CS 276 Projects

General

• Study projects involve the survey of a series of research papers on a particular subject. The outcome of the project is a report describing the general problem, and some interesting aspect of the solutions provided in the various papers or of the conceptual and technical contributions of the papers. One or more key results should be stated and proved in the report, possibly filling any gap in the original presentation (see below). A clear description of how the presented result fits into the general picture should also be given. There is no page limit (either minimum or maximum), and reports will be evaluated on technical content (not on length), but we expect that a typical report would be about 3 to 8 pages long.

  Every study project should contain "something old" and "something new". The "something old" is the explanation of some interesting technical aspect of the research papers, and is the main focus of the project. As for the "something new", the intention is that every project should at least a little bit of new technical material. For instance, you could take a claim or lemma that is not proven in the paper (or whose proof is only sketched) and give the full proof. Or, in the case of a theorem stated in asymptotic terms (e.g., "if X has superpolynomial security, then so does Y"), you could translate it into concrete security terms (give the exact form of the reduction: e.g., "if X is (t,q,e)-secure, then Y is (t/2,sqrt(q),10e)-secure"). Or, you could take any security result and say something about how tight it is (e.g., if X is claimed to be (t,q,e)-secure, can you find an attack that (t,q,e/2)-breaks it? what is the best attack you can find against a scheme satisfying the premises of the theorem?). Or, if there is a theorem with a complicated proof, you could take some easier special case and give a simpler proof for that special case. Feel free to be creative in your choice of what you will do. You must state in your proposal what new technical item you will provide.

  If you do a study project, the expectation is that you should take effort to make your report "beautiful". Your report does not have to provide a comprehensive survey of the entire topic area you chose, but the parts it does present should be well thought-out, clearly presented and organized, conceptually cohesive, and easy to read.

• Research projects are of theoretical nature, and are directed to prove a certain result (not previously known). Topics should be chosen so that proofs should not be very hard, and that the final result should be interesting. Since theoretical research is intrinsically inpredictable, it is possible that one month (or twenty years, for that matter) might not be enough to come up with a solution. Partial solutions will be accepted. In case of no results, the project can be turned into a study project on the same topic.

Collaboration

Topics

If you just want to peruse the literature, good places to start include the Journal of Cryptology; conference proceedings from CRYPTO, EUROCRYPT, and ASIACRYPT (these are all available in one convenient location in the Engineering library); and the IACR e-print archive. Many of the papers below can be found online at Springer's LINK service, through the library's INSPEC database (use Melvyl online), or at Citeseer.

Proposals

Your project proposal is due April 5th.

Final reports

You may submit your project report electronically or on paper. I prefer electronic submission, although you may choose either. If you submit the final report electronically, it must be in a format which is easily readable on Unix platforms: that means HTML, Postscript, or PDF is fine (but not Microsoft Word). If you submit on paper, place it in David Wagner's mailbox in Soda Hall (in the mailroom, or outside his office: 765 Soda).

Format of the Report

Advice on writing

• Advice on research and writing
• More resources on writing papers
• Detailed advice on technical writing
• Armando Fox's hints on writing good papers

Example study projects

Amplification of Hardness for One-Way Functions and Permutations.

It is possible to show that if f is a weak one way function (i.e., one-way for a small fraction of the input space), then fk(x1,...,xk) = f(x1),...,f(xk) is a strong one-way function. In general, the probability that an adversary can invert the function goes down (about) exponentially in k. Study other methods of amplifying hardness. One possible focus: If f is a one-way permutation, then there is a way of doing a similar amplification without blowing up the input size of the function --- which is what becomes the length of the key in applications to encryption (a related question can be found in the list of research problems). Another possibility: If f_k is a pseudorandom permutation, composition amplifies its hardness (g_{k,k'}(x) = f_k'(f_k(x)). (A nice project would be to study Luby and Rackoff's work on this, and translate their asymptotic analysis to the concrete security realm.) A third possibility: amplification of PRF's.

References:

• Goldreich's book, sections 2.3 and 2.6
• Luby's book, Chapter 3
• Goldreich, Impagliazzo, Levin, Venkatesen, Zuckerman, "Security-preserving amplification of hardness", FOCS'90.
• Luby, Rackoff, "How to construct pseudorandom permutations from random functions", SIAM J. Computing, vol 17 no 2, April 1988.
• Luby, Rackoff, "Pseudo-random permutation generators and cryptographic composition", STOC 1986.
• Myers, "Efficient Amplification of the Security of Weak Pseudo-Random Function Generators", EUROCRYPT 2001.

