pinecone/core-2020-05-10-deduplication huggingface dataset:
Verifiable side-channel security of cryptographic implementations: constant-time MEE-CBC

We provide further evidence that implementing software countermeasures against timing attacks is a non-trivial task and requires domain-specific software development processes: we report an implementation bug in the s2n library, recently released by AWS Labs. This bug ( now fixed) allowed bypassing the balancing countermeasures against timing attacks deployed in the implementation of the MAC-then-Encode-then-CBC-Encrypt (MEE-CBC) component, creating a timing side-channel similar to that exploited by Lucky 13.Although such an attack could only be launched when the MEE-CBC component is used in isolation - Albrecht and Paterson recently confirmed in independent work that s2n's second line of defence, once reinforced, provides adequate mitigation against current adversary capabilities - its existence serves as further evidence to the fact that conventional software validation processes are not effective in the study and validation of security properties. To solve this problem, we define a methodology for proving security of implementations in the presence of timing attackers: first, prove black-box security of an algorithmic description of a cryptographic construction; then, establish functional correctness of an implementation with respect to the algorithmic description; and finally, prove that the implementation is leakage secure.We present a proof-of-concept application of our methodology to MEE-CBC, bringing together three different formal verification tools to produce an assembly implementation of this construction that is verifiably secure against adversaries with access to some timing leakage. Our methodology subsumes previous work connecting provable security and side-channel analysis at the implementation level, and supports the verification of a much larger case study. Our case study itself provides the first provable security validation of complex timing countermeasures deployed, for example, in OpenSSL.The first two authors were funded by Project "TEC4Growth - Pervasive Intelligence, Enhancers and Proofs of Concept with Industrial Impact/ NORTE-01-0145-FEDER-000020", which is financed by the North Portugal Regional Operational Programme (NORTE 2020), under the PORTUGAL 2020 Partnership Agreement, and through the European Regional Development Fund (ERDF). The third and fourth authors were supported by projects S2013/ICE-2731 N-GREENS Software-CM and ONR Grants N000141210914 (AutoCrypt) and N00014151 2750 (SynCrypt). The fourth author was supported by FP7 Marie Cure Actions-COFUND 291803 (Amarout II). The machine-checked proof for CBC improves on a script by Benjamin Gregoire and Benedikt Schmidt. Pierre-Yves Strub provided support for extracting Why3 definitions from EasyCrypt specifications. We thank Mathias Pedersen and Bas Spitters for useful comments.info:eu-repo/semantics/publishedVersio
Quantum homomorphic encryption for polynomial-sized circuits

We present a new scheme for quantum homomorphic encryption which is compact
and allows for efficient evaluation of arbitrary polynomial-sized quantum
circuits. Building on the framework of Broadbent and Jeffery and recent results
in the area of instantaneous non-local quantum computation, we show how to
construct quantum gadgets that allow perfect correction of the errors which
occur during the homomorphic evaluation of T gates on encrypted quantum data.
Our scheme can be based on any classical (leveled) fully homomorphic encryption
(FHE) scheme and requires no computational assumptions besides those already
used by the classical scheme. The size of our quantum gadget depends on the
space complexity of the classical decryption function -- which aligns well with
the current efforts to minimize the complexity of the decryption function.
  Our scheme (or slight variants of it) offers a number of additional
advantages such as ideal compactness, the ability to supply gadgets "on
demand", circuit privacy for the evaluator against passive adversaries, and a
three-round scheme for blind delegated quantum computation which puts only very
limited demands on the quantum abilities of the client
Circuit-ABE from LWE: Unbounded Attributes and Semi-adaptive Security

We construct an LWE-based key-policy attribute-based encryption (ABE) scheme that supports attributes of unbounded polynomial length. Namely, the size of the public parameters is a fixed polynomial in the security parameter and a depth bound, and with these fixed length parameters, one can encrypt attributes of arbitrary length. Similarly, any polynomial size circuit that adheres to the depth bound can be used as the policy circuit regardless of its input length (recall that a depth d circuit can have as many as 2d

inputs). This is in contrast to previous LWE-based schemes where the length of the public parameters has to grow linearly with the maximal attribute length.

