About on Elena Pagnin

Tail-Hammer: Optimized Statistics for Anonymous Committees and Applications

Mon, 01 Jun 2026 14:00:00 +0000

Techniques to randomly select sets of anonymous parties are ubiquitous in efficient and adaptively secure consensus protocols, as well as in Multi-Party Computation in the YOSO model, where each round is executed by a different random anonymous committee. Anonymous committee selection aims at randomly selecting a set of n parties (the committee), where at most t parties are corrupted (except with negligible probability), drawing from a population of $N ≫ n$ parties with at most $T$ corrupted parties. Additionally, each party knows (and can prove) if they belong to the committee, but ignores other members’ identities. A very common and efficient instantiation of anonymous committee selection is to select parties according to a VRF output, this however, leads to committees of probabilistic size ($n$ behaves as a Binomial random variable). Despite wide adoption, only [7] (Blum et al., CCS23) provides an analysis of VRF-based probabilistic anonymous committee selection that estimates the size of committees. This analysis relies on lose bounds (Chernoff) and approximations (Poisson). In this work, we revisit Blum et al.’s estimates and derive accurate closed-form formulas (based on a tight Binomial approximation), as well as an efficient high-precision library called Tail-Hammer for computing exact parameters. Notably, Tail-Hammer identifies smaller committee sizes (approximately -25% on average) than [7] for the same security level, leading to improved efficiency in protocols relying on random committee selection, also when anonymity is not needed. Our analysis applies to committee selection techniques that employ unbiased (uniformly random), or bounded-bias randomness, to both synchronous and asynchronous communication settings, and it can account for inactive parties. As a new application, we present a verifiable consistent broadcast protocol that leverages quorums in anonymous committees to achieve efficiency without requiring threshold signatures.

Thu, 07 Sep 2023 00:00:00 +0000

Proofs of sequential communication delays from physical assumptions and their applications

Wed, 30 Jul 2025 10:00:00 +0000

Time-based cryptographic primitives unlock efficient realizations of several functionalities including Randomness Beacons, Proof of Replicated Storage, Encryption to the Future, and MultiParty Computation with partial fairness. Existing constructions derive time-delays from the average hardness of sequential computational problems, a measure that is susceptible to algorithmic and hardware improvements. Therefore time-based systems secure at deployment date are at constant risk to turn insecure. A way to combat this intrinsic drawback is to ground time-delays on assumptions that are not affected by scientific advancement such as trust (in a subset of parties) and physical communication delays. This paper builds on Baum et al.’s (SCN 2024) work on “CaSCaDE: (Time-Based) Cryptography from Space Communications DElay”, and provides concrete realizations and detailed security proofs of: a Time Lock Puzzle, a stateless Verifiable Random Function, a Delay Encryption scheme, and a Randomness Beacon from proofs of Sequential Communication Delays (SCD) and trust assumptions on subsets of parties. Notably, our SCD-based Delay Encryption construction constitutes the first alternative to existing supersingular isogenies Delay Encryption schemes.

Thu, 07 Sep 2023 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

That's AmorE: Amortized Eﬃciency for Pairing Delegation

Mon, 05 May 2025 14:00:00 +0000

Over two decades since their introduction in 2005, all major verifiable pairing delegation protocols for public inputs have been designed to ensure information-theoretic security. However, we note that a delegation protocol involving only ephemeral secret keys in the public view can achieve everlasting security, provided the server is unable to produce a pairing forgery within the protocol’s execution time. Thus, computationally bounding the adversary’s capabilities during the protocol’s execution, rather than across its entire lifespan, may be more reasonable, especially when the goal is to achieve significant efficiency gains for the delegating party. This consideration is particularly relevant given the continuously evolving computational costs associated with pairing computations and their ancillary blocks, which creates an ever-changing landscape for what constitutes efficiency in pairing delegation protocols. With the goal of fulfilling both efficiency and everlasting security, we present AmorE, a protocol equipped with an adjustable security and efficiency parameter for sequential pairing delegation, which achieves state-of-the-art amortized efficiency in terms of the number of pairing computations. For example, delegating batches of 10 pairings on the BLS48-575 elliptic curve via our protocol costs to the client, on average, less than a single scalar multiplication in G2 per delegated pairing, while still ensuring at least 40 bits of statistical security.

Sat, 01 May 2021 00:00:00 +0000

Thu, 07 Sep 2023 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

Thu, 07 Sep 2023 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

Sun, 07 Feb 2021 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

Universally Composable Interactive and Ordered Multi-Signatures

Tue, 04 Feb 2025 10:00:00 +0000

Multi-signatures allow a given set of parties to cooperate in order to create a digital signature whose size is independent of the number of signers. At the same time, no other set of parties can create such a signature. While non-interactive multi-signatures are known (e.g. BLS from pairings), many popular multi-signature schemes such as FROST or MuSig (which are constructed from pairing-free discrete logarithm-style assumptions) require interaction. Such interactive multi-signatures have recently found practical applications e.g. in the cryptocurrency space. Motivated by classical and emerging use cases of such interactive multi-signatures, we introduce the first systematic treatment of interactive multi-signatures in the universal composability (UC) framework. Along the way, we revisit existing game-based security notions and prove that constructions secure in the game-based setting can easily be made UC secure and vice versa. In addition, we consider interactive multi-signatures where the signers must interact in a fixed pattern (so-called ordered multi-signatures). Here, we provide the first construction of ordered multi-signatures based on the one-more discrete logarithm assumption, whereas the only other previously known construction required pairings. Our scheme achieves a stronger notion of unforgeability, guaranteeing that the adversary cannot obtain a signature altering the relative order of honest signers. We also present the first formalization of ordered multi-signatures in the UC framework and again show that our stronger game-based definitions are equivalent to UC security.

Sat, 01 May 2021 00:00:00 +0000

Thu, 07 Sep 2023 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

Thu, 07 Sep 2023 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

Sun, 07 Feb 2021 00:00:00 +0000

Sat, 01 May 2021 00:00:00 +0000

Multi Designated Verifier Ring Signatures

Tue, 03 Sep 2024 10:00:00 +0000

We study signatures well suited for sensitive applications (e.g. whistle-blowing) where both the signer’s anonymity and deniability are important. Two independent lines of work have tackled these two goals: ring signatures ensure the signer’s anonymity (within a set of signers, called a ring), and — separately — multi-designated verifier signatures ensure that all the intended recipients agree on whether a signature is valid, while maintaining the signer’s deniability by preventing the intended recipients from convincing an outsider of the validity of the signature. In this paper, we introduce multi-designated verifier ring signatures (MDVRS), which simultaneously offer both signer anonymity and deniability. This makes MDVRS uniquely suited for sensitive scenarios. Following the blueprint of Damgård et al (TCC’20) for multi-designated verifier signatures, we introduce provably simulatable designated-verifier ring signatures (PSDVRS) as an intermediate building block which we then compile into an MDVRS. We instantiate PSDVRS in a concretely efficient way from discrete-logarithm-based sigma protocols, encryption and commitments.