Generic algorithms for the discrete log

The discrete log problem plays a key role in public-key cryptography. Several authors have studied the hardness of the discrete log against generic algorithms (i.e., algorithms that use only the group operations, but not anything about the representation of group elements) and obtained interesting hardness results.

References:

• Shoup, Lower bounds for discrete logarithms and related problems, EUROCRYPT'97.
• Schnorr, "Security Of DL-Encryption and Signatures Against Generic Attacks - A Survey", Public-Key Cryptography and Computational Number Theory Conference 2000.

Diffie-Hellman

The discrete log assumption says that the discrete log is hard in some cyclic group G, i.e., given g and u, it is hard to find u so that y=g^u. The Diffie-Hellman (DH) problem is, given g,g^u,g^v, find g^{uv}. The Decision Diffie-Hellman (DDH) problem is to distinguish the distribution (g,g^u,g^v,g^{uv}) from (g,g^u,g^v,g^w). Study the hardness of these problems, their relationships, and their applications to cryptography.

References:

• Boneh, "The Decision Diffie-Hellman problem", 3rd ANTS, LNCS 1423, 1998.
• Maurer, Wolf, "The Diffie-Hellman Protocol", Designs, Codes, and Cryptography, vol. 19, pp. 147-171, 2000.
• Boneh, Lipton, Algorithms for black box fields and their application to cryptography, CRYPTO'96.

Fast message authentication

The Carter-Wegman paradim has been a goldmine of techniques for building fast MACs with provable security properties. Study the underlying proposal and the state-of-the-art schemes. Alternatively, study the HMAC construction (in widespread use in practice) and its provable security properties.

References:

• Krawczyk, LFSR-based hashing and authentication, CRYPTO'94.
• Shoup, On fast and provably secure message authentication based on universal hashing, CRYPTO'96.
• Bellare, Canetti, Krawczyk, Keying hash functions for message authentication, CRYPTO'96. (See also their Cryptobytes paper, on the same web page.)
• Bernstein, Floating-point arithmetic and message authentication. (See particularly Sections 1, 8-10.)
• Black, Halevi, Krawczyk, Krovetz, Rogaway, "UMAC: Fast and secure message authentication", CRYPTO '99.

Pseudorandom Generators from One-Way Functions

The result that allows to base all private-key encryption as well as signature schemes on the existence of one-way funcitons.

References:

• Goldreich Section 3.5
• Luby Chapter 9
• Hastad, Impagliazzo, Levin and Luby. "Construction of a pseudorandom generator from any one-way function," SIAM J. on Computing, 28(4):1364-1396, 1999.

Attacks on RSA

Several innocent-looking restrictions of RSA or ways to implement it as a cryptosystem can yield dramatic security flaws.

References:

• Boneh, "Twenty years of attacks on the RSA cryptosystem", Notices of the AMS 46(2)203-213, 1999.
• Boneh, Joux, and Nguyen, Why Textbook ElGamal and RSA Encryption are Insecure, ASIACRYPT'00.
• Hastad, "Solving simultaneous modular equations of low degree", SICOMP 17(2):336-341, 1988.

Generic composition

There has been a great deal of work recently on how to securely combine symmetric-key encryption (for confidentiality) with symmetric-key message authentication (for integrity), and some surprises resulted. Study this issue, or study recently proposed modes of operation that provide both encryption and integrity all at once.

References:

• Bellare, Namprempre, Authenticated encryption: Relations among notions and analysis of the generic composition paradigm, ASIACRYPT 2000.
• Krawczyk, "The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)", CRYPTO 2001.
• Jutla, "Parallelizable Encryption Mode with Almost Free Message Integrity", EUROCRYPT 2001.

Universal one-way hashes

Universal one-way hashes capture the simple notion that public-key signatures can achieve extra security if the signer includes a random nonce in the signature before hashing, chosen to protect herself from hash collisions. It is natural to expect this will allow us to relax assumptions needed on the hash functions. Study this intuitively appealing idea.