We prove that our scheme is semi-adaptively secure, namely, the adversary can choose the challenge attribute after seeing the public parameters (but before any decryption keys). Previous LWE-based constructions were only able to achieve selective security. (We stress that the “complexity leveraging” technique is not applicable for unbounded attributes).

We believe that our techniques are of interest at least as much as our end result. Fundamentally, selective security and bounded attributes are both shortcomings that arise out of the current LWE proof techniques that program the challenge attributes into the public parameters. The LWE toolbox we develop in this work allows us to delay this programming. In a nutshell, the new tools include a way to generate an a-priori unbounded sequence of LWE matrices, and have fine-grained control over which trapdoor is embedded in each and every one of them, all with succinct representation.National Science Foundation (U.S.) (Award CNS-1350619)National Science Foundation (U.S.) (Grant CNS-1413964)United States-Israel Binational Science Foundation (Grant 712307
Fine-Grained Cryptography

Fine-grained cryptographic primitives are ones that are secure against adversaries with an a-priori bounded polynomial amount of resources (time, space or parallel-time), where the honest algorithms use less resources than the adversaries they are designed to fool. Such primitives were previously studied in the context of time-bounded adversaries (Merkle, CACM 1978), space-bounded adversaries (Cachin and Maurer, CRYPTO 1997) and parallel-time-bounded adversaries (Håstad, IPL 1987). Our goal is come up with fine-grained primitives (in the setting of parallel-time-bounded adversaries) and to show unconditional security of these constructions when possible, or base security on widely believed separation of worst-case complexity classes. We show:

    1. NC¹-cryptography: Under the assumption that Open image in new window, we construct one-way functions, pseudo-random generators (with sub-linear stretch), collision-resistant hash functions and most importantly, public-key encryption schemes, all computable in NC¹ and secure against all NC¹ circuits. Our results rely heavily on the notion of randomized encodings pioneered by Applebaum, Ishai and Kushilevitz, and crucially, make non-black-box use of randomized encodings for logspace classes.
 
2. AC⁰-cryptography: We construct (unconditionally secure) pseudo-random generators with arbitrary polynomial stretch, weak pseudo-random functions, secret-key encryption and perhaps most interestingly, collision-resistant hash functions, computable in AC⁰ and secure against all AC⁰ circuits. Previously, one-way permutations and pseudo-random generators (with linear stretch) computable in AC⁰ and secure against AC⁰ circuits were known from the works of Håstad and Braverman.United States. Defense Advanced Research Projects Agency (Contract W911NF-15-C-0226)United States. Army Research Office (Contract W911NF-15-C-0226
Semantic Security and Indistinguishability in the Quantum World

At CRYPTO 2013, Boneh and Zhandry initiated the study of quantum-secure
encryption. They proposed first indistinguishability definitions for the
quantum world where the actual indistinguishability only holds for classical
messages, and they provide arguments why it might be hard to achieve a stronger
notion. In this work, we show that stronger notions are achievable, where the
indistinguishability holds for quantum superpositions of messages. We
investigate exhaustively the possibilities and subtle differences in defining
such a quantum indistinguishability notion for symmetric-key encryption
schemes. We justify our stronger definition by showing its equivalence to novel
quantum semantic-security notions that we introduce. Furthermore, we show that
our new security definitions cannot be achieved by a large class of ciphers --
those which are quasi-preserving the message length. On the other hand, we
provide a secure construction based on quantum-resistant pseudorandom
permutations; this construction can be used as a generic transformation for
turning a large class of encryption schemes into quantum indistinguishable and
hence quantum semantically secure ones. Moreover, our construction is the first
completely classical encryption scheme shown to be secure against an even
stronger notion of indistinguishability, which was previously known to be
achievable only by using quantum messages and arbitrary quantum encryption
circuits.Comment: 37 pages, 2 figure
Undecidability of the Lambek calculus with a relevant modality