Sat, 01 May 2021 00:00:00 +0000

Updatable Privacy-Preserving Blueprints

Mon, 26 Aug 2024 10:00:00 +0000

Privacy-preserving blueprint schemes (Kohlweiss et al., EUROCRYPT’23) offer a mechanism for safeguarding user’s privacy while allowing for specific legitimate controls by a designated auditor agent. These schemes enable users to create escrows encrypting the result of evaluating a function y = P (t, x), with P being publicly known, t a secret used during the auditor’s key generation, and x the user’s private input. Crucially, escrows only disclose the blueprinting result y = P (t, x) to the designated auditor, even in cases where the auditor is fully compromised. The original definition and construction only support the evaluation of functions P on an input x provided by a single user. We address this limitation by introducing updatable privacy-preserving blueprint schemes (UPPB), which enhance the original notion with the ability for multiple users to non-interactively update the private user in- put x while blueprinting. Moreover, UPPBs contain a proof that y is the result of a sequence of valid updates, while revealing nothing else about the private inputs {xi} of updates. As in the case of privacy-preserving blueprints, we first observe that UPPBs can be realized via a generic construction for arbitrary predicates P based on FHE and NIZKs. Our main result is uBlu, an efficient instantiation for a specific predicate comparing the values x and t, where x is the cumulative sum of users’ private inputs and t is a fixed private value provided by the auditor in the setup phase. This rather specific setting already finds interesting applications such as privacy-preserving anti-money laundering and location tracking, and can be extended to support more generic predicates. From the technical perspective, we devise a novel technique to keep the escrow size concise, independent of the number of updates, and reasonable for practical applications. We achieve this via a novel characteriza- tion of malleability for the algebraic NIZK by Couteau and Hartmann (CRYPTO’20) that allows for an additive update function.

Sat, 01 May 2021 00:00:00 +0000

CaSCaDE: (Time-Based) Cryptography from Space Communications DElay

Mon, 01 Jul 2024 14:00:00 +0000

Time-based cryptographic primitives such as Time-Lock Puzzles (TLPs) and Verifiable Delay Functions (VDFs) have proven to be pivotal in several areas of cryptography. All existing candidate constructions, however, guarantee time-delays based on the average hardness of sequential computational problems. This means that any algorithmic or hardware improvement affects parameter choices and may turn deployed systems insecure. To address this issue, we investigate how to build time-based cryptographic primitives where delays depend on sources other than sequential computations: namely, transmission delays caused by sequential communication. We explore sequential communication delays that arise when sending a message through a constellation of satellites in Space. This setting has the advantage that distances between protocol participants are guaranteed as positions of satellites are observable from Earth, moreover delay lower bounds are unconditional and can be easily computed using the laws of Physics (no transmission travels faster than the speed of Light). We introduce proofs of sequential communication delay (SCD) in the Universal Composability framework, that can be used to convince a verifier that a message has accrued delay by traversing a path among a set of scattered satellites. With our SCD proofs we realize the first proposals of Publicly Verifiable TLPs and VDFs whose delay guarantees are rooted on physical limits, rather than ever-decreasing computational hardness. Finally, our notion of SCD paves the way to the first Delay Encryption construction not based on supersingular isogenies.

Progressive and Efficient Verification for Digital Signatures: Extensions and Experimental Results

Mon, 01 Jul 2024 14:00:00 +0000

Digital signatures are widely deployed to authenticate the source of incoming information, or to certify data integrity. Common signature verification procedures return a decision (accept/reject) only at the very end of the execution. If interrupted prematurely, however, the verification process cannot infer any meaningful information about the validity of the given signature. This limitation is due to the algorithm design solely, and it is not inherent to signature verification. In this work, we provide a formal framework to extract information from prematurely interrupted signature verification, independently of why the process halts: we propose a generic verification procedure that progressively builds confidence on the final decision. Our transformation builds on a simple but powerful intuition and applies to a wide range of existing schemes considered to be post-quantum secure, including some lattice-based and multivariate equations based constructions. We demonstrate the feasibility of our approach through an implementation on off-the-shelf resource-constrained devices. In particular, an intensive testing activity has been conducted measuring the increase of performance on three IoT boards — i.e., Arduino, Raspberry, and Espressif — and a consumer-grade laptop. While the primary motivation of progressive verification is to mitigate unexpected interruptions, we show that verifiers can leverage it in two innovative ways. First, progressive verification can be used to intentionally adjust the soundness of the verification process. Second, our transformation splits verification into a computationally intensive offline set-up (run once), and an efficient online verification that is faster than the original algorithm. We conclude showing how to tweak our compiler for progressive verification to work on a wide range of signatures with properties, on three real-life use cases, and in combination with efficient verification.

Sat, 01 May 2021 00:00:00 +0000

Metadata Privacy Beyond Tunneling for Instant Messaging

Mon, 01 Apr 2024 14:00:00 +0000

Transport layer data leaks metadata unintentionally – such as who communicates with whom. While tools for strong transport layer privacy exist, they have adoption obstacles, including performance overheads incompatible with mobile devices. We posit that by changing the objective of metadata privacy for all traffic, we can open up a new design space for pragmatic approaches to transport layer privacy. As a first step in this direction, we propose using techniques from information flow control and present a principled approach to constructing formal models of systems with metadata privacy for some, deniable, traffic. We prove that deniable traffic achieves metadata privacy against strong adversaries– this constitutes the first bridging of information flow control and anonymous communication to our knowledge. Additionally, we show that existing state-of-the-art protocols can be extended to support metadata privacy, by designing a novel protocol for deniable instant messaging (DenIM), which is a variant of the Signal protocol. To show the efficacy of our approach, we implement and evaluate a proof-of- concept instant messaging system running DenIM on top of unmodified Signal. We empirically show that the DenIM on Signal can maintain low-latency for unmodified Signal traffic without breaking existing features, while at the same time supporting deniable Signal traffic.

Sat, 01 May 2021 00:00:00 +0000

Swedish

Tue, 14 Nov 2023 10:00:00 +0000

Technical Swedish

Living and working in Sweden one can go by a long way with using just English. However, now and then comes the time when you are asked to provide a summary of your talk/thesis/work/grant proposal in Swedish. The usual workflow is to write a good piece of text in English, run it via google translator or chatGPT, but then, human-intelligence is needed to handle odd translation of terms that are rarely (if ever) used in Swedish. For these terms IT-ord provides a good translation. Good luck!

Sat, 01 May 2021 00:00:00 +0000

Reading Fast(er)

Mon, 25 Sep 2023 10:00:00 +0000

Reading Fast(er)

In academia one ends up reading a lot. Some readings require little attention and can be made fast and enjoyable by pasting the text into spreeder or bionic reading. These tools can also come handy for a first pass on a paper (mostly introduction), but be aware that understanding written text takes time, so you should anyway re-read a paper in ’the usual way’. Check out Episode 69 of the academic imperfectionist for an academic’s experience with speed reading and intellectual understanding.

Sat, 01 May 2021 00:00:00 +0000

Academic Integrity

Thu, 20 Apr 2023 10:00:00 +0000

Integrity in Academia

Integrity is crucial in academic line of work: you need to make sure that what you publish is sound, and that you are able to defend any aspect of your work, even the parts that have been developed by your collaborators and co-authors.

It is also very important to objectively and respectfully recognize the source of ideas. Many times you end up re-discovering an existing wheel, though you made the effort “independently” if someone else published or publicly discussed it before you, the “seminal idea” should be awarded to them.

Academic Spam

Thu, 20 Apr 2023 10:00:00 +0000

What is Academic Spam?

Yes, academia is not immune to spam! and here I’m not talking about ’the usual’ kind of spam, but the one that is targeted to academic. This often comes with emails addressed to Dear colleague, Respected Sir, or in the more sophisticated cases they actually parse your name (usually from bibliographic references, so that it spells surname first or with odd shortening), and offers invitation to submit your work to (fictional) conferences or (scamy and irrelevant) journals with low-quality. The aim is to cause irrelevant submissions, get money for you to publish it, or gather intelligence about your (unpublished) progress.

