a590003

alternatives: mis (based on mutual information) and ss (based on the classical notion of semantic
security). We prove them equivalent, thereby connecting two fundamentally different ways of
defining privacy and providing a new, strong and well-founded target for constructions. On the
second front (schemes), we provide the first explicit scheme with all the following
characteristics: it is proven to achieve both security (ss and mis, not just mis-r) and decodability;
it has optimal rate; and both the encryption and decryption algorithms are proven to be
polynomialtime.
14. “Multi-Instance Security and its Application to Password-Based Cryptography,” by
Mihir Bellare, Thomas Ristenpart, and Stephano Tessaro[25]
This paper develops a theory of multi-instance (mi) security and applies it to provide the first
proof-based support for the classical practice of salting in password-based cryptography. Misecurity
comes into play in settings (like password-based cryptography) where it is
computationally feasible to compromise a single instance, and provides a second line of defense,
aiming to ensure (in the case of passwords, via salting) that the effort to compromise all of some
large number m of instances grows linearly with m. The first challenge is definitions, where we
suggest LORX-security as a good metric for mi security of encryption and support this claim by
showing it implies other natural metrics, illustrating in the process that even lifting simple results
from the si setting to the mi one calls for new techniques. Next we provide a composition-based
framework to transfer standard single-instance (si) security to mi-security with the aid of a keyderivation
function. Analyzing password-based KDFs from the PKCS#5 standard to show that
they meet our indifferentiability-style mi-security definition for KDFs, we are able to conclude
with the first proof that per password salts amplify mi-security as hoped in practice. We believe
that mi-security is of interest in other domains and that this work provides the foundation for its
further theoretical development and practical application.
15. “To Hash or Not to Hash Again? (In)differentiability Results for H 2 and HMAC,” by
Yevgeniy Dodis, Thomas Ristenpart, John Steinberger, and Stephano Tessaro[26]
We show that the second iterate H 2 (M) = H(H(M)) of a random oracle H cannot achieve strong
security in the sense of indifferentiability from a random oracle. We do so by proving that
indifferentiability for H 2 holds only with poor concrete security by providing a lower bound (via
an attack) and a matching upper bound (via a proof requiring new techniques) on the complexity
of any successful simulator. We then investigate HMAC when it is used as a general-purpose
hash function with arbitrary keys (and not as a MAC or PRF with uniform, secret keys). We
uncover that HMAC’s handling of keys gives rise to two types of weak key pairs. The first
allows trivial attacks against its indifferentiability; the second gives rise to structural issues
similar to that which ruled out strong indifferentiability bounds in the case of H 2 . However, such
weak key pairs do not arise, as far as we know, in any deployed applications of HMAC. For
example, using keys of any fixed length shorter than d − 1, where d is the block length in bits of
the underlying hash function, completely avoids weak key pairs. We therefore conclude with a
positive result: a proof that HMAC is indifferentiable from a RO (with standard, good bounds)
when applications use keys of a fixed length less than d − 1.
16. “Design and Implementation of a Homomorphic-Encryption Library”, by Shai Halevi and
Approved for Public Release; Distribution Unlimited.
15