Morrill and Valentin in the paper "Computational coverage of TLG:
Nonlinearity" considered an extension of the Lambek calculus enriched by a
so-called "exponential" modality. This modality behaves in the "relevant"
style, that is, it allows contraction and permutation, but not weakening.
Morrill and Valentin stated an open problem whether this system is decidable.
Here we show its undecidability. Our result remains valid if we consider the
fragment where all division operations have one direction. We also show that
the derivability problem in a restricted case, where the modality can be
applied only to variables (primitive types), is decidable and belongs to the NP
class.Comment: 17 page
Auto-Parameterized Shape Grammar for Constructing Islamic Geometric Motif-Based Structures

YesThe complex formation of Islamic Geometric Patterns (IGP)
is one of the distinctive features in Islamic art and architecture. Many
have attempted to reproduce these patterns in digital form, using various
pattern generation techniques, in 2D. Shape grammars are an e ective
pattern generation method, providing good aesthetic results. In this pa-
per we describe a novel approach in generating 3D IGP using the shape
grammar method. The particular emphasis here is to generate the motifs
(repeated units with the pattern) in 3D using parameterization. These
can then be manipulated within the 3D space to construct architec-
tural structures. In this work we have developed two distinctive Shape
Grammars in 3D namely Parameterized Shape Grammar (PSG) and
Auto-Parameterized Shape Grammar (APSG). Here the PSG generates
the motifs and the APSG enables construction of the structures using
the generated motifs. Both grammars are practically implemented as a
3D modelling tool within Autodesk Maya. The parameterization within
each grammar is the key to generate both Islamic geometric motifs and
Islamic geometric motif-based structures
Position Automaton Construction for Regular Expressions with Intersection

Positions and derivatives are two essential notions in the conversion methods from regular expressions to equivalent finite automata. Partial derivative based methods have recently been extended to regular expressions with intersection. In this paper, we present a position automaton construction for those expressions. This construction generalizes the notion of position making it compatible with intersection. The resulting automaton is homogeneous and has the partial derivative automaton as its quotient
An abstract approach to polychromatic coloring

The goal of this paper is to give a new, abstract approach to cover-decomposition and polychromatic colorings using hypergraphs on ordered vertex sets. We introduce an abstract version of a framework by Smorodinsky and Yuditsky, used for polychromatic coloring halfplanes, and apply it to so-called ABA-free hypergraphs, which are a generalization of interval graphs. Using our methods, we prove that (2k−1)-uniform ABA-free hypergraphs have a polychromatic k-coloring, a problem posed by the second author. We also prove the same for hypergraphs defined on a point set by pseudohalfplanes. These results are best possible. We also introduce several new notions that seem to be important for investigating polychromatic colorings and ϵ -nets, such as shallow hitting sets. We pose several open problems related to them. For example, is it true that given a finite point set S on a sphere and a set of halfspheres F, such that {S ∩ F | F ∈ F} is a Sperner family, we can select an R ⊂ S such that 1 ≤ |F ∩ R| ≤ 2 holds for every F ∈ F?. © Springer International Publishing Switzerland 2016
Open problems on graph coloring for special graph classes.

For a given graph G and integer k, the Coloring problem is that of testing whether G has a k-coloring, that is, whether there exists a vertex mapping c:V→{1,2,…}c:V→{1,2,…} such that c(u)≠c(v)c(u)≠c(v) for every edge uv∈Euv∈E. We survey known results on the computational complexity of Coloring for graph classes that are hereditary or for which some graph parameter is bounded. We also consider coloring variants, such as precoloring extensions and list colorings and give some open problems in the area of on-line coloring
Algorithms and complexity for metric dimension and location-domination on interval and permutation graphs.

