which is typical for efficient cryptosystems. Lyubashevsky et al . (Eurocrypt ’13) proved a “regularity lemma,” which can be used instead of the LHL, but applies only for Gaussian inputs. This is in contrast to the LHL, which applies when the input is drawn from any high min-entropy distribution. Our work presents an approach for generalizing the “regularity lemma” of Lyubashevsky et al . to certain conditional distributions. We assume the input was sampled from a discrete Gaussian distribution and consider the induced distribution, given side-channel leakage on the input. We present three instantiations of our approach, proving that the regularity lemma holds for three natural conditional distributions.

The Eleventh Power Residue Symbol

Marc Joye, Oleksandra Lapiha, Ky Nguyen, David Naccache November 17, 2020 Page range: 111-122

More Cite
Open Access PDF PDF

Abstract

This paper presents an efficient algorithm for computing 11 th -power residue symbols in the cyclo-tomic field ℚ(ζ11),$ \mathbb{Q}\left( {{\zeta }_{11}} \right), $where 11 is a primitive 11 th root of unity. It extends an earlier algorithm due to Caranay and Scheidler (Int. J. Number Theory, 2010) for the 7 th -power residue symbol. The new algorithm finds applications in the implementation of certain cryptographic schemes.

Factoring with Hints

Francesco Sica November 17, 2020 Page range: 123-130

More Cite
Open Access PDF PDF

Abstract

We introduce a new approach to (deterministic) integer factorisation, which could be described in the cryptographically fashionable term of “factoring with hints”: we prove that, for any ϵ > 0, given the knowledge of the factorisations of O ( N 1/3+ ϵ ) terms surrounding N = pq product of two large primes, we can recover deterministically p and q in O ( N 1/3+ ϵ ) bit operations. This shows that the factorisations of close integers are non trivially related and that consequently one can expect more results along this line of thought.

One Bit is All It Takes: A Devastating Timing Attack on BLISS’s Non-Constant Time Sign Flips

Mehdi Tibouchi, Alexandre Wallet November 17, 2020 Page range: 131-142

More Cite
Open Access PDF PDF

Abstract

As one of the most efficient lattice-based signature schemes, and one of the only ones to have seen deployment beyond an academic setting (e.g., as part of the VPN software suite strongSwan), BLISS has attracted a significant amount of attention in terms of its implementation security, and side-channel vulnerabilities of several parts of its signing algorithm have been identified in previous works. In this paper, we present an even simpler timing attack against it. The bimodal Gaussian distribution that BLISS is named after is achieved using a random sign flip during signature generation, and neither the original implementation of BLISS nor strongSwan ensure that this sign flip is carried out in constant time. It is therefore possible to recover the corresponding sign through side-channel leakage (using, e.g., cache attacks or branch tracing). We show that obtaining this single bit of leakage (for a moderate number of signatures) is in fact sufficient for a full key recovery attack. The recovery is carried out using a maximum likelihood estimation on the space of parameters, which can be seen as a statistical manifold. The analysis of the attack thus reduces to the computation of the Fisher information metric.

A framework for reducing the overhead of the quantum oracle for use with Grover’s algorithm with applications to cryptanalysis of SIKE

Jean-François Biasse, Benjamin Pring November 17, 2020 Page range: 143-156

More Cite
Open Access PDF PDF

Abstract

In this paper we provide a framework for applying classical search and preprocessing to quantum oracles for use with Grover’s quantum search algorithm in order to lower the quantum circuit-complexity of Grover’s algorithm for single-target search problems. This has the effect (for certain problems) of reducing a portion of the polynomial overhead contributed by the implementation cost of quantum oracles and can be used to provide either strict improvements or advantageous trade-offs in circuit-complexity. Our results indicate that it is possible for quantum oracles for certain single-target preimage search problems to reduce the quantum circuit-size from O2n/2⋅ mC$O\left(2^{n/2}\cdot mC\right)$ (where C originates from the cost of implementing the quantum oracle) to O(2n/2⋅ mC)$O(2^{n/2} \cdot m\sqrt{C})$ without the use of quantum ram, whilst also slightly reducing the number of required qubits. This framework captures a previous optimisation of Grover’s algorithm using preprocessing [21] applied to cryptanalysis, providing new asymptotic analysis. We additionally provide insights and asymptotic improvements on recent cryptanalysis [16] of SIKE [14] via Grover’s algorithm, demonstrating that the speedup applies to this attack and impacting upon quantum security estimates [16] incorporated into the SIKE specification [14].

