Estendemos o trabalho de Vincent Rijmen e Joan Daemen na estratégia de trilha larga, uma metodologia de projeto para primitivas criptográficas simétricas eficientes e demonstravelmente resistentes às técnicas de criptanálise diferencial e linear. Preocupamo-nos principalmente com a melhoria na eficiência de primitivas projetadas de acordo com a estratégia de trilha larga. Investigamos duas linhas distintas de pesquisa: a aplicabilidade da técnica de bitslicing à implementação em software de primitivas baseadas na estratégia de trilha larga; e o projeto de S-boxes estruturadas com implementação eficiente em hardware e bitslicing, e especificamente, o uso de S-boxes invariantes por rotação, que exibem propriedades vantajosas para implementação. Também implementamos e otimizamos algumas primitivas criptográficas em plataformas de software selecionadas, para substanciar e aprimorar as afirmações de eficiência da estratégia de trilha larga. Ademais, aplicamos nosso conhecimento e técnicas propostas ao projeto de novas primitivas criptográficas altamente eficientes, em particular a função de hash MAELSTROM-0 e a cifra de bloco legada FUTURE. / We extend the work of Vincent Rijmen and Joan Daemen on the Wide Trail strategy, a design methodology for symmetric-key cryptographic primitives which are efficient and provably secure against differential and linear cryptanalysis. We concern ourselves mainly with improving the efficiency of primitives designed according to the Wide Trail strategy. To that end, we investigate two distinct lines of research: the applicability of the bitslicing technique to the software implementation of primitives based on the Wide Trail strategy; and the design of structured S-boxes with efficient implementation in hardware and bitslicing, and specifically, the use of rotation-symmetric S-boxes, which exhibit advantageous implementation properties. We also perform general implementation and optimization work on selected software platforms, to further realize the claims of efficiency of the Wide Trail strategy. Additionally, we apply our expertise and proposed techniques to the design of new highly-efficient cryptographic primitives, in particular the hash function MAELSTROM-0 and the legacy-level block cipher FUTURE.

Wireless sensor networks are employed in a wide range of applications including disaster relief operations, forest-fire detection, battlefield surveillance, pollution measurement, and healthcare applications. Because of the characteristics of these applications, a wireless sensor network is more vulnerable to security threats than traditional networks. In order to protect the sensor network from outside attacks, it is necessary to implement a cryptographic mechanism that can achieve three major security objectives: confidentiality, integrity and authentication. Even though the topic of cryptography has been well studied for traditional networks, many conventional cryptographic approaches cannot easily be applied to sensor networks. To illustrate, public key-based schemes and even some symmetric key methods are complex with regards to computations, memory, communication, and packet size requirements. On the other hand, sensor networks suffer from severe constraints on their available resources as a result of the necessity to increase the lifetime of the complete network, minimize the physical size of the sensor nodes, and reduce the cost of sensor nodes. Consequently, it is important to propose cryptographic solutions designed specifically for wireless sensor networks. A fundamental element in an effective cryptographic system is how sensor nodes are equipped with the cryptographic keys needed to create secure radio connections with their local neighbours. This thesis contributes to the challenging field of key establishment by introducing three key agreement schemes whose memory, processing, and communication requirements are low. These methods utilize the concept of third parties, and sometimes also deployment knowledge, to reduce the cryptographic burden of public-key based schemes and the key management overhead of symmetric key approaches. The proposed methods employ just a few simple hash operations in the sensor nodes. Furthermore, additional nodes called third parties are deployed to assist sensor nodes in the key establishment phase. Our key agreement schemes have many advantages over existing approaches. For instance, a sensor node in these schemes needs to make just a few local contacts to establish a secure radio connection with its neighbours with very high probability. In addition, the majority of sensor nodes must store only a small number of secret keys in their memory. These methods also employ an authentication mechanism to prevent impersonation attacks. / Graduate

