Cryptology and Network Security: 19th International Conference, CANS 2020, Vienna, Austria, December 14–16, 2020, Proceedings

Preface
Organization
Contents
Best Papers
An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes
	1 Introduction
		1.1 Additional Related Work
	2 Preliminaries
		2.1 Canonical (2n+1)-Pass Identification Schemes
		2.2 Fiat-Shamir Transformation for a Class of 5-Pass ID Schemes
	3 Forgery Attacks on MQDSS
		3.1 Description of MQDSS
		3.2 Description of the Attack on MQDSS
		3.3 Attack Parameters and Mitigation
		3.4 Practical Verification
	4 Attacks on Five Round Protocols Using the Fiat-Shamir Transform
		4.1 Cost Analysis
		4.2 Discussion
	5 Application to Other Schemes
		5.1 Five Round Picnic
		5.2 PKP-Based Signature Scheme
		5.3 LegRoast
	6 Conclusion
	References
Energy Analysis of Lightweight AEAD Circuits
	1 Introduction
		1.1 Contributions and Organization
	2 Preliminaries
		2.1 Test Bench and Synthesis Options
	3 Implementations
		3.1 r-Round Unrolled
		3.2 Fully-Unrolled
	4 Effects of Design Choices
		4.1 Clock Frequency
		4.2 Optimal Unrolling
		4.3 Clock-Gating
		4.4 Inverse-Gating
		4.5 Results
	5 Threshold Implementations
		5.1 S-Box Details
		5.2 Results
	6 Final Observations and Conclusion
	References
Cross-Site Search Attacks: Unauthorized Queries over Private Data
	1 Introduction
	2 Taxonomy of XS-Search Attacks and Related Work
		2.1 XS-Search Attack Types
		2.2 XS-Search Methods
	3 Time-Based XS-Search Attacks
		3.1 Network-Time (NT) XS-Search Attack
		3.2 Cache-Time (CT) XS-Search Attack
		3.3 Processing-Time (PT) XS-Search Attack
	4 Length-Based XS-Search Attack
		4.1 Computing the Number of Records from Response-Length
		4.2 Measuring the Response Length
	5 Optimizations
		5.1 Inflation Methods
		5.2 Second-Order (SO) Optimization
	6 Term-Identification Query Algorithms
		6.1 Any-Term Identification (ATI) Algorithm
		6.2 Char-by-Char Search Algorithm
	7 Experiments
		7.1 Reproducibility
		7.2 The Reproducible Enron XS-Search Experiment
		7.3 Gmail: Credit Card Number Experiment
	8 Defense Techniques
		8.1 Client-Side Defenses
		8.2 Server-Side Defenses
	9 Conclusions
	References
Cybersecurity
Stronger Targeted Poisoning Attacks Against Malware Detection
	1 Introduction
		1.1 Related Work
		1.2 Contributions
	2 Preliminaries
		2.1 Notation
		2.2 Targeted Data Poisoning Attacks
		2.3 Data Sanitization Defense
	3 Sphere Defense-Aware Targeted Poisoning Attacks
		3.1 Basic Attack
		3.2 Streamlined Attack Based on the Optimal Attack Strategy
	4 Validation
		4.1 Experimental Setup
		4.2 Evaluation Indicator
		4.3 Defensive Performance of Sphere Defense
		4.4 Attack Performance Against Sphere Defense
		4.5 Noise Resilience
		4.6 Runtime Comparison
	5 Conclusion
	References
STDNeut: Neutralizing Sensor, Telephony System and Device State Information on Emulated Android Environments
	1 Introduction
	2 Background and Related Work
		2.1 Base Transceiver Station
		2.2 Emulation-Detection
		2.3 Related Work
	3 Motivation
		3.1 Overview of Emulation-Detection Library (EmuDetLib)
		3.2 Evaluation of Existing Frameworks
		3.3 Summary of Emulation-Detection
	4 STDNeut: Design and Implementation
		4.1 Realistic Sensor Data Generation
		4.2 STDNeut Overview
		4.3 Extensions to the Android Emulator