Regular Articles

Secret sharing and duality

Laszlo Csirmaz November 25, 2020 Page range: 157-173

More Cite
Open Access PDF PDF

Abstract

Secret sharing is an important building block in cryptography. All explicit secret sharing schemes which are known to have optimal complexity are multi-linear, thus are closely related to linear codes. The dual of such a linear scheme, in the sense of duality of linear codes, gives another scheme for the dual access structure. These schemes have the same complexity, namely the largest share size relative to the secret size is the same. It is a long-standing open problem whether this fact is true in general: the complexity of any access structure is the same as the complexity of its dual. We give a partial answer to this question. An almost perfect scheme allows negligible errors, both in the recovery and in the independence. There exists an almost perfect ideal scheme on 174 participants whose complexity is strictly smaller than that of its dual.

On the condition number of the Vandermonde matrix of the nth cyclotomic polynomial

Antonio J. Di Scala, Carlo Sanna, Edoardo Signorini November 25, 2020 Page range: 174-178

More Cite
Open Access PDF PDF

Abstract

Recently, Blanco-Chacón proved the equivalence between the Ring Learning With Errors and Polynomial Learning With Errors problems for some families of cyclotomic number fields by giving some upper bounds for the condition number Cond( V n ) of the Vandermonde matrix V n associated to the n th cyclotomic polynomial. We prove some results on the singular values of V n and, in particular, we determine Cond( V n ) for n = 2 k p ℓ , where k , ℓ ≥ 0 are integers and p is an odd prime number.

On the equivalence of authentication codes and robust (2, 2)-threshold schemes

Maura B. Paterson, Douglas R. Stinson November 25, 2020 Page range: 179-196

More Cite
Open Access PDF PDF

Abstract

In this paper, we show a “direct” equivalence between certain authentication codes and robust threshold schemes. It was previously known that authentication codes and robust threshold schemes are closely related to similar types of designs, but direct equivalences had not been considered in the literature. Our new equivalences motivate the consideration of a certain “key-substitution attack.” We study this attack and analyze it in the setting of “dual authentication codes.” We also show how this viewpoint provides a nice way to prove properties and generalizations of some known constructions.

Pseudo-free families of computational universal algebras

Mikhail Anokhin November 25, 2020 Page range: 197-222

More Cite
Open Access PDF PDF

Abstract

Let Ω be a finite set of finitary operation symbols. We initiate the study of (weakly) pseudo-free families of computational Ω -algebras in arbitrary varieties of Ω -algebras. A family ( H d | d ∈ D ) of computational Ω -algebras (where D ⊆ {0, 1} * ) is called polynomially bounded (resp., having exponential size) if there exists a polynomial η such that for all d ∈ D , the length of any representation of every h ∈ H d is at most η(|d|)( resp., |Hd|≤2η(|d|)).$\eta (|d|)\left( \text{ resp}\text{., }\left| {{H}_{d}} \right|\le {{2}^{\eta (|d|)}} \right).$ First, we prove the following trichotomy: (i) if Ω consists of nullary operation symbols only, then there exists a polynomially bounded pseudo-free family; (ii) if Ω = Ω 0 ∪ { ω }, where Ω 0 consists of nullary operation symbols and the arity of ω is 1, then there exist an exponential-size pseudo-free family and a polynomially bounded weakly pseudo-free family; (iii) in all other cases, the existence of polynomially bounded weakly pseudo-free families implies the existence of collision-resistant families of hash functions. In this trichotomy, (weak) pseudo-freeness is meant in the variety of all Ω -algebras. Second, assuming the existence of collision-resistant families of hash functions, we construct a polynomially bounded weakly pseudo-free family and an exponential-size pseudo-free family in the variety of all m -ary groupoids, where m is an arbitrary positive integer.

Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic

Gary McGuire, Oisín Robinson November 25, 2020 Page range: 223-236

More Cite
Open Access PDF PDF

Abstract

Lattice sieving in two dimensions has proven to be an indispensable practical aid in integer factorization and discrete log computations involving the number field sieve. The main contribution of this article is to show that a different method of lattice sieving in three dimensions will provide a significant speedup in medium characteristic. Our method is to use the successive minima and shortest vectors of the lattice instead of transition vectors to iterate through lattice points. We showcase the new method by a record computation in a 133-bit subgroup of Fp6${{\mathbb{F}}_{{{p}^{6}}}}$, with p 6 having 423 bits. Our overall timing is nearly 3 times faster than the previous record of a 132-bit subgroup in a 422-bit field. The approach generalizes to dimensions 4 or more, overcoming one key obstruction to the implementation of the tower number field sieve.