References:

• Bellare, Rogaway, Collision-Resistant Hashing: Towards Making UOWHFs Practical, CRYPTO'97.
• Shoup, A Composition Theorem for Universal One-Way Hash Functions, EUROCRYPT 2000.

Modes of operation

Pick any mode of operation (e.g., CBC, PCBC, and so on) from any crypto textbook (e.g., Schneier's), any standard that uses crypto (e.g., IETF TLS, IETF IPSEC, 802.11b WEP), and any other system of practical interest (e.g., Kerberos). Study what's known in the literature about that mode of encryption. Does it meet standard theoretical definitions of security, like IND-CPA or IND-CCA2? Does it provide strong security in the practical setting where it is used? (This might lead into the statement of an open problem if you pick a mode whose security properties have not been studied formally before, or even to a research project rather than a study project.)

References:

• Vaudenay, "Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC,WTLS...", EUROCRYPT 2002.
• Krawczyk, "The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)", CRYPTO 2001.
• Bellovin, "Problem Areas for the IP Security Protocols", Usenix Security '96.
• Bellovin, Blaze, "Cryptographic Modes of Operation for the Internet", 2nd NIST Workshop on Modes of Operation, 2001.
• Borisov, Goldberg, Wagner, Intercepting Mobile Communications: The Insecurity of 802.11, MOBICOM 2001.
• Bellare, Desai, Jokipii, Rogaway, A Concrete Security Treatment of Symmetric Encryption: Analysis of the DES Modes of Operation, FOCS '97.

Random oracles

As we saw in class, the random oracle model gives a powerful way to model the security properties of cryptographic hash functions, which are important in practice. However, this model has important theoretical limitations (and we use it only because there is nothing better). Learn about the controversy.

References:

• Bellare, Rogaway, "Random oracles are practical: A paradigm for designing efficient protocols, ACM CCS '93.
• Canetti, Goldreich, Halevi, "The Random Oracle Methodology, Revisited", STOC '98.

Forward security

Today's systems are not invulnerable: occasionally machines are broken into, and the intruder gains free reign on that machine for some time before he is discovered and kicked off and the vulnerability is fixed. If machines were to store all their past cryptographic keys, then a single intrusion at time T might compromise all traffic before time T, say. Forward-secure cryptosystems are intended to reduce the window of vulnerability and thereby provide robustness against this sort of failure mode.

References:

• Bellare, Miner, A forward-secure digital signature scheme, CRYPTO'99.
• Bellare, Yee, Forward security in private key cryptography.
• Anderson, Two Remarks on Public Key Cryptology, ACM CCS '98 invited talk.

Cryptographic protocol design

In the computer security community, there has been a great deal of work on verifying the security of cryptographic protocols through formal methods and logics of authentication. That style of work has a very different flavor from the complexity-theoretic notions of security that we've been studying in class. Study that field of research on cryptographic protocols. There has also been recent exciting work on relating that field's formalization of security to the complexity-theoretic notions, which you might want to examine.

• Dolev, Yao, "On the security of public key protocols", IEEE Trans. Information Theory, IT-29(12):198-208, March 1983 (earlier version in FOCS'81).
• Burrows, Abadi, Needham, A Logic of Authentication. (the famous BAN logic)
• Abadi, Rogaway, Reconciling two views of cryptography (The computational soundness of formal encryption), To appear in J. Cryptology.
• Abadi, Needham, Prudent engineering practice for cryptographic protocols
• Anderson, Needham, Robustness principles for public key protocols, CRYPTO'95.
• Anderson, Programming Satan's Computer", LNCS 1000.
• Lampson, Abadi, Burrows, Wobber, Authentication in distributed systems: Theory and practice, ACM Trans. Computer Systems 10, 4 (Nov. 1992), pp 265-310.

Lattices in cryptography

Recently, lattices have found many applications in cryptography. In cryptosystem design, they have been used to construct public-key encryption based on the worst-case hardness of various problems. In cryptanalysis, they have been used to break knapsack encryption, broadcast encryption with low-exponent RSA, subset-sum-based hash functions, and various other schemes. This topic is probably too broad for one project, so you should pick some interesting subset.
References:

• Ajtai, Dwork A public key cryptosystem with wost-case/average-case equivalence. STOC'97.
• Nguyen, Stern, "Cryptanalysis of the Ajtai-Dwork cryptosystem", CRYPTO'98.
• Goldreich, Goldwasser, Halevi Public-key cryptosystems from lattice reduction problems, 1997.
• Micciancio, course notes
• Joux, Stern, "Lattice reduction: a toolbox for the cryptanalyst", J. of Cryptology (1998), 11 (3), 161-185.
• Boneh, "Twenty years of attacks on the RSA cryptosystem", Notices of the AMS 46(2)203-213, 1999. (Read only the parts that use lattices.)