		4.4 STDNeut Controller
	5 Validation of STDNeut
		5.1 Non-detectability Through Sensors
		5.2 Non-detectability Through Device Information
		5.3 Evading Distributed Emulation-Detection
		5.4 Discussion and Limitations
	6 Conclusion
	References
HMAC and ``Secure Preferences'': Revisiting Chromium-Based Browsers Security
	1 Introduction
	2 Background
		2.1 Chromium Preferences
		2.2 HMAC in Chromium
	3 Security Analysis
		3.1 Attacker Model
		3.2 Changeware Proof-of-Concept
		3.3 Practical Attacks
		3.4 Installed-by-Default Extensions
		3.5 Google Hangsout Use Case
	4 Discussion
	5 Related Work
	6 Conclusions
	A Installed-by-Default Extensions
	References
Detecting Word Based DGA Domains Using Ensemble Models
	1 Introduction
	2 Related Work
	3 Proposed Methodology
		3.1 Building Classifiers
	4 Results and Discussion
		4.1 Experiment-1
		4.2 Experiment-2
		4.3 Experiment-3
		4.4 Experiment-4
		4.5 Experiment-5
	5 Conclusion and Future Scope
	References
Credentials
Distance-Bounding, Privacy-Preserving Attribute-Based Credentials
	1 Introduction
	2 Preliminaries
		2.1 Zero-Knowledge Proofs of Knowledge
		2.2 Distance Bounding Security Definitions
	3 Distance-Bounding ZKPK for Discrete Logarithms
		3.1 Reattempting a Distance-Bounding Schnorr Protocol
		3.2 Zero-Knowledge and Proof of Knowledge
		3.3 MF, TF and DH Resistance
	4 From Mutual Trust to PKI
		4.1 Security Analysis
	5 Bit-by-Bit Distance-Bounding Schnorr Protocol
		5.1 Security Analysis
	6 Performance
	7 Conclusion
	References
Trenchcoat: Human-Computable Hashing Algorithms for Password Generation
	1 Introduction
		1.1 Paper Outline and Contributions
	2 Cognitive and Neuro-Scientific Perspectives
	3 Password Security Advice
	4 Human-Computable Hashing Algorithms
		4.1 Description of the Schemes
	5 Analysis of Hash Functions
		5.1 Generation and Retention
		5.2 Effective Security
		5.3 User Study and Improvements
		5.4 Machine-Learning Based Analysis Using LSTMs
	6 Real-World Password Generation Methods
	7 Conclusion
	A Cryptographic Security
		A.1 Pre-image Resistance
		A.2 Collision Resistance and Randomness
	References
Provably Secure Scalable Distributed Authentication for Clouds
	1 Introduction
		1.1 Motivation and Related Work
		1.2 Our Contribution
		1.3 Outline of Article
	2 Preliminaries
	3 The Proposed Scheme
		3.1 Setup
		3.2 Scalability
		3.3 Authentication Phase
	4 Security Analysis
		4.1 Security Model
		4.2 Adversarial Model
		4.3 Practical Issues
	5 Conclusion
	References
Forward-Secure 0-RTT Goes Live: Implementation and Performance Analysis in QUIC
	1 Introduction
	2 Protocol Design
		2.1 QUIC Handhsake Protocol
		2.2 Bloom Filter Key Encapsulation Mechanisms
		2.3 The Implemented Handshake Protocol
		2.4 Instantiation of the BFKEM
		2.5 Failure Probability and Key Exhaustion of BFKEMs
	3 Security
	4 Implementation
	5 Analysis
		5.1 Measurement Setup
		5.2 Metrics and Methodology
		5.3 Performance Comparison with QUIC
	6 Conclusion
	References
Elliptic Curves
Semi-commutative Masking: A Framework for Isogeny-Based Protocols, with an Application to Fully Secure Two-Round Isogeny-Based OT
	1 Introduction
	2 Preliminaries
	3 Semi-commutative Invertible Masking Structures
		3.1 Masking Structure
		3.2 Problems and Properties
	4 Instantiation from Supersingular Isogenies