Sat, 01 May 2021 00:00:00 +0000

PAPR: Publicly Auditable Privacy Revocation for Anonymous Credentials

Wed, 01 Feb 2023 14:00:00 +0000

We study the notion of anonymous credentials with Publicly Auditable Privacy Revocation (PAPR). PAPR credentials simultaneously provide conditional user privacy and auditable privacy revocation. The first property implies that users keep their identity private when authenticating unless and until an appointed authority requests to revoke this privacy, retroactively. The second property enforces that auditors can verify whether or not this authority has revoked privacy from an issued credential (i.e. learned the identity of the user who owns that credential), holding the authority accountable. In other words, the second property enriches conditionally anonymous credential systems with transparency by design, effectively discouraging such systems from being used for mass surveillance. In this work, we introduce the notion of a PAPR anonymous credential scheme, formalize it as an ideal functionality, and present constructions that are provably secure under standard assumptions in the Universal Composability framework. The core tool in our PAPR construction is a mechanism for randomly selecting an anonymous committee which users secret share their identity information towards, while hiding the identities of the committee members from the authority. As a consequence, in order to initiate the revocation process for a given credential, the authority is forced to post a request on a public bulletin board used as a broadcast channel to contact the anonymous committee that holds the keys needed to decrypt the identity connected to the credential. This mechanism makes the user de-anonymization publicly auditable.

Bifrost: Secure, Scalable and Efficient File Sharing System Using Dual Deduplication

Thu, 01 Sep 2022 14:00:00 +0000

We consider the problem of sharing sensitive files across users while relying on a common, untrusted third-party, e.g., a Cloud Storage Provider (CSP). Although users can rely on a secure peer-to-peer (P2P) channel for file sharing, this introduces potential delay on the data transfer and requires the sender to remain connected while the transfer process occurs. Instead, users can upload information about the file on a common CSP and share only the essential information that enables the receiver to recover the original file. However, using encryption to protect the uploaded information from the untrusted cloud hinders deduplication capabilities, which is undesirable for CSPs. This paper introduces Bifrost, an innovative file sharing method inspired by recent results on dual deduplication. Bifrost achieves secure file sharing using an untrusted cloud, and simultaneously guarantees that (1) the CSP can efficiently deduplicate outsourced data; (2) the secure P2P channel is used only to transmit short, but crucial information; (3) users can check for data integrity, i.e., detect if the CSP alters the outsourced data; and (4) only the sender and the intended receiver can recover the sensitive file, i.e., the cloud or no malicious adversary can infer useful information about the shared file. We analyze compression and bandwidth performance using a proof-of-concept implementation. Our experiments show that secure file sharing can be achieved by sending as little as 640 bits on the P2P channel, irrespective of file size, while the CSP that aids the sharing can enjoy a deduplication rate of 86.9%.

How does the peer-review system work?

Thu, 01 Sep 2022 10:00:00 +0000

Basics principles of peer-reviewing

You submit your work. A few people read it, usually the magic number of reviewers is 3, and they are supposed to be experts in the topic of your paper. These people say what they think about your paper. Your paper gets accepted or rejecting according to the reviewers’ opinions and possibly a sanity check by the general chair of the conference.

What do reviewers look for in a paper?

Usually, they focus on novelty and correctness. This means that they want to first understand why what you did matters, and how “big” your contribution is; then, they will move to checking that your work is sound (no errors or flaws). Remember that reviewers are humans, they make errors, may be swayed to praise more works closer to their line of work, have a personal taste. Also, it is hard to define what novelty actually means, and too often, lately, novelty is confused with hardness. There’s a nice post by Michael J. Black that discusses novelty in computer science, I think many of his claims apply to the cryptographic community as well.

How to determine quality of papers

Fri, 01 Jul 2022 10:00:00 +0000

How to determine quality of papers

There are different metrics to measure ‘how good’ a paper is. None is perfect or completely accurate. The best way to judge is personal, and you will develop your own preferences and ‘qualities indicators’ over time.

The San Francisco Declaration on Research Assessment (DORA) opens with this statement:

There is a pressing need to improve the ways in which the output of scientific research is evaluated by funding agencies, academic institutions, and other parties.

Interview Questions

Wed, 15 Jun 2022 10:00:00 +0000

If you’re preparing for an interview (either as interviewee or interviewer), this is a good link to check out! It’s essentially a bot that returns common hiring questions for faculty appointments within computer science. Here you get a pdf with a good pool of questions for practicing.

Secure Cloud Storage with Joint Deduplication and Erasure Protection

Tue, 10 May 2022 00:00:00 +0000

This work proposes a novel design for secure cloud storage systems using a third party to meet three seemingly opposing demands: reduce storage requirements on the Cloud, protect against erasures (data loss), and maintain confidentiality of the data. More specifically, we achieve storage cost reductions using data deduplication without requiring system Users to trust the Cloud operates honestly. We analyze the security of our scheme against various types of rational, malicious adversaries that may collude with multiple parties and show that no novel sensitive information can be inferred, assuming random oracles and a high min-entropy data source. We also provide a mathematical analysis to characterize its potential for compression given the popularity of individual chunks of data and its overall erasure protection capabilities. In fact, we show that the storage cost of our scheme for a chunk with 𝑟 replicas is 𝑂(log(r)/r), while deduplication without security or reliability considerations is O(1/r), i.e., our added cost for providing reliability and security is only 𝑂(log(𝑟)). We provide a proof of concept implementation to simulate performance and verify our analytical results

CatNap: Practical and actively secure proximity testing with a napping party based on generic MPC techniques

Mon, 02 May 2022 14:00:00 +0000

Proximity testing functionality is at the core of most LocationBased Services (LBS). In a nutshell, proximity testing takes the locations of two clients from them and produces a single bit of result telling whether the clients are within each other’s proximity or not. Currently existing LBS require full trust from their clients; in order to use the service, clients have to disclose their locations in plain and trust that the service will not misuse them. Clamorous precedents of such misuse motivate the search for solutions which would ensure the privacy of client location.

Outsourcing MPC Precomputation for Location Privacy

Fri, 08 Apr 2022 14:00:00 +0000

Proximity testing is at the core of several Location-Based Services (LBS) offered by, e.g., Uber, Facebook, and BlaBlaCar, as it determines closeness to a target. Unfortunately, modern LBS demand not only that clients disclose their locations in plain, but also to trust that the services will not abuse this information. These requirements are unfounded as there are ways to perform proximity testing without revealing one’s location. We propose POLAR, a protocol that implements privacy-preserving proximity testing for LBS. POLAR is suitable for clients running mobile devices, and relies on a careful combination of three well-established multiparty computation protocols and lightweight cryptography. A point of originality is the inclusion of two servers into the proximity testing. The servers may aid multiple pairs of clients and contribute towards enhancing privacy, improving effciency, and reducing the running time of clients’ procedures.