Perfect Zero Knowledge is Contained in co-AM

The result implies that, under standard assumptions, one cannot have statistical zero-knowledge proofs of NP-hard problems. So one needs to use computational zero-knowledge in order to prove everything. This is for people familiar with complexity theory.

References:

• Aiello, Hastad, Statistical zero knowlege languages can be recognized in two rounds. JCSS 42:327-345, 1991.
• Hastad also wrote a note on the paper.

Computationally Private Information Retrieval With polylog Communication

You will have to first study what private information retrieval is.

• Chor, Goldreich, Kushilevitz, Sudan Private Information Retrieval
• Cachin, Micali, Stadler, Computationally Private Information Retrieval with Polylograrithmic Communication, Eurocrypt'99.

Research Projects

• One-way functions from PRF's
  Let F:K x X -> K be a PRF with keyspace K and outputs from K, and define G(K) = F_K(0). Is G guaranteed to be a one-way function? Give a proof or a disproof.
  Reference: Wagner and Goldberg Proofs of security for the Unix password hashing algorithm, ASIACRYPT 2000.
• Randomness-efficient Amplification of Hardness for General One-Way Functions
  Apply the techniques of Impagliazzo's paper referenced below to the case of one-way functions, and show that from a (S,1-1/n)-one way function f:{0,1}^n -> f:{0,1}^n you can get a (S/poly(n),1/n^c)-one way function g:{0,1}^m -> {0,1}^m, where, for fixed c, m=O(n). Proving the existence of hard-core sets for one-way functions is actually much easier than for predicates. The rest of the proof goes unchanged, except that some hashing is needed to keep the output length low. (This is probably the simplest problem in the list.)
  Reference: Impagliazzo Hard core distributions for somewhat hard problems, FOCS'95.
• The Blum-Micali-Yao Generator with a Weak One-Way Permutation
  What can be said about the output of the Blum-Micali-Yao generator when it is constructed starting from a weak one-way permutation? Perhaps the output is indistinguishable from some distribution having large entropy (a similar result was proved for a different kind of generator). If this is true, and the proof has good quantitative parameters, the consequence would be a new, more efficient, transformation of weak one permutations into pseudorandom generators.
  References:
  • Impagliazzo Hard core distributions for somewhat hard problems, FOCS'95. (Contains a result that might be helpful)
  • Goldreich, Nisan, Wigderson, On Yao's XOR Lemma, ECCC TR95-50, 1995 (Revised 1998). (Contains a good exposition of Impagliazzo's result)
  • Nisan Extracting randomness: how and why, 1996. (General reference on entropy, statistical distance, and efficient transformation of certain distributions in certain other ones)
  • Sudan, Trevisan, Vadhan Pseudorandom generators without the XOR Lemma, STOC'99. (The result about the different kind of generator)
  
  
• Even stronger notions of security
  Consider the follow notion of security for symmetric-key encryption, let's call it LOR-CCA3. Define S_b as the selection operator on pairs, i.e., S_0(x,y) = x, S_1(x,y) = y. The scheme is LOR-CCA3 secure if no adversary can guess b, even when given the two oracles E_k o S_b and D_k o S_b (subject to the restriction that the adversary cannot query its encryption oracle on any pair containing a plaintext returned by a previous decryption oracle call, nor query its decryption oracle on any pair containing a previously returned ciphertext). How this notion compare to previous notions? Does LOR-CCA2 imply LOR-CCA3? Does LOR-CCA3 imply LOR-CCA2? Give reductions that are as tight as possible (or separations that are as strong as possible).
• CFB encryption
  Give a correct proof of security for CFB mode encryption. Handle the case of m-bit CFB mode, for small values of m, if you can.

• ---

  The CS276 Instructors, daw@cs.berkeley.edu, http://www.cs.berkeley.edu/~daw/cs276/.