Attack on Kayawood protocol: uncloaking private keys

Matvei Kotov, Anton Menshov, Alexander Ushakov December 1, 2020 Page range: 237-249

More Cite
Open Access PDF PDF

Abstract

We analyze security properties of a two-party key-agreement protocol recently proposed by I. Anshel, D. Atkins, D. Goldfeld, and P. Gunnels, called Kayawood protocol. At the core of the protocol is an action (called E-multiplication ) of a braid group on some finite set. The protocol assigns a secret element of a braid group to each party (private key). To disguise those elements, the protocol uses a so-called cloaking method that multiplies private keys on the left and on the right by specially designed elements (stabilizers for E-multiplication). We present a heuristic algorithm that allows a passive eavesdropper to recover Alice’s private key by removing cloaking elements. Our attack has 100% success rate on randomly generated instances of the protocol for the originally proposed parameter values and for recent proposals that suggest to insert many cloaking elements at random positions of the private key. Implementation of the attack is available on GitHub.

The circulant hash revisited

Filipe Araujo, Samuel Neves December 3, 2020 Page range: 250-257

More Cite
Open Access PDF PDF

Abstract

At ProvSec 2013, Minematsu presented the circulant hash, an almost-xor universal hash using only the xor and rotation operations. The circulant hash is a variant of Carter and Wegman’s H 3 hash as well as Krawczyk’s Toeplitz hash, both of which are hashes based on matrix-vector multiplication over 𝔽 2 . In this paper we revisit the circulant hash and reinterpret it as a multiplication in the polynomial ring 𝔽 2 [ x ]/( x n + 1). This leads to simpler proofs, faster implementations in modern computer chips, and newer variants with practical implementation advantages.

On cryptographic properties of (n + 1)-bit S-boxes constructed by known n-bit S-boxes

Yu Zhou, Daoguang Mu, Xinfeng Dong December 8, 2020 Page range: 258-265

More Cite
Open Access PDF PDF

Abstract

S-box is the basic component of symmetric cryptographic algorithms, and its cryptographic properties play a key role in security of the algorithms. In this paper we give the distributions of Walsh spectrum and the distributions of autocorrelation functions for ( n + 1)-bit S-boxes in [12]. We obtain the nonlinearity of ( n + 1)-bit S-boxes, and one necessary and sufficient conditions of ( n + 1)-bit S-boxes satisfying m -order resilient. Meanwhile, we also give one characterization of ( n + 1)-bit S-boxes satisfying t -order propagation criterion. Finally, we give one relationship of the sum-of-squares indicators between an n -bit S-box S 0 and the ( n + 1)-bit S-box S (which is constructed by S 0 ).

Improved cryptanalysis of a ElGamal Cryptosystem Based on Matrices Over Group Rings

Atul Pandey, Indivar Gupta, Dhiraj Kumar Singh December 20, 2020 Page range: 266-279

More Cite
Open Access PDF PDF

Abstract

ElGamal cryptosystem has emerged as one of the most important construction in Public Key Cryptography (PKC) since Diffie-Hellman key exchange protocol was proposed. However, public key schemes which are based on number theoretic problems such as discrete logarithm problem (DLP) are at risk because of the evolution of quantum computers. As a result, other non-number theoretic alternatives are a dire need of entire cryptographic community. In 2016, Saba Inam and Rashid Ali proposed a ElGamal-like cryptosystem based on matrices over group rings in ‘Neural Computing & Applications’. Using linear algebra approach, Jia et al. provided a cryptanalysis for the cryptosystem in 2019 and claimed that their attack could recover all the equivalent keys. However, this is not the case and we have improved their cryptanalysis approach and derived all equivalent key pairs that can be used to totally break the ElGamal-like cryptosystem proposed by Saba and Rashid. Using the decomposition of matrices over group rings to larger size matrices over rings, we have made the cryptanalysing algorithm more practical and efficient. We have also proved that the ElGamal cryptosystem proposed by Saba and Rashid does not achieve the security of IND-CPA and IND-CCA.