Progressive And Efficient Verification For Digital Signatures

Fri, 18 Mar 2022 14:00:00 +0000

Count Me In! Extendability for Threshold Ring Signatures

Wed, 09 Mar 2022 14:00:00 +0000

Ring signatures enable a signer to sign a message on behalf of a group anonymously, without revealing her identity. Similarly, threshold ring signatures allow several signers to sign the same message on behalf of a group; while the combined signature reveals that some threshold t of the group members signed the message, it does not leak anything else about the signers’ identities. Anonymity is a central feature in threshold ring signature applications, such as whistleblowing, e-voting and privacy-preserving cryptocurrencies: it is often crucial for signers to remain anonymous even from their fellow signers. When the generation of a signature requires interaction, this is difficult to achieve. There exist threshold ring signatures with non-interactive signing — where signers locally produce partial signatures which can then be aggregated — but a limitation of existing threshold ring signature constructions is that all of the signers must agree on the group on whose behalf they are signing, which implicitly assumes some coordination amongst them. The need to agree on a group before generating a signature also prevents others — from outside that group — from endorsing a message by adding their signature to the statement post-factum. We overcome this limitation by introducing extendability for ring signatures, same-message linkable ring signatures, and threshold ring signatures. Extendability allows an untrusted third party to take a signature, and extend it by enlarging the anonymity set to a larger set. In the extendable threshold ring signature, two signatures on the same message which have been extended to the same anonymity set can then be combined into one signature with a higher threshold. This enhances signers’ anonymity, and enables new signers to anonymously support a statement already made by others. For each of those primitives, we formalize the syntax and provide a meaningful security model which includes different flavors of anonymous extendability. In addition, we present concrete realizations of each primitive and formally prove their security relying on signatures of knowledge and the hardness of the discrete logarithm problem. We also describe a generic transformation to obtain extendable threshold ring signatures from same-message-linkable extendable ring signatures. Finally, we implement and benchmark our constructions.

LOVE a Pairing

Wed, 04 Aug 2021 14:00:00 +0000

The problem of securely outsourcing the computation of a bilinear pairing has been widely investigated in the literature. Designing an eﬀicient protocol with the desired functionality has, however, been an open challenge for a long time. Recently, Di Crescenzo et al. (CARDIS’20) proposed the first suite of protocols for securely and eﬀiciently delegating pairings with online inputs under the presence of a malicious server. We progress along this path with the aim of LOVE (Lowering the cost of Outsourcing and Verifying Eﬀiciently) a pairing. Our contributions are threefold. First, we propose a protocol (LOVE) that improves the eﬀiciency of Di Crescenzo et al.’s proposal for securely delegating pairings with online, public inputs. Second, we provide the first implementation of eﬀicient protocols in this setting. Finally, we evaluate the performance of our LOVE protocol in different application scenarios by benchmarking an implementation using BN, BLS12 and BLS24 pairing-friendly curves. Interestingly, compared to Di Crescenzo et al.’s protocol, LOVE is up to 29.7% faster for the client, up to 24.9% for the server and requires 23- 24% less communication cost depending on the choice of parameters. Furthermore, we note that our LOVE protocol is especially suited for subgroup-secure groups: checking the correctness of the delegated pairing requires up to 56.2% less computations than evaluating the pairing locally (no delegation). This makes LOVE the most eﬀicient protocol to date for securely outsourcing the computation of a pairing with online public inputs, even when the server is malicious.The problem of securely outsourcing the computation of a bilinear pairing has been widely investigated in the literature. Designing an eﬀicient protocol with the desired functionality has, however, been an open challenge for a long time. Recently, Di Crescenzo et al. (CARDIS’20) proposed the first suite of protocols for securely and eﬀiciently delegating pairings with online inputs under the presence of a malicious server. We progress along this path with the aim of LOVE (Lowering the cost of Outsourcing and Verifying Eﬀiciently) a pairing. Our contributions are threefold. First, we propose a protocol (LOVE) that improves the eﬀiciency of Di Crescenzo et al.’s proposal for securely delegating pairings with online, public inputs. Second, we provide the first implementation of eﬀicient protocols in this setting. Finally, we evaluate the performance of our LOVE protocol in different application scenarios by benchmarking an implementation using BN, BLS12 and BLS24 pairing-friendly curves. Interestingly, compared to Di Crescenzo et al.’s protocol, LOVE is up to 29.7% faster for the client, up to 24.9% for the server and requires 23- 24% less communication cost depending on the choice of parameters. Furthermore, we note that our LOVE protocol is especially suited for subgroup-secure groups: checking the correctness of the delegated pairing requires up to 56.2% less computations than evaluating the pairing locally (no delegation). This makes LOVE the most eﬀicient protocol to date for securely outsourcing the computation of a pairing with online public inputs, even when the server is malicious.

About this website

Wed, 05 May 2021 00:00:00 +0000

How did I build this website?

For academics, I think having a personal website is quite important as it allows you to quickly advertise news, collect and organize your work, and, most importantly, it is a great way for everyone around the world to know you exist and what you’re up to.

For several years I have used jekyll, but it started to get messy with the latest OS updates and gem versions. So for this website I’m using hugo, it does have a steep learning curve for beginners, but I’m really loving it ❤️
Here’s a quick comparison between hugo and jekyll.

4 LaTeX

Tue, 27 Apr 2021 10:00:00 +0000

Handy links for LaTeX

Detexify automatic recognition of handwritten symbols
latex-arrows visual list of latex commands for different types of arrows and more (e.g., very useful LaTeX for Beginners F.A.Q.)
latexpand to automatically combine all latex files into a single file. (If full latex is installed, you just need to type this command line: latexpand -empty-comments -o main_one_file.tex main.tex the long file output will appear in the Terminal)
mathcha for creating tikz pictures in a more eye-friendly way
FreeTikZ to transform handwritten diagrams into tikz
TikZiT GUI editor for graphs and string diagrams
CryptoBib the database that contains references to all iacr publications (remember to periodically download the latest version, which includes the most recent publications)
CryptoBib Search online tool for easy searching references in the crypto bib!

GIT &co

Tue, 27 Apr 2021 10:00:00 +0000

Handy links for GIT

Git is an amazing tool for collaborative projects. In a nutshell, it enables version controlling of whatever collection of digital data you log in it. When writing a paper with other people, git makes it easy to trace changes, to ensure everyone can reach the most recent version of the text / code / experiments, and, if needed, to revert in time to restore previous versions. As a PhD student, if you want to do research with me, knowing how to navigate git is a prerequisite.

Interesting Readings (Research Articles)

Tue, 27 Apr 2021 10:00:00 +0000

The body of literature around cryptographic techniques and provable security is enormous. To help newcomers approach the community I am collecting a list of nice papers that hopefully provide an easy introduction to the main branches of cryptography and the way formal reasoning works.

New Directions in Cryptoraphy by Diffie and Hellman, in IEEE Transactions on information theory, 1978.

This is THE Diffie Hellman paper, the stepping stone into public-key and computational cryptography. A must read for every cryptographer, at least once in a lifetime (and every now and then, as a reminder that simple explanations are possible, good and long-standing)

Nice Books

Tue, 27 Apr 2021 10:00:00 +0000

📙 Captivate: The Science of Succeeding with People by Vanessa Van Edwards

📙 Develop Your Presentation Skills: How to Inspire and Inform with Clarity and Confidence by Theo Theobald

📙 From Research to Manuscript A Guide to Scientific Writing by Michael Jay Katz

Podcasts on Cryptography & Security

Tue, 27 Apr 2021 10:00:00 +0000

List of nice podcast about Cryptography and Real world Security

🎧 Darknet Diaries, fascinating interviews and stories about several famous event and people (enjoyable even if you are not tech-savvy).

🎧 Cryptography FM, interviews and discussions about recent progresses in cryptography. Particularly relevant for PhD students and people that study and work with cryptography.

Resources for presentations

Tue, 27 Apr 2021 10:00:00 +0000

Looking for Copyright-free material for slides?

Here’s some useful links to images databases: pikwizard, freepik, unsplash, pxfuel.

Here’s my go-to place for free clipart, and icons

My favorites: emojis, streamline uft8, emojis for latex

Tools to help you visualize the size of things

When numbers are so big that it’s too hard to get an understanding of their magnitude some resources might come handy: the mesure of things to compare the quantity to other more-or-less well-known things; or numbermatics to get facts on the number itself.

Things you should know

Tue, 27 Apr 2021 10:00:00 +0000

This post contains some common Q&A for PhD students:

Q: Where can I look for papers to read and study?