We study the problems Locating-Dominating Set and Metric Dimension, which consist of determining a minimum-size set of vertices that distinguishes the vertices of a graph using either neighbourhoods or distances. We consider these problems when restricted to interval graphs and permutation graphs. We prove that both decision problems are NP-complete, even for graphs that are at the same time interval graphs and permutation graphs and have diameter 2. While Locating-Dominating Set parameterized by solution size is trivially fixed-parameter-tractable, it is known that Metric Dimension is W[2]-hard. We show that for interval graphs, this parameterization of Metric Dimension is fixed-parameter-tractable
The stable fixtures problem with payments.

We generalize two well-known game-theoretic models by introducing multiple partners matching games, defined by a graph G=(N,E)G=(N,E), with an integer vertex capacity function b and an edge weighting w. The set N consists of a number of players that are to form a set M⊆EM⊆E of 2-player coalitions ij with value w(ij), such that each player i is in at most b(i) coalitions. A payoff is a mapping p:N×N→Rp:N×N→R with p(i,j)+p(j,i)=w(ij)p(i,j)+p(j,i)=w(ij) if ij∈Mij∈M and p(i,j)=p(j,i)=0p(i,j)=p(j,i)=0 if ij∉Mij∉M. The pair (M, p) is called a solution. A pair of players i, j with ij∈E∖Mij∈E∖M blocks a solution (M, p) if i, j can form, possibly only after withdrawing from one of their existing 2-player coalitions, a new 2-player coalition in which they are mutually better off. A solution is stable if it has no blocking pairs. We give a polynomial-time algorithm that either finds that no stable solution exists, or obtains a stable solution. Previously this result was only known for multiple partners assignment games, which correspond to the case where G is bipartite (Sotomayor 1992) and for the case where b≡1b≡1 (Biro et al. 2012). We also characterize the set of stable solutions of a multiple partners matching game in two different ways and initiate a study on the core of the corresponding cooperative game, where coalitions of any size may be formed
On the tree search problem with non-uniform costs

Searching in partially ordered structures has been considered in the context of information retrieval and efficient tree-like indices, as well as in hierarchy based knowledge representation. In this paper we focus on tree-like partial orders and consider the problem of identifying an initially unknown vertex in a tree by asking edge queries: an edge query e returns the component of T −e containing the vertex sought for, while incurring some known cost c(e). The Tree Search Problem with Non-Uniform Cost is the following: given a tree T on n vertices, each edge having an associated cost, construct a strategy that minimizes the total cost of the identification in the worst case. Finding the strategy guaranteeing the minimum possible cost is an NP-complete problem already for input trees of degree 3 or diameter 6. The best known approximation guarantee was an O(log n/ log log log n)- approximation algorithm of [Cicalese et al. TCS 2012].We improve upon the above results both from the algorithmic and the computational complexity point of view: We provide a novel algorithm that provides an O(formula presented)-approximation of the cost of the optimal strategy. In addition, we show that finding an optimal strategy is NPhard even when the input tree is a spider of diameter 6, i.e., at most one vertex has degree larger than 2. © Springer-Verlag Berlin Heidelberg 2016
SBBA: a Strongly-Budget-Balanced Double-Auction Mechanism

In a seminal paper, McAfee (1992) presented the first dominant strategy
truthful mechanism for double auction. His mechanism attains nearly optimal
gain-from-trade when the market is sufficiently large. However, his mechanism
may leave money on the table, since the price paid by the buyers may be higher
than the price paid to the sellers. This money is included in the
gain-from-trade and in some cases it accounts for almost all the
gain-from-trade, leaving almost no gain-from-trade to the traders. We present
SBBA: a variant of McAfee's mechanism which is strongly budget-balanced. There
is a single price, all money is exchanged between buyers and sellers and no
money is left on the table. This means that all gain-from-trade is enjoyed by
the traders. We generalize this variant to spatially-distributed markets with
transit costs.Comment: Accepted to SAGT 2016. This full version (14 pages) includes an
  additional exampl
The Parallel Complexity of Coloring Games

