Phillip Rogaway - Academia.edu (original) (raw)

Uploads

Papers by Phillip Rogaway

Research paper thumbnail of Some Comments on WHF Mode

Research paper thumbnail of A paradigm for designing ef cient protocols

Research paper thumbnail of Evaluation of Security Level of Cryptography HIME-1

Research paper thumbnail of On the Construction of Variable-Input-Length Ciphers

Lecture Notes in Computer Science, 1999

Whereas a block cipher enciphers messages of some one particular length (the blocklength), a vari... more Whereas a block cipher enciphers messages of some one particular length (the blocklength), a variable-input-length cipher takes messages of varying (and preferably arbitrary) lengths. Still, the length of the ciphertext must equal the length of the plaintext. This paper introduces the problem of constructing such objects, and provides a practical solution. Our VIL mode of operation makes a variable-input-length cipher from any block cipher. The method is demonstrably secure in the provable-security sense of modern cryptography: we give a quantitative security analysis relating the difficulty of breaking the constructed (variable-input-length) cipher to the difficulty of breaking the underlying block cipher.

Research paper thumbnail of Reconciling Two Views of Cryptography

Lecture Notes in Computer Science, 2000

Two distinct, rigorous views of cryptography have developed over the years, in two mostly separat... more Two distinct, rigorous views of cryptography have developed over the years, in two mostly separate communities. One of the views relies on a simple but effective formal approach; the other, on a detailed computational model that considers issues of complexity and probability. There is an uncomfortable and interesting