A: In the beginning of your PhD, start by looking at the list of accepted papers at top- and mid-level conferences. You can do this by googling the conference name, a year and search for a link of ‘accepted papers’ or ‘program’. [Names of conferences: CRYPTO, EUROCRYPT, ASIACRYPT, PKC, Theory of Cryptography Conference] Some conferences also provide video recordings of the presentations (which is a time-efficient way to get what the paper is about). Following this strategy you will most likely encounter solid results and work of good quality.

Tipps for Good Teaching Practice

Tue, 27 Apr 2021 10:00:00 +0000

Tipps for Good Teaching Practice

As part of your PhD education at LTH, you will take some pedagogical courses regarding teaching, learning and how to evaluate students’ learning. But when it comes to it, how do you structure a lecture? Here and here you can find a list of clear and valuable pointers to keep in mind when preparing yourself to this task.

Useful Links

Tue, 27 Apr 2021 10:00:00 +0000

Efficiently decide on a meeting date and time

When2meet lets people fill in their availability in a calendar form, instead of flooding people with numerous options.

What was the Latex command for that symbol?

Detexify automatic recognition of handwritten symbols

Good English

Ngram Viewer is a useful tool that checks how frequent a certain word, name or expression (sequence of few words) is common in the English literature. It is a simple way to check correctness of words bending and preposition for non-native speakers.

Print own good looking calendar with Swedish common holidays “red days”?

Timeanddate provides free nice layouts if you do not mind their logo

Visualize `.md` file and more on MacOSX

Glance (also available on the applestore)
pandoc to easily turnmd files into pdf files (actually, it turns almost anything to almost anything)
Eisvogel for a nice formatting of the output (command line: pandock example.md -o example.pdf --template eisvogel --listingss)

Finding subtle bias in job ads

Gender Decoder

What is Cryptography?

Tue, 27 Apr 2021 10:00:00 +0000

What is Cryptography?

Here’s a quick video explaining the magic you can do with cryptography.

If you are working with me, chances are that we stumble upon some cryptographic primitive, security proof, or privacy challenge. In order to have fruitful discussion, it is very important that you get an understanding of the general framework used in cryptography, how primitives are formalized and how to reason about security model, attackers and proofs.

Wondering what other researchers think?

Tue, 27 Apr 2021 10:00:00 +0000

Mentoring videos by the IACR community

The International Association for Cryptologic Research (IACR) launched an initiative to provide advice for researchers in early stages (students and junior faculty) and women researchers in the area of cryptography. In this series of videos you can listen to the answers a pool of community members gives to a wide range of questions, most of which you will stumble upon at a certain point in your academic career.

Working with me and at Chalmers

Tue, 27 Apr 2021 10:00:00 +0000

Meet me, and my research projects

🎬 I’m a Cryptographer, I’m paid to be paranoid

🎬 Future-Oriented Research: “Enhancing Data Authentication”

How does it feel to be a PhD student at Chalmers?

🎬 Interview to a first year PhD student

Yggdrasil: Privacy-aware Dual Deduplication in Multi Client Settings

Thu, 15 Apr 2021 14:00:00 +0000

This paper proposes Yggdrasil, a protocol for privacy-aware dual data deduplication in multi client settings. Yggdrasil is designed to reduce the cloud storage space while safeguarding the privacy of the client’s outsourced data. Yggdrasil combines three innovative tools to achieve this goal. First, generalized deduplication, an emerging technique to reduce data footprint. Second, non-deterministic transformations that are described compactly and improve the degree of data compression in the Cloud (across users). Third, data preprocessing in the clients in the form of lightweight, privacy-driven transformations prior to upload. This guarantees that an honest-but-curious Cloud service trying to retrieve the client’s actual data will face a high degree of uncertainty as to what the original data is. We provide a mathematical analysis of the measure of uncertainty as well as the compression potential of our protocol. Our experiments with a HDFS log data set shows that 49 % overall compression can be achieved, with clients storing only 12 % for privacy and the Cloud storing the rest. This is achieved while ensuring that each fragment uploaded to the Cloud would have 10293 possible original strings from the client. Higher uncertainty is possible, with some reduction of compression potential.

What's the next deadline???

Fri, 01 Jan 2021 10:00:00 +0000

Check out my selection of deadlines for conference on stuff I like to do research on (sporadically updated).

Where are you Bob? Privacy-Preserving Proximity Testing with a Napping Party

Wed, 16 Sep 2020 10:00:00 +0000

Location based services (LBS) extensively utilize proximity testing to help people discover nearby friends, devices, and services. Current practices rely on full trust to the service providers: users share their locations with the providers who perform proximity testing on behalf of the users. Unfortunately, location data has been often breached by LBS providers, raising privacy concerns over the current practices. To address these concerns previous research has suggested cryptographic protocols for privacy-preserving location proximity testing. Yet general and precise location proximity testing has been out of reach for the current research. A major roadblock has been the requirement by much of the previous work that for proximity testing between Alice and Bob both must be present online. This requirement is not problematic for one-to-one proximity testing but it does not generalize to one-to-many testing. Indeed, in settings like ridesharing, it is desirable to match against ride preferences of all users, not necessarily ones that are currently online. This paper proposes a novel privacy-preserving proximity testing protocol where, after providing some data about its location, one party can go offline (nap) during the proximity testing execution, without undermining user privacy. We thus break away from the limitation of much of the previous work where the parties must be online and interact directly to each other to retain user privacy. Our basic protocol achieves privacy against semi-honest parties and can be upgraded to full security (against malicious parties) in a straight forward way using advanced cryptographic tools. Finally, we reduce the responding client overhead from quadratic (in the proximity radius parameter) to constant, com- pared to the previous research. Analysis and performance experiments with an implementation confirm our findings.

Secure Generalized Deduplication via Multi-Key Revealing Encryption

Tue, 15 Sep 2020 00:00:00 +0000

Cloud Storage Providers (CSPs) offer solutions to relieve users from locally storing vast amounts of data, including personal and sensitive ones. While users may desire to retain some privacy on the data they outsource, CSPs are interested in reducing the total storage space by employing compression techniques such as deduplication. We propose a new cryptographic primitive that simultaneously realizes both requirements: Multi-Key Revealing Encryption (MKRE). The goal of MKRE is to disclose the result of a predefined function over multiple ciphertexts, even if the ciphertexts were generated using different keys, while revealing nothing else about the data. We present a formal model and a security definition for MKRE and provide a construction of MKRE for generalized deduplication that only uses symmetric key primitives in a black-box way. Our construction allows (a) cloud providers to reduce the storage space by using generalized deduplication to compress encrypted data across users, and (b) each user to maintain a certain privacy level for the outsourced information. Our scheme can be proven secure in the random oracle model (and we argue that this is a necessary evil). We develop a proof-of-concept implementation of our solution. For a test data set, our MKRE construction achieves secure generalized deduplication with a compression ratio of 87% for 1KB file chunks and 82.2% for 8KB chunks. Finally, our experiments show that, compared to generalized deduplication setup with un-encrypted files, adding privacy via MKRE introduces a compression overhead of less than 3% and reduces the storage throughput by at most 6.9%.