Remarks on a Tropical Key Exchange System

Dylan Rudy, Chris Monico December 20, 2020 Page range: 280-283

More Cite
Open Access PDF PDF

Abstract

We consider a key-exchange protocol based on matrices over a tropical semiring which was recently proposed in [2]. We show that a particular private parameter of that protocol can be recovered with a simple binary search, rendering it insecure.

A note on secure multiparty computation via higher residue symbols

Ignacio Cascudo, Reto Schnyder January 29, 2021 Page range: 284-297

More Cite
Open Access PDF PDF

Abstract

We generalize a protocol by Yu for comparing two integers with relatively small difference in a secure multiparty computation setting. Yu's protocol is based on the Legendre symbol. A prime number p is found for which the Legendre symbol (· | p ) agrees with the sign function for integers in a certain range {− N , . . . , N } ⊂ ℤ. This can then be computed efficiently. We generalize this idea to higher residue symbols in cyclotomic rings ℤ[ ζ r ] for r a small odd prime. We present a way to determine a prime number p such that the r -th residue symbol (· | p ) r agrees with a desired function f:A→{ζr0,…,ζrr−1}f:A \to \left\{ {\zeta _r^0, \ldots ,\zeta _r^{r - 1}} \right\} on a given small subset A ⊂ ℤ[ ζ r ], when this is possible. We also explain how to efficiently compute the r -th residue symbol in a secret shared setting.

Using Inclusion / Exclusion to find Bent and Balanced Monomial Rotation Symmetric Functions

Elizabeth M. Reid January 29, 2021 Page range: 298-304

More Cite
Open Access PDF PDF

Abstract

There are many cryptographic applications of Boolean functions. Recently, research has been done on monomial rotation symmetric (MRS) functions which have useful cryptographic properties. In this paper we use the inclusion/exclusion principle to construct formulas for the weights of two subclasses of MRS functions: degree d short MRS functions and d -functions. From these results we classify bent and balanced functions of these forms.

The Oribatida v1.3 Family of Lightweight Authenticated Encryption Schemes

Arghya Bhattacharjee, Cuauhtemoc Mancillas López, Eik List, Mridul Nandi January 29, 2021 Page range: 305-344

More Cite
Open Access PDF PDF

Abstract

Permutation-based modes have been established for lightweight authenticated encryption, as can be seen from the high interest in the ongoing NIST lightweight competition. However, their security is upper bounded by O ( σ 2 /2 c ) bits, where σ are the number of calls and c is the hidden capacity of the state. The development of more schemes that provide higher security bounds led to the CHES’18 proposal Beetle that raised the bound to O ( rσ /2 c ), where r is the public rate of the state. While authenticated encryption can be performed in an on-line manner, authenticated decryption assumes that the resulting plaintext is buffered and never released if the corresponding tag is incorrect. Since lightweight devices may lack the resources for buffering, additional robustness guarantees, such as integrity under release of unverified plaintexts (I nt -RUP), are desirable. In this stronger setting, the security of the established schemes, including Beetle, is limited by O ( q p q d /2 c ), where q d is the maximal number of decryption queries, and q p that of off-line primitive queries, which motivates novel approaches. This work proposes Oribatida, a permutation-based AE scheme that derives s -bit masks from previous permutation outputs to mask ciphertext blocks. Oribatida can provide a security bound of O ( rσ 2 / c + s ), which allows smaller permutations for the same level of security. It provides a security level dominated by O(σd2/2c)O(\sigma_d^2{/2^c}) under I nt -RUP adversaries, which eliminates the dependency on primitive queries. We prove its security under nonce-respecting and I nt -RUP adversaries. We show that our I nt -RUP bound is tight and show general attacks on previous constructions.

Isogenies on twisted Hessian curves

Fouazou Lontouo Perez Broon, Thinh Dang, Emmanuel Fouotsa, Dustin Moody March 16, 2021 Page range: 345-358

More Cite
Open Access PDF PDF

Abstract

Elliptic curves are typically defined by Weierstrass equations. Given a kernel, the well-known Vélu's formula shows how to explicitly write down an isogeny between Weierstrass curves. However, it is not clear how to do the same on other forms of elliptic curves without isomorphisms mapping to and from the Weierstrass form. Previous papers have shown some isogeny formulas for (twisted) Edwards, Huff, and Montgomery forms of elliptic curves. Continuing this line of work, this paper derives explicit formulas for isogenies between elliptic curves in (twisted) Hessian form. In addition, we examine the numbers of operations in the base field to compute the formulas. In comparison with other isogeny formulas, we note that our formulas for twisted Hessian curves have the lowest costs for processing the kernel and our X -affine formula has the lowest cost for processing an input point in affine coordinates.