		4.1 Supersingular Isogenies over the Extension Field
		4.2 Masking Structure
		4.3 Computational Problems
	5 Oblivious Transfer Protocol from Masking Structures
	6 Active Secure Two-Round OT from Masking Structures
		6.1 Additional OT Security Notions
		6.2 Two Rounds OT with Active UC-Security
	References
Optimized and Secure Pairing-Friendly Elliptic Curves Suitable for One Layer Proof Composition
	1 Introduction
		1.1 Previous Work
		1.2 Our Contributions
		1.3 Applications
	2 Preliminaries
		2.1 Pairing-Friendly Elliptic Curves
		2.2 Recursive Proof Composition
	3 The Proposed Elliptic Curve: BW6-761
		3.1 Optimizations in G_1
		3.2 Optimizations in G_2
		3.3 Pairing Computation
	4 Security Estimate of the Curves
		4.1 A Note on Cheon's Attack
	5 Conclusion
	References
Curves with Fast Computations in the First Pairing Group
	1 Introduction
	2 Preliminaries
		2.1 Elliptic Curves
		2.2 Bilinear Groups
	3 Schemes with Numerous Computations in G1
	4 Attacks Solving the DLP
	5 Curves Optimizing Operation in G1
		5.1 Curves Over a Five-64-Bit-Machine-Word Prime Field
		5.2 GLV Endomorphism on BW13-P310 and BW19-P286
	6 Implementation and Comparison
		6.1 Operation in G1
		6.2 Operation in G2
		6.3 Pairing Computation
	7 Conclusion
	References
Revisiting ECM on GPUs
	1 Introduction
	2 Preliminaries
		2.1 Elliptic Curve Method
		2.2 Discrete Logarithm Problem
	3 Algorithmic Optimizations
		3.1 Stage 1 Optimizations
		3.2 ECM Stage 2 Optimizations
	4 Implementation Strategies
		4.1 Large Integer Representation on GPUs
		4.2 Elliptic Curve Arithmetic on GPUs
	5 Evaluation
		5.1 Stage One Bound
		5.2 Stage Two Bound
		5.3 ECM Throughput
		5.4 Comparison to Previous Work
	6 Conclusion
	References
Payment Systems
Arcula: A Secure Hierarchical Deterministic Wallet for Multi-asset Blockchains
	1 Introduction
		1.1 Our Contributions
		1.2 Applications
		1.3 Our Technique
	2 Related Work
	3 Preliminaries
		3.1 Signature Scheme
		3.2 (Deterministic) Hierarchical Key Assignment Scheme
	4 Hierarchical Deterministic Wallet
	5 Constructing Arcula from DHKA and Signatures
	6 Arcula in the Real World
		6.1 Technical Implementation
		6.2 Arcula in Bitcoin Cash
		6.3 Optimizations and Compatibility with Bitcoin
		6.4 Unlinkability of Transactions
	7 Conclusions
	References
Detecting Covert Cryptomining Using HPC
	1 Introduction
	2 Related Works
	3 System Architecture
		3.1 Fundamental Intuition of Our Approach
		3.2 Data Collection
		3.3 Cryptocurrencies and Miners
		3.4 Classifier Design
	4 Evaluation
		4.1 Binary Classification
		4.2 Currency Classification
		4.3 Nested Classification
		4.4 Sample Length
		4.5 Feature Relevance
		4.6 Unseen Miner Programs
	5 Limitations
		5.1 Zero-Day Cryptocurrencies
		5.2 Scalability
		5.3 Process Selection
		5.4 Restricted Mining
	6 Conclusion and Future Works
	A Validated Hyper-parameters
	B Parameters selected by grid search
	References
Lightweight Virtual Payment Channels
	1 Introduction
	2 Preliminaries
	3 The UTXO Model
	4 Overview of the Construction
	5 Our Protocols
	6 The Ideal Functionality
	7 Future Work
	A  Additional Functionalities and Protocols
	References
Privacy-Enhancing Tools
Chosen-Ciphertext Secure Multi-identity and Multi-attribute Pure FHE
	1 Introduction
	2 Preliminaries
		2.1 Pseudorandom Generator ch19blum1984generate