TOPPool: time-aware optimized privacy-preserving ridesharing

Sun, 15 Sep 2019 00:00:00 +0000

Ridesharing is revolutionizing the transportation industry in many countries. Yet, the state of the art is based on heavily centralized services and platforms, where the service providers have full possession of the users’ location data. Recently, researchers have started addressing the challenge of enabling privacy-preserving ridesharing. The initial proposals, however, have shortcomings, as some rely on a central party, some incur high performance penalties, and most do not consider time preferences for ridesharing. TOPPool encompasses ridesharing based on the proximity of end-points of a ride as well as partial itinerary overlaps. To achieve the latter, we propose a simple yet powerful reduction to a private set intersection on trips represented as sets of consecutive road segments. We show that TOPPool includes time preferences while preserving privacy and without relying on a third party. We evaluate our approach on real-world data from the New York’s Taxi & Limousine Commission. Our experiments demonstrate that TOPPool is superior in performance over the prior work: our intersection-based itinerary matching runs in less than 0.3 seconds for reasonable trip length, in contrast, on the same set of trips prior work takes up to 10 hours.

The simplest multi-key linearly homomorphic signature scheme

Sun, 04 Aug 2019 14:00:00 +0000

We consider the problem of outsourcing computation on data authenticated by different users. Our aim is to describe and implement the simplest possible solution to provide data integrity in cloud-based scenarios. Concretely, our multi-key linearly homomorphic signature scheme (mklhs) allows users to upload signed data on a server, and at any later point in time any third party can query the server to compute a linear combination of data authenticated by different users and check the correctness of the returned result. Our construction generalizes Boneh et al.’s linearly homomorphic signature scheme (PKC’09 [7]) to the multi-key setting and relies on basic tools of pairing-based cryptography. Compared to existing multi-key homomorphic signature schemes, our mklhs is a conceptually simple and elegant direct construction, which trades-off privacy for efficiency. The simplicity of our approach leads us to a very efficient construction that enjoys significantly shorter signatures and higher performance than previous proposals. Finally, we implement mklhs using two different pairing-friendly curves at the 128-bit security level, a Barreto-Lynn-Scott curve and a Barreto-Naehrig curve. Our benchmarks illustrate interesting performance trade-offs between these parameters, involving the cost of exponentiation and hashing in pairing groups. We provide a discussion on such trade-offs that can be useful to other implementers of pairing-based protocols.

SAID: Reshaping Signal into an Identity-Based Asynchronous Messaging Protocol with Authenticated Ratcheting

Fri, 07 Jun 2019 00:00:00 +0000

As messaging applications are becoming increasingly popular, it is of utmost importance to analyze their security and mitigate existing weaknesses. This paper focuses on one of the most acclaimed messaging applications: Signal. Signal is a protocol that provides end-to-end channel security, forward secrecy, and post-compromise security. These features are achieved thanks to a key-ratcheting mechanism that updates the key material at every message. Due to its high security impact, Signal’s key-ratcheting has recently been formalized, along with an analysis of its security. In this paper, we revisit Signal, describing some attacks against the original design and proposing SAID: Signal Authenticated and IDentity-based. As the name indicates, our protocol relies on an identity-based setup, which allows us to dispense with Signal’s centralized server. We use the identity-based long-term secrets to obtain persistent and explicit authentication, such that SAID achieves higher security guarantees than Signal. We prove the security of SAID not only in the Authenticated Key Exchange (AKE) model (as done by previous work), but also in the Authenticated and Confidential Channel Establishment (ACCE) model, which we adapted and redefined for SAID and asynchronous messaging protocols in general into a model we call identity-based Multistage Asynchronous Messaging (iMAM). We believe our model to be more faithful in particular to the true security of Signal, whose use of the message keys prevents them from achieving the composable guarantee claimed by previous analysis.

Multi-key homomorphic authenticators

Mon, 29 Apr 2019 14:00:00 +0000

Homomorphic authenticators (HAs) enable a client to authenticate a large collection of data elements m_1,…,m_t and outsource them, along with the corresponding authenticators, to an untrusted server. At any later point, the server can generate a short authenticator sigma_(f,y) vouching for the correctness of the output y of a function f computed on the outsourced data, i.e., y = f(m_1,…,m_t). Recently researchers have focused on HAs as a solution, with minimal communication and interaction, to the problem of delegating computation on outsourced data. The notion of HAs studied so far, however, only supports executions (and proofs of correctness) of computations over data authenticated by a single user. Motivated by realistic scenarios (ubiquitous computing, sensor networks, etc.) in which large datasets include data provided by multiple users, we study the concept of multi-key homomorphic authenticators. In a nutshell, multi-key HAs are like HAs with the extra feature of allowing the holder of public evaluation keys to compute on data authenticated under different secret keys. In this paper, we introduce and formally define multi-key HAs. Secondly, we propose a construction of a multi-key homomorphic signature based on standard lattices and supporting the evaluation of circuits of bounded polynomial depth. Thirdly, we provide a construction of multi-key homomorphic MACs based only on pseudorandom functions and supporting the evaluation of low-degree arithmetic circuits. Albeit being less expressive and only secretly verifiable, the latter construction presents interesting efficiency properties.

HIKE: Walking the Privacy Trail

Sat, 07 Jul 2018 14:00:00 +0000

We consider the problem of privacy-preserving processing of outsourced data in the context of user-customised services. Clients store their data on a server. In order to provide user-dependent services, service providers may ask the server to compute functions on the users’ data. We propose a new solution to this problem that guarantees data privacy (i.e., an honest-but-curious server cannot access plaintexts), as well as that service providers can correctly decrypt only –functions on– the data the user gave them access to (i.e., service providers learn nothing more than the result of user-selected computations). Our solution has as base point a new secure labelled homomorphic encryption scheme (LEEG). LEEG supports additional algorithms (FEET) that enhance the scheme’s functionalities with extra privacy-oriented fea- tures. Equipped with LEEG and FEET, we define HIKE: a lightweight protocol for private and secure storage, computation and disclosure of users’ data. Finally, we implement HIKE and benchmark its performances demonstrating its succinctness and efficiency.

Matrioska: A Compiler for Multi-Key Homomorphic Signatures

Tue, 05 Jun 2018 14:00:00 +0000

Multi-Key Homomorphic Signatures (MK-HS) enable clients in a system to sign and upload messages to an untrusted server. At any later point in time, the server can perform a computation C on data provided by t different clients, and return the output y and a short signature vouching for the correctness of y as the output of the function C on the signed data. Interestingly, MK-HS enable verifiers to check the validity of the signature using solely the public keys of the signers whose messages were used in the computation. Moreover, the signatures are succinct, namely their size depends at most linearly in the number of clients, and only logarithmically in the total number of inputs of C. Existing MK-HS are constructed based either on standard assumptions over lattices (Fiore et al., ASIACRYPT’16), or on non-falsifiable assumptions (SNARKs) (Lai et al., ePrint’16). In this paper, we investigate connections between single-key and multi-key homomorphic signatures. We propose a generic compiler, called Matrioska, which turns any (sufficiently expressive) single-key homomorphic signature scheme into a multi-key scheme. Matrioska establishes a formal connection between these two primitives and is the first alternative to the only known construction under standard falsifiable assumptions. Our result relies on a novel technique that exploits the homomorphic property of a single-key HS scheme to compress an arbitrary number of signatures from t different users into only t signatures.

HB+DB: Distance bounding meets human based authentication

Mon, 01 Jan 2018 14:00:00 +0000

Authentication for resource-constrained devices is seen as one of the major challenges in current wireless communication networks. The HB+ protocol by Juels and Weis provides device authentication based on the learning parity with noise (LPN) problem and is appropriate for resource-constrained devices, but it has been shown to be vulnerable to a simple man-in-the-middle attack. Subsequent work has focused on modifying the cryptographic properties of the original protocol to mitigate this problem. We propose that this attack could be mitigated using physical layer measures from distance-bounding protocols and simple modifications to devices’ radio receivers. We take the HB+ as a reference protocol and combine it with distance-bounding techniques. This hybrid solution, the HB+DB protocol is shown to provide resistance against the man-in-the-middle attacks on HB+ as a result of the additional physical-layer mechanisms. We analyze the security of the proposed HB+DB protocol against active man-in-the-middle attacks and present experiments showing how it is practically possible to limit the success of a practical man-in-the-middle attack. We also briefly discuss the possibility that HB+DB could provide some resistance to basic threats scenarios meant to be mitigated by distance-bounding protocols. We make a practical implementation to verify that our proposed method is feasible. Finally, we discuss a proof-of-concept channel for our scheme implemented on a platform equivalent in resources to a contactless smart card/NFC device.

