Real Crypto

Pedersen hash weaknesses Pedersen hash has been popularized by Zcash team as ZK-friendly hash function suitable for Merkle trees. Its simplest version operates on an elliptic curve with two fixed generators G and H with unknown discrete log relation. Then to hash two integers (a,b) one computes P = aG + bH and takes some compressed version of P (e.g. x-coordinate) as a result. There are several extensions of this …

Crypto 2019 Part 7 37. Unifying Leakage Models on a Rényi Day https://eprint.iacr.org/2019/138.pdf How to model the number of probes in side channel attacks: new approaches based on the statistical difference between two distributions. 38. Low Memory Attacks against Two-Round Even-Mansour using the 3-XOR Problem N/A 39. Cryptographic Sensing https://eprint.iacr.org/2019/637.pdf This is a new concept with the fol…

Crypto 2019, part 6 31. Stronger leakage-resilient and non-malleable secret sharing schemes for general access structures https://eprint.iacr.org/2018/1147.pdf How to share a secret if leakage is present. 32. Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model https://eprint.iacr.org/2019/190.pdf Similar to paper 23, but with a bit stronger security guarantees. 33. Non-Interactive Non-M…

Crypto 2019. Part 5 25. Exploring Constructions of Compact NIZKs from Various Assumptions https://eprint.iacr.org/2019/623.pdf Very long theoretical paper about asymptotically efficient zero-knowledge proofs for generic circuits. 26. Highly Efficient Key Exchange Protocols with Optimal Tightness https://eprint.iacr.org/2019/737.pdf Existing key agreement protocols used in TLS or Signal do not have tight proofs: t…

A couple of remaining Zcon1 talks that worth watching https://www.youtube.com/watch?v=fXWRJUsq8Ok&list=PL40dyJ0UYTLLjPZaKjdhMoCNanb77_Ztj&index=16 ZEXE: how to make computation decentralized and zero knowledge: allow writes to certain memory/tree leafs only to those who prove identity and transition logic in zero knowledge. https://www.youtube.com/watch?v=J9OGAwt_f_c&list=PL40dyJ0UYTLLjPZaKjdhMoCNanb77_Ztj&index=19…

Crypto 2019. Part 4 19. The Communication Complexity of Threshold Private Set Intersection https://eprint.iacr.org/2019/175.pdf The problem is for Alice and Bob to find an intersection between their sets if it is big enough. The authors prove tight bounds on the communication complexity by encoding set elements as monomials 20. Match Me if You Can: Matchmaking Encryption and its Applications https://eprint.iacr.org…

Interesting talks from ZCash conference Zcon1, Part 1: https://www.youtube.com/watch?v=AJGLhaUV8QM&list=PL40dyJ0UYTLLjPZaKjdhMoCNanb77_Ztj&index=4 How to break privacy in cryptocurrencies that use incomplete (ring signatures, mixers) privacy. Smart attackers can flood the network with decoys and identify your transactions. https://www.youtube.com/watch?v=vuzYwutBqjY&list=PL40dyJ0UYTLLjPZaKjdhMoCNanb77_Ztj&index=5 L…

Crypto 2019 Part 3 13. Two-Party ECDSA from Hash Proof Systems and Efficient Instantiations https://eprint.iacr.org/2019/503.pdf Only recently there has appeared a threshold ECDSA for 2 parties, but the construction needed non-trivial assumptions. This scheme removes the assumptions with little effect on performance. 14. iO Without Multilinear Maps: New Paradigms via Low-Degree Weak Pseudorandom Generators and Sec…

7. Adaptively Secure and Succinct Functional Encryption: Improving Security and Efficiency, Simultaneously https://eprint.iacr.org/2018/974.pdf Functional encryption allows decrypting f(plaintext) for a class of functions f, each with a diferent decryption key. This paper shows how to build an FE scheme with polynomially many f’s from weaker versions. 8. Data-Independent Memory Hard Functions: New Attacks and Stron…

Crypto 2019 Part 1 1. "How to Record Quantum Queries, and Applications to Quantum Indifferentiability" https://eprint.iacr.org/2018/276.pdf In classic cryptography many constructions are proven secure assuming their components are random oracles (respond randomly on new inputs). The security proofs are often conducted by constructing an adversary breaking this randomness (so contradiction) from an adversary breaki…

Libra https://eprint.iacr.org/2019/317.pdf Libra is notable for its very fast proof generation time, processing about 50,000 gates per second (order of magnitude faster than Bulletproofs). The downside is the trusted setup requirement and Verifier costs linear in circuit depth. The trusted setup, though, should be performed only once for circuits of certain size (like in Sonics). The idea is to represent each gate …

Lelantus https://eprint.iacr.org/2019/373.pdf This is a new privacy-oriented cryptocurrency protocol, developed by the Zcoin team. Lelantus claims to achieve both transaction privacy and coin amount secrecy, in the line of Monero, Zcash, Zcoin. The authors claim short proofs and fast verification time, also the ability to batch proofs to enable fast verification of multiple proofs. The ledger is UTXO based. Each o…