International audienceWe wish to motivate the problem of finding decentralized lower-bounds on the complexity of computing a Nash equilibrium in graph games. While the centralized computation of an equilibrium in polynomial time is generally perceived as a positive result, this does not reflect well the reality of some applications where the game serves to implement distributed resource allocation algorithms, or to model the social choices of users with limited memory and computing power. As a case study, we investigate on the parallel complexity of a game-theoretic variation of graph coloring. These " coloring games " were shown to capture key properties of the more general welfare games and Hedonic games. On the positive side, it can be computed a Nash equilibrium in polynomial-time for any such game with a local search algorithm. However, the algorithm is time-consuming and it requires polynomial space. The latter questions the use of coloring games in the modeling of information-propagation in social networks. We prove that the problem of computing a Nash equilibrium in a given coloring game is PTIME-hard, and so, it is unlikely that one can be computed with an efficient distributed algorithm. The latter brings more insights on the complexity of these games
Mining conditional partial order graphs from event logs

Process mining techniques rely on event logs: the extraction of a process model (discovery) takes an event log as the input, the adequacy of a process model (conformance) is checked against an event log, and the enhancement of a process model is performed by using available data in the log. Several notations and formalisms for event log representation have been proposed in the recent years to enable efficient algorithms for the aforementioned process mining problems. In this paper we show how Conditional Partial Order Graphs (CPOGs), a recently introduced formalism for compact representation of families of partial orders, can be used in the process mining field, in particular for addressing the problem of compact and easy-to-comprehend representation of event logs with data. We present algorithms for extracting both the control flow as well as the relevant data parameters from a given event log and show how CPOGs can be used for efficient and effective visualisation of the obtained results. We demonstrate that the resulting representation can be used to reveal the hidden interplay between the control and data flows of a process, thereby opening way for new process mining techniques capable of exploiting this interplay. Finally, we present open-source software support and discuss current limitations of the proposed approach.Peer ReviewedPostprint (author's final draft
Self-tracking reloaded: Applying process mining to personalized health care from labeled sensor data

Currently, there is a trend to promote personalized health care in order to prevent diseases or to have a healthier life. Using current devices such as smart-phones and smart-watches, an individual can easily record detailed data from her daily life. Yet, this data has been mainly used for self-tracking in order to enable personalized health care. In this paper, we provide ideas on how process mining can be used as a fine-grained evolution of traditional self-tracking. We have applied the ideas of the paper on recorded data from a set of individuals, and present conclusions and challenges.Peer ReviewedPostprint (author's final draft
On edge intersection graphs of paths with 2 bends

An EPG-representation of a graph G is a collection of paths in a grid, each corresponding to a single vertex of G, so that two vertices are adjacent if and only if their corresponding paths share infinitely many points. In this paper we focus on graphs admitting EPG-representations by paths with at most 2 bends. We show hardness of the recognition problem for this class of graphs, along with some subclasses. We also initiate the study of graphs representable by unaligned polylines, and by polylines, whose every segment is parallel to one of prescribed slopes. We show hardness of recognition and explore the trade-off between the number of bends and the number of slopes. © Springer-Verlag GmbH Germany 2016
Parameterized vertex deletion problems for hereditary graph classes with a block property

For a class of graphs P, the Bounded P-Block Vertex Deletion problem asks, given a graph G on n vertices and positive integers k and d, whether there is a set S of at most k vertices such that each block of G − S has at most d vertices and is in P. We show that when P satisfies a natural hereditary property and is recognizable in polynomial time, Bounded P-Block Vertex Deletion can be solved in time 2O(k log d)nO(1), and this running time cannot be improved to 2o(k log d)nO(1), in general, unless the Exponential Time Hypothesis fails. On the other hand, if P consists of only complete graphs, or only K1,K2, and cycle graphs, then Bounded P-Block Vertex Deletion admits a cknO(1)-time algorithm for some constant c independent of d. We also show that Bounded P-Block Vertex Deletion admits a kernel with O(k2d7) vertices. © Springer-Verlag GmbH Germany 2016