Volume 15 (2021)

Issue 1

Volume 14 (2020)

Issue 1

Volume 13 (2019)

Volume 12 (2018)

Volume 11 (2017)

Volume 10 (2016)

Volume 9 (2015)

Volume 8 (2014)

Volume 7 (2013)

Volume 6 (2012)

Volume 5 (2012)

Volume 4 (2010)

Volume 3 (2009)

Volume 2 (2008)

Volume 1 (2007)

Cite Score	1.1
Mathematical Citation Quotient	0.75
SCImago Journal Rank	0.321
Source Normalized Impact per Paper	0.855

Submit

Submission
Please submit to JMC via ScholarOne Manuscripts　

Your benefits of publishing with us

Authors benefit from critical peer review and promotion of published papers to readers and citers.
The journal uses a continuous publication model - accepted manuscripts are published quickly after acceptance.
Thanks to Open Access, all articles are freely available to the academic community worldwide without any restrictions. Authors also benefit from more liberal policies on copyrights (authors retain copyright) and on self-archiving (no embargo periods).
The journal is archived in Portico.

Submission process

Before submitting an article, please adhere to the Instructions for Authors (Supplementary Information)
Submission of your paper via ScholarOne Manuscripts
Peer review procedure
Decision on your paper
Publishing
You will be guided through the whole process of submission
In case of any problems editorial assistance will be provided

Please note

Before submitting your manuscript, please get familiar with Publication ethics and malpractice statement
Beginning from January 2020, JMC is publishing in the Open Access model
Online publication for all papers accepted after peer review
If you have any general questions please visit our FAQ page for authors

We look forward to receiving your manuscript!

Editorial

Editor-in-Chief
Timothy J. Hodges, University of Cincinnati, USA

Editorial Advisory Board
Wasim Alhamdani, School of Computer and Information Sciences, University of the Cumberlands, KY, USA
Lejla Batina, Institute for Computing and Information Sciences, Radboud University, The Netherlands
Joseph J. Boutros, Texas A&M University at Qatar, Doha, Qatar
Liqun Chen, Department of Computer Science, University of Surrey, UK
Ray CC Cheung, City University of Hong Kong, Hong Kong
Paolo D'Arco, Università di Salerno, Salerno, Italy
Bernardo David, IT-Universitetet i København, Copenhagen, Denmark
Roberto De Prisco, Università di Salerno, Salerno, Italy
Vipul Goyal, Carnegie Mellon University, Pittsburgh, USA
Shay Gueron, University of Haifa and Intel Corporation, Israel
Chunlei Li, Department of Informatics, University of Bergen, Norway
Carlos Aguilar Melchor, ISAE-SUPAERO, Toulouse University, France
Chris Mitchell, Royal Holloway University of London, Egham, United Kingdom
Wai Ho Mow, Department of Electronic and Computer Engineering, Hong Kong University of Science and Technology, Hong Kong
Jean-Jacques Quisquater, Université Catholique de Louvain (UCL), Belgium
Dmytro Savchuk, Department of Mathematics and Statistics, University of South Florida, USA
Dominique Schröder, Department of Computer Science, Friedrich-Alexander-Universität Erlangen-Nürnberg, Germany
Peter Schwabe, Digital Security Group, Radboud University, The Netherlands
Gil Segev, School of Computer Science and Engineering, Hebrew University of Jerusalem
Arkadii Slinko, Department of Mathematics, The University of Auckland, New Zealand
Tamir Tassa, The Open University of Israel, Ra'anana, Israel
Huaxiong Wang, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore
Susanne Wetzel, Stevens Institute of Technology, Department of Computer Science, Castle Point on Hudson, USA
Øyvind Ytrehus, Simula UiB AS, Norway
Chao Zhang, School of Mathematics, Harbin Institute of Technology, China

Editorial Contact
Ewa Sarzyńska
jmc_editorial@degruyter.com

Journal of Mathematical Cryptology

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Details