Estendemos o trabalho de Vincent Rijmen e Joan Daemen na estratégia de trilha larga, uma metodologia de projeto para primitivas criptográficas simétricas eficientes e demonstravelmente resistentes às técnicas de criptanálise diferencial e linear. Preocupamo-nos principalmente com a melhoria na eficiência de primitivas projetadas de acordo com a estratégia de trilha larga. Investigamos duas linhas distintas de pesquisa: a aplicabilidade da técnica de bitslicing à implementação em software de primitivas baseadas na estratégia de trilha larga; e o projeto de S-boxes estruturadas com implementação eficiente em hardware e bitslicing, e especificamente, o uso de S-boxes invariantes por rotação, que exibem propriedades vantajosas para implementação. Também implementamos e otimizamos algumas primitivas criptográficas em plataformas de software selecionadas, para substanciar e aprimorar as afirmações de eficiência da estratégia de trilha larga. Ademais, aplicamos nosso conhecimento e técnicas propostas ao projeto de novas primitivas criptográficas altamente eficientes, em particular a função de hash MAELSTROM-0 e a cifra de bloco legada FUTURE. / We extend the work of Vincent Rijmen and Joan Daemen on the Wide Trail strategy, a design methodology for symmetric-key cryptographic primitives which are efficient and provably secure against differential and linear cryptanalysis. We concern ourselves mainly with improving the efficiency of primitives designed according to the Wide Trail strategy. To that end, we investigate two distinct lines of research: the applicability of the bitslicing technique to the software implementation of primitives based on the Wide Trail strategy; and the design of structured S-boxes with efficient implementation in hardware and bitslicing, and specifically, the use of rotation-symmetric S-boxes, which exhibit advantageous implementation properties. We also perform general implementation and optimization work on selected software platforms, to further realize the claims of efficiency of the Wide Trail strategy. Additionally, we apply our expertise and proposed techniques to the design of new highly-efficient cryptographic primitives, in particular the hash function MAELSTROM-0 and the legacy-level block cipher FUTURE.

Supervisory Control and Data Acquisition (SCADA) systems are responsible for automatic control of several critical infrastructures like power grids. An important requirement of SCADA systems is to provide cryptographic protection of its communications. Many key management schemes have been proposed to provide cryptographic protection. But cryptographic modules are seen as more appropriate solution as it provides cryptographic protection of keys. Recently I has proposed a draft standard SCADA cryptographic module(SCM) which provides direct link security. The goal of this research is joint design of a comprehensive key distribution scheme for SCADA systems, and the architecture of simple SCM to support key distribution and mutual authentication of messages exchanged between any two SCADA entities. Furthermore, unlike the I module, our SCM will be transparent to the type of SCADA communication protocol employed, and will not be restricted to the Bump in the Wire (BITW) mode of operation.

No description available.

Cryptographic protocols are in general difficult to analyze, and complicated attacks exposing security flaws have remained hidden years after a protocol is developed. Recently developed tools such as strand spaces and inductive logical proofs provide mechanical procedures for analyzing protocols. The key to these methods is that a generous upper bound on the activity of a malicious penetrator is often much easier to work with than a tighter bound. However, these formalizations make strong assumptions about the algebraic structure of the cryptosystem that are never met in a real application. In this work, we show that an extended form of the strand space machinery can be used to analyze protocols which contain nontrivial algebraic structure, specifically that which arises from the XOR operation. This work also serves as one of the first steps in reconciling computational and formal methods of analyzing cryptographic security.

<p>Authenticated Group Key Agreement Protocols are protocols allowing a group of principals to contributively generate a key by the exchange of messages on a network possibly controlled by an attacker. Furthermore, their execution also guarantees all group members that the key they obtained can only be known by the other intended protocol participants. These protocols can be exploited in many applications such as audio or videoconferencing, replicated servers (such as database, web, time servers), chat or network games for instance.</p> <p>AGKAP's present several particularities that make them interesting case studies for research in the theory of security. At first, the consideration of the number of protocol participants as a parameter raises several complexity problems that are not present in the classical two or three-party frameworks. Furthermore, up to now, the security properties of group protocols have roughly been considered as direct extensions of two-party properties, what does not capture several plausible attack scenarios. A second interesting aspect of the analysis of AGKAP's is the consideration of Diffie-Hellman-type primitives, that present properties out of the scope of most classical models.</p> <p>We started our study with the construction of a simple model for the analysis of a classical family of protocols: the Cliques AGKAP's. This allowed us to discover several attacks and define different flavors of group security properties. We then tried to fix these protocols, what led us to extend our model in order to prove that it is in fact impossible to build a secure AGKAP based on the same design assumptions as the Cliques protocols. Finally, we designed a new AGKAP based on different cryptographic primitives (signature and hash functions) for which we proved authentication, freshness and secrecy properties. A comparison with a similar AGKAP developed in parallel to ours is also proposed.</p>