Anonymous Single-Round Server-Aided Verification

Mon, 04 Dec 2017 14:00:00 +0000

Server-Aided Verification (SAV) is a method that can be em- ployed to speed up the process of verifying signatures by letting the verifier outsource part of its computation load to a third party. Achieving fast and reliable verification under the presence of an untrusted server is an attractive goal in cloud computing and internet of things scenarios. In this paper, we describe a simple framework for SAV where the interaction between a verifier and an untrusted server happens via a single-round protocol. We propose a security model for SAV that refines existing ones and includes the new notions of SAV-anonymity and extended unforgeability. In addition, we apply our definitional framework to provide the first generic transformation from any signature scheme to a single-round SAV scheme that incorporates verifiable computation. Our compiler identifies two independent ways to achieve SAV-anonymity: computationally, through the privacy of the verifiable computation scheme, or unconditionally, through the adaptibility of the signature scheme. Finally, we define three novel instantiations of SAV schemes obtained through our compiler. Compared to previous works, our proposals are the only ones which simultaneously achieve existential unforgeability and soundness against collusion.

Revisiting Yasuda et al.’s Biometric Authentication Protocol: Are you Private Enough?

Mon, 04 Dec 2017 14:00:00 +0000

Biometric Authentication Protocols (BAPs) have increasingly been employed to guarantee reliable access control to places and services. However, it is well-known that biometric traits contain sensitive information of individuals and if compromised could lead to serious security and privacy breaches. Yasuda et al. [23] proposed a distributed privacy-preserving BAP which Abidin et al. [1] have shown to be vulnerable to biometric template recovery attacks under the presence of a malicious computational server. In this paper, we fix the weaknesses of Yasuda et al.’s BAP and present a detailed instantiation of a distributed privacy-preserving BAP which is resilient against the attack presented in [1]. Our solution employs Backes et al.’s [4] verifiable computation scheme to limit the possible misbehaviours of a malicious computational server.

Two-hop Distance-Bounding Protocols: Keep your Friends Close

Thu, 09 Nov 2017 14:00:00 +0000

Distance-bounding (DB) protocols are cross-layer authentication protocols that are based on the round-trip-time of challenge-response exchanges and can be employed to guarantee physical proximity and combat relay attacks. However, traditional DB protocols rely on the assumption that the prover is in the communication range of the verifier, which might not be the case in multiple access control scenarios in ubiquitous computing environments or when we need to verify the proximity of our two-hop neighbour in an ad-hoc network. In this paper, we extend traditional DB protocols to a two-hop setting i.e. when the prover is out of the communication range of the verifier and thus, they both need to rely on an untrusted in-between entity to verify proximity. We present a formal framework that captures the most representative classes of existing DB protocols and provide a general method to extend traditional DB protocols to the two-hop case. We analyse the security of two-hop DB protocols and identify connections with the security issues of the corresponding one-hop case. Finally, we demonstrate the correctness of our security analysis and the efficiency of our model by transforming five existing DB protocols to the two-hop setting and we evaluate their performance with simulations.

Privacy-preserving biometric authentication: challenges and directions

Thu, 19 Oct 2017 14:00:00 +0000

An emerging direction for authenticating people is the adoption of biometric authentication systems. Biometric credentials are becoming increasingly popular as a means of authenticating people due to the wide range of advantages that they provide with respect to classical authentication methods (e.g., password-based authentication). The most characteristic feature of this authentication method is the naturally strong bond between a user and her biometric credentials. This very same advantageous property, however, raises serious security and privacy concerns in case the biometric trait gets compromised. In this article, we present the most challenging issues that need to be taken into consideration when designing secure and privacy-preserving biometric authentication protocols. More precisely, we describe the main threats against privacy-preserving biometric authentication systems and give directions on possible countermeasures in order to design secure and privacy-preserving biometric authentication protocols.

Multi-key homomorphic authenticators

Sun, 04 Dec 2016 14:00:00 +0000

Using distance-bounding protocols to securely verify the proximity of two-hop neighbours

Wed, 01 Jul 2015 14:00:00 +0000

Distance-bounding protocols allow devices to cryptographically verify the physical proximity of two parties and is a prominent secure neighbour detection method. We describe how existing distance-bounding protocols could be modified to verify the proximity of both next-hop and two-hop neighbours. This approach allows a node to verify that another node is a physical next-hop neighbour, and also detects legitimate neighbours who make dishonest claims as to who their neighbours are. This approach could prevent dishonest neighbours from hoarding traffic as the result of advertising false two-hop routes.

HB+DB, Mitigating Man-in-the-Middle Attacks Against HB+ with Distance Bounding

Thu, 25 Jun 2015 14:00:00 +0000

Authentication for resource-constrained devices is seen as one of the major challenges in current wireless communication networks.
The HB+ protocol performs device authentication based on the learning parity with noise (LPN) problem and simple computational steps, that renders it suitable for resource-constrained devices such as radio frequency identification (RFID) tags. However, it has been shown that the HB+ protocol as well as many of its variants are vulnerable to a simple man-in-the-middle attack.
We demonstrate that this attack could be mitigated using physical layer measures from distance-bounding and simple modifications to devices’ radio receivers. Our hybrid solution (HB+DB) is shown to provide both effective distance-bounding using a lightweight HB+ -based response function, and resistance against the man-in-the-middle attack to HB+. We provide experimental evaluation of our results as well as a brief discussion on practical requirements for secure implementation.

On the Leakage of Information in Biometric Authentication.

Sun, 14 Dec 2014 15:36:27 +0000

In biometric authentication protocols, a user is authenticated or granted access to a service if her fresh biometric trait matches the reference biometric template stored on the service provider. This matching process is usually based on a suitable distance which measures the similarities between the two biometric templates. In this paper, we prove that, when the matching process is performed using a specific family of distances (which includes distances such as the Hamming and the Euclidean distance), then information about the reference template is leaked. This leakage of information enables a hill-climbing attack that, given a sample that matches the template, could lead to the full recovery of the biometric template (i.e. centre search attack) even if it is stored encrypted. We formalise this “leakage of information” in a mathematical framework and we prove that centre search attacks are feasible for any biometric template defined in Z_q^n (q >= 2) after a number of authentication attempts linear in n. Furthermore, we investigate brute force attacks to find a biometric template that matches a reference template, and hence can be used to run a centre search attack. We do this in the binary case and identify connections with the set-covering problem and sampling without replacement.

Mon, 01 Jan 0001 00:00:00 +0000

Cryptographic Proofs Techniques

Welcome to the webpage of Cryptographic Proofs Techniques this is a PhD-level course designed to enhance your understanding of standard proof techniques commonly employed in the field of provable security. By delving into various topics, we aim to foster a deep understanding of the principles and methodologies that underpin provable security and gain proficiency in the application of standard proof techniques.

Each seminar will be led by a designated speaker who will curate relevant resources, structure the session, and facilitate engaging discussions. These seminars are designed to be highly interactive, encouraging respectful collaboration and the exchange of ideas among participants.