		2.2 Symmetric Key Encryption ch19halevi2003tweakable,ch19halevi2004parallelizable
		2.3 All-but-one Signature Scheme ch19goyal2019collusion
		2.4 Witness Pseudorandom Function ch19zhandry2016avoid
	3 CCA1 Secure MIFHE from WPRF and MFHE
		3.1 From IBE to CCA1 Secure MIFHE
	4 CCA1 Secure MAFHE from WPRF and MFHE
		4.1 From ABE to CCA1 Secure MAFHE
	5 Conclusion
	References
Linear Complexity Private Set Intersection for Secure Two-Party Protocols
	1 Introduction
	2 Preliminaries and Similar Protocols
		2.1 Sub-protocols
		2.2 Security Definitions
	3 Bloom Filter Based OPPRF Construction
	4 Our Private Set Membership Protocol
	5 Batch One-Time OPPRF
	6 Our Private Set Intersection Protocol
	7 Performance Evaluation
		7.1 Concrete Complexity
		7.2 Experimental Verification
	8 Conclusion
	References
Compact Multi-Party Confidential Transactions
	1 Introduction
		1.1 Our Contribution
		1.2 Related Work
	2 Preliminaries
		2.1 Homomorphic Pedersen Commitment Scheme
		2.2 Compact Multi Signature Scheme
		2.3 Non-interactive Zero-Knowledge Compact Multi-party Range Proofs
	3 Compact Multi-party Confidential Transactions
	4 Cryptographic Investigation
		4.1 Security Model
		4.2 Security of Compact Schnorr Signatures and BLS Signatures
		4.3 Non-malleable, Compact, Multi-party Range Proofs from Bulletproofs
		4.4 Security Proofs for Compact, Multi-party Confidential Transactions
	A  Compact Schnorr and BLS Signatures
	B  Improved Inner Product Argument with Strong Fiat Shamir Challenges
	References
Simulation Extractable Versions of Groth's zk-SNARK Revisited
	1 Introduction
		1.1 Our Contributions
	2 Preliminaries
	3 Simulation Extractability Without Random Oracles
	4 Conclusion
	References
Efficient Composable Oblivious Transfer from CDH in the Global Random Oracle Model
	1 Introduction
		1.1 Our Contributions
		1.2 Related Works
		1.3 Our Techniques
	2 Preliminaries
	3 The Generic Protocol
	4 Realizing FOT,1 Directly
	References
Lightweight Cryptography
Integral Cryptanalysis of Reduced-Round Tweakable TWINE
	1 Introduction
	2 Preliminaries
		2.1 Specifications
		2.2 Integral Cryptanalysis
	3 Integral Distinguishing Attacks
	4 Integral Attacks on
		4.1 Attack on 26-Round [80]
		4.2 Attack on 27-Round [128]
	5 Attacking One More Round
		5.1 Key Recovery Attacks
	6 Conclusion
	A Recovery of 80-bit keys of [80] attack
	References
RiCaSi: Rigorous Cache Side Channel Mitigation via Selective Circuit Compilation
	1 Introduction
	2 Preliminaries
		2.1 The Block Ciphers AES, DES and Camellia
		2.2 Boolean Circuits for Secure Computation
		2.3 Program-Analysis Approach
	3 The RiCaSi Toolchain
		3.1 Initial Side-Channel Analysis
		3.2 C Code Preprocessing
		3.3 C Code to Circuit Compilation
		3.4 Circuit to Binary Compilation
		3.5 Final Side-Channel Analysis
	4 Evaluation of Cache-Side-Channel Security
		4.1 RiCaSi for AES Implementations
		4.2 RiCaSi for Block Ciphers from mbedTLS
	5 Evaluation of Overhead
		5.1 Binary Sizes
		5.2 Run-Times
	6 Related Work
		6.1 Secure Computation Techniques for Side-Channel Mitigation
		6.2 Systematic Detection and Assessment of Side-Channel Leakage
		6.3 Analysis of Side-Channel Leakage in Circuit Implementations
	7 Conclusion
	References
Assembly or Optimized C for Lightweight Cryptography on RISC-V?