In cryptographic processor design, the selection of functional primitives and connection structures between these primitives are extremely crucial to maximize throughput and flexibility. Hence, detailed analysis on the specifications and requirements of existing crypto-systems plays a crucial role in cryptographic processor design. This thesis provides the most comprehensive literature review that we are aware of on the widest range of existing cryptographic algorithms, their specifications, requirements, and hardware structures. In the light of this analysis, it also describes a high performance, low power, and highly flexible cryptographic processor, Cryptoraptor, that is designed to support both today's and tomorrow's encryption standards. To the best of our knowledge, the proposed cryptographic processor supports the widest range of cryptographic algorithms compared to other solutions in the literature and is the only crypto-specific processor targeting the future standards as well. Unlike previous work, we aim for maximum throughput for all known encryption standards, and to support future standards as well. Our 1GHz design achieves a peak throughput of 128Gbps for AES-128 which is competitive with ASIC designs and has 25X and 160X higher throughput per area than CPU and GPU solutions, respectively. / text

Location-based services (LBS) are available on a variety of mobile platforms like cell phones, PDA's, etc. and an increasing number of users subscribe to and use these services. Two of the popular models of information flow in LBS are the client-server model and the peer-to-peer model, in both of which, existing approaches do not always provide privacy for all parties concerned. In this work, I study the feasibility of applying cryptographic protocols to design privacy-preserving solutions for LBS from an experimental and theoretical standpoint. In the client-server model, I construct a two-phase framework for processing nearest neighbor queries using combinations of cryptographic protocols such as oblivious transfer and private information retrieval. In the peer-to-peer model, I present privacy preserving solutions for processing group nearest neighbor queries in the semi-honest and dishonest adversarial models. I apply concepts from secure multi-party computation to realize our constructions and also leverage the capabilities of trusted computing technology, specifically TPM chips. My solution for the dishonest adversarial model is also of independent cryptographic interest. I prove my constructions secure under standard cryptographic assumptions and design experiments for testing the feasibility or practicability of our constructions and benchmark key operations. My experiments show that the proposed constructions are practical to implement and have reasonable costs, while providing strong privacy assurances.

In this work, we study the cryptographic primitive: signcryption, which combines the functionalities of digital signatures and public-key encryption. We first propose two generic transforms from meta-ElGamal signature schemes to signcryption schemes. These constructions can be thought of as generalisations of the signcryption schemes by Zheng and Gamage et al. Our results show that a large class of signcryption schemes are outsider IND-CCA2 secure and insider UF-CMA secure. As a by-product, we also show that the meta-ElGamal signature schemes, for which no previous formal security proofs have been shown, are UF-CMA secure. We then propose a modification of one of the transforms in order to achieve insider IND-CCA2 security in addition to insider UF-CMA security. This modification costs just one extra exponential operation. In particular, we can apply this modification to the Zheng signcryption scheme to make it fully insider secure. Finally, we propose a generic transform from a two-key signcryption scheme to a one-key signcryption scheme while preserving both confidentiality and unforgeability. Our result shows that if we have an insider IND-CCA2 and UFCMA secure two-key signcryption scheme, then it can be turned into an insider IND-CCA2 and UF-CMA secure one-key signcryption scheme. We also show that an insider IND-CCA2 and UF-CMA secure one-key signcryption scheme induces a secure combined public-key scheme; that is, a combination of a signature scheme and a public-key encryption scheme that can securely share the same key pair. Combining previous results suggests that we can obtain a large class of insider secure one-key signcryption schemes from meta-ElGamal signature schemes, and that each of them can induce a secure combined public-key scheme.