Mon, 01 Jan 0001 00:00:00 +0000

Untitled

About the Cryptography Course TDA352/DIT250

Mon, 01 Jan 0001 00:00:00 +0000

Cryptography Course TDA352/DIT250 - 7.5 credits

For official and updated material please refer to the course page on Canvas. This page collects the first draft of the course material (run in the fall 2022). I share the material with the intention that it serves as resource for:

People willing to learn, but not having the possibility to access Chalmers’s official interfaces.
Teaching staff searching for inspiration.

If you re-use part of this material, I would appreciate you let me know it and in case that you mention/credit my work.

CV

Mon, 01 Jan 0001 00:00:00 +0000

I embedded a current version of my CV below (you might need to wait for a few seconds before it appears, the pdf embedding does not work on mobile devices).

You can also download the PDF here

General Info for Adds

Mon, 01 Jan 0001 00:00:00 +0000

Short Bio

Elena Pagnin is an Assistant Professor at Chalmers University of Technology (Gothenburg, Sweden) since 2022. Her research is focused on public key cryptography, the design of new secure protocols and transparency technologies. She is interested in data authentication, verifiable computations, user privacy and transparency. Her motto is: det är lätt att vara efterklok (it’s easy to be wise in hindsight). For more information visit: https://epagnin.github.io

Professional Biography

Elena Pagnin is an Assistant Professor at Chalmers University of Technology (Gothenburg, Sweden) where she is the head of the Crypto Team since 2022. Prior to that, Elena has been an Associate Senior Lecturer at Lund University (2020-2022), and a Post-doctoral Researcher in the crypto group at Aarhus University (2019-2020).

How to reach me

Mon, 01 Jan 0001 00:00:00 +0000

My office is located in the EDIT Building, room 6482, on the Chalmers Johanneberg Campus.

On Campus

Enter the building via the entrance closest to Maskingränd 2 which looks like this:

Once inside, you’ll find yourself in a small glass lobby. Take the glass door to your left, after few upward steps you will see a large spiral staircase to your right. Take it to floor 6V (not 6Ö). After passing through the glass-and-metal door, my office is the second door on the right. If you take the elevator, use the panel farthest from the entrance and select 6. Exit through the doors opposite where you entered. Otherwise, you will arrive on the Ö side of the building and will need to go half a flight up or down.

My Research

Mon, 01 Jan 0001 00:00:00 +0000

The Research I Like

My research interests lie in the design of advanced public key cryptographic primitives and new cryptographic protocols, mainly for authentication or transparency. I am particularly fascinated by cryptographic applications of mathematical objects and new construction that may derive from it.

Below is a visual overview of my lines of research. Text in black (resp.gray) refers to published papers (resp.work in progress/under submission). Icons identify collaborations with industrial partners, or grant-sponsored research.

Teaching

Mon, 01 Jan 0001 00:00:00 +0000

My Teaching Ethics

I believe that the main factors for great learning outcomes are: trust in the teacher and engagement of the students. When interacting with students my philosophy is to do it all with enthusiasm, be available and remember that we are all learning from each other.

Ongoing Courses

Since fall 2022, I am teaching the CRYPTOGRAPHY course (TDA352/DIT352) for students at Chalmers and Göteborg University. The course is organized in three modules:

The CryptoTeam at Chalmers

Mon, 01 Jan 0001 00:00:00 +0000

The CryptoTeam was started by Elena in 2023.

Members of the Crypto Team at Chalmers

Seniors

Asst. Prof. Elena Pagnin (head of team)
Asst. Prof. Christoph Egger

Post Docs

Shai Levin

PhD Students

🎩 = main advisor; 🦸 = is co-advisor

Tejas Balasaheb Pujari : Foundational Cryptography (🎩 Christoph; 🦸 Elena)
Lucia Lavagnino : Transparency Technologies (🎩 Elena; 🦸 Christoph)
Adrián Pérez Keilty : Progressive and Efficient Verification (🎩 Elena)
Hanna Ek : Signatures with Advanced Properties (🎩 Elena; 🦸 Kelsey)

Former / Graduated Members

PostDoc Kelsey Melissaris
PhD Ivan Oleynikov: Privacy-Preserving Location Proximity Testing (🎩 Elena)

About on Elena Pagnin

Tail-Hammer: Optimized Statistics for Anonymous Committees and Applications

Proofs of sequential communication delays from physical assumptions and their applications

That's AmorE: Amortized Eﬃciency for Pairing Delegation

Universally Composable Interactive and Ordered Multi-Signatures

Multi Designated Verifier Ring Signatures

Updatable Privacy-Preserving Blueprints

CaSCaDE: (Time-Based) Cryptography from Space Communications DElay

Progressive and Efficient Verification for Digital Signatures: Extensions and Experimental Results

Metadata Privacy Beyond Tunneling for Instant Messaging

Swedish

Technical Swedish

Reading Fast(er)

Reading Fast(er)

Academic Integrity

Integrity in Academia

Academic Spam

What is Academic Spam?

PAPR: Publicly Auditable Privacy Revocation for Anonymous Credentials

Bifrost: Secure, Scalable and Efficient File Sharing System Using Dual Deduplication

How does the peer-review system work?

Basics principles of peer-reviewing

What do reviewers look for in a paper?

How to determine quality of papers

How to determine quality of papers

Interview Questions

Secure Cloud Storage with Joint Deduplication and Erasure Protection

CatNap: Practical and actively secure proximity testing with a napping party based on generic MPC techniques

Outsourcing MPC Precomputation for Location Privacy

Progressive And Efficient Verification For Digital Signatures

Count Me In! Extendability for Threshold Ring Signatures

LOVE a Pairing

About this website

How did I build this website?

4 LaTeX

Handy links for LaTeX

GIT &co

Handy links for GIT

Interesting Readings (Research Articles)

Nice Books

Podcasts on Cryptography & Security

List of nice podcast about Cryptography and Real world Security

Resources for presentations

Looking for Copyright-free material for slides?

Tools to help you visualize the size of things

Things you should know

Q: Where can I look for papers to read and study?

Tipps for Good Teaching Practice

Tipps for Good Teaching Practice

Useful Links

Efficiently decide on a meeting date and time

What was the Latex command for that symbol?

Good English

Print own good looking calendar with Swedish common holidays “red days”?

Visualize .md file and more on MacOSX

Finding subtle bias in job ads

What is Cryptography?

What is Cryptography?

Wondering what other researchers think?

Mentoring videos by the IACR community

Working with me and at Chalmers

Meet me, and my research projects

How does it feel to be a PhD student at Chalmers?

Yggdrasil: Privacy-aware Dual Deduplication in Multi Client Settings

What's the next deadline???

Where are you Bob? Privacy-Preserving Proximity Testing with a Napping Party

Secure Generalized Deduplication via Multi-Key Revealing Encryption

TOPPool: time-aware optimized privacy-preserving ridesharing

The simplest multi-key linearly homomorphic signature scheme

SAID: Reshaping Signal into an Identity-Based Asynchronous Messaging Protocol with Authenticated Ratcheting

Multi-key homomorphic authenticators

HIKE: Walking the Privacy Trail

Matrioska: A Compiler for Multi-Key Homomorphic Signatures

HB+DB: Distance bounding meets human based authentication

Anonymous Single-Round Server-Aided Verification

Revisiting Yasuda et al.’s Biometric Authentication Protocol: Are you Private Enough?

Two-hop Distance-Bounding Protocols: Keep your Friends Close

Privacy-preserving biometric authentication: challenges and directions

Multi-key homomorphic authenticators

Using distance-bounding protocols to securely verify the proximity of two-hop neighbours

Visualize `.md` file and more on MacOSX