	1 Introduction
	2 RISC-V
		2.1 Architecture
		2.2 Instruction Set
		2.3 Executing Code
	3 Optimized Algorithms
		3.1 Gimli
		3.2 Sparkle
		3.3 Saturnin
		3.4 Ascon
		3.5 Delirium
		3.6 Xoodyak
		3.7 AES
		3.8 Keccak
	4 Comparison with Other Implementations and Additional Benchmark
	5 Conclusion
	References
Codes and Lattices
Attack on LAC Key Exchange in Misuse Situation
	1 Introduction
	2 Preliminaries
		2.1 Notation
		2.2 LAC
	3 Attack on LAC Key Exchange
		3.1 Attack Model
		3.2 Attack on LAC-128-KE and LAC-192-KE
	4 Attack on LAC-256-KE
		4.1 Attack on LAC-256-KE
		4.2 Attack on LAC-256-KE Simplified
	5 Conclusion
	References
Enhancing Code Based Zero-Knowledge Proofs Using Rank Metric
	1 Introduction
		1.1 Our Contribution
		1.2 Related Works
	2 Preliminaries and Notations
		2.1 Codes in the Rank Metric
		2.2 Rank Decoding Problem
		2.3 Commitment Schemes
		2.4 Zero-Knowledge Proof of Knowledge
	3 A Commitment Scheme in the Rank Metric
	4 Zero Knowledge Proof Protocols
		4.1 Proving Knowledge of a Valid Opening
		4.2 Proving Linear Relations
		4.3 Proving Multiplicative Relations
	5 Implementation
		5.1 Parameters
		5.2 Sizes and Communication Cost Comparison
		5.3 Performance Comparison
	6 Conclusion
	A  Sigma Protocol
	B  Proof of Theorem3
	References
A Secure Algorithm for Rounded Gaussian Sampling
	1 Introduction
		1.1 Related Work
		1.2 Our Contribution
	2 Method Background
		2.1 Box-Muller Gaussian Sampling
		2.2 CORDIC Algorithm for Evaluation of Transcendental Functions
	3 Secure CORDIC Algorithm
		3.1 Fundamental Arithmetic
		3.2 Constant-Time, Sequential Rotations
		3.3 Reduced Cos and Sin Algorithm
		3.4 Reduced Natural Logarithm and Square Root Functions
		3.5 Range Restoration and Full Sampler
	4 Results and Discussion
	References
Accelerating Lattice Based Proxy Re-encryption Schemes on GPUs
	1 Introduction
	2 Design
		2.1 Syntax of Unidirectional PRE Scheme
	3 Preliminaries and Mathematical Notations
		3.1 Gadget Matrix and Relinearization Functions:
	4 Number Theoretic Transform and Bit-Decomposition
		4.1 Number Theoretic Transform
		4.2 Parallel NTT
		4.3 Barrett Modulo Reduction and Arbitrary Precision Support
		4.4 Bit Decomposition
	5 PRE Cryptosystem with BV FHE Scheme
		5.1 BV Encryption Scheme
		5.2 Proxy Re-encryption Scheme
		5.3 Security
	6 PRE Cryptosystem with Ring-GSW FHE Scheme
		6.1 Ring-GSW Encryption Scheme
		6.2 Proxy Re-encryption Scheme
		6.3 Security
	7 Parameter Selection
	8 GPU Implementation and Results
		8.1 Software Implementation
		8.2 Experimental Results
	9 Conclusion and Future Work
	References
Author Index