The algebraic group model and its applications
One of the most important and successful tools for assessing hardness assumptions in
cryptography is the Generic Group Model (GGM). Over the past two decades, numerous …
cryptography is the Generic Group Model (GGM). Over the past two decades, numerous …
On the adaptive security of the threshold BLS signature scheme
Threshold signatures are a crucial tool for many distributed protocols. As shown by Cachin,
Kursawe, and Shoup (PODC'00), schemes with unique signatures are of particular …
Kursawe, and Shoup (PODC'00), schemes with unique signatures are of particular …
Chameleon-hashes with ephemeral trapdoors: And applications to invisible sanitizable signatures
A chameleon-hash function is a hash function that involves a trapdoor the knowledge of
which allows one to find arbitrary collisions in the domain of the function. In this paper, we …
which allows one to find arbitrary collisions in the domain of the function. In this paper, we …
Fully,(almost) tightly secure IBE and dual system groups
We present the first fully secure Identity-Based Encryption scheme (IBE) from the standard
assumptions where the security loss depends only on the security parameter and is …
assumptions where the security loss depends only on the security parameter and is …
Optimal security proofs for signatures from identification schemes
We perform a concrete security treatment of digital signature schemes obtained from
canonical identification schemes via the Fiat-Shamir transform. If the identification scheme is …
canonical identification schemes via the Fiat-Shamir transform. If the identification scheme is …
Tightly-secure authenticated key exchange
We construct the first Authenticated Key Exchange (AKE) protocol whose security does not
degrade with an increasing number of users or sessions. We describe a three-message …
degrade with an increasing number of users or sessions. We describe a three-message …
On the impossibility of tight cryptographic reductions
The existence of tight reductions in cryptographic security proofs is an important question,
motivated by the theoretical search for cryptosystems whose security guarantees are truly …
motivated by the theoretical search for cryptosystems whose security guarantees are truly …
Instantiating random oracles via UCEs
This paper provides a (standard-model) notion of security for (keyed) hash functions, called
UCE, that we show enables instantiation of random oracles (ROs) in a fairly broad and …
UCE, that we show enables instantiation of random oracles (ROs) in a fairly broad and …
The exact security of BIP32 wallets
In many cryptocurrencies, the problem of key management has become one of the most
fundamental security challenges. Typically, keys are kept in designated schemes called …
fundamental security challenges. Typically, keys are kept in designated schemes called …
Lattice-based signatures with tight adaptive corruptions and more
We construct the first tightly secure signature schemes in the multi-user setting with adaptive
corruptions from lattices. In stark contrast to the previous tight constructions whose security is …
corruptions from lattices. In stark contrast to the previous tight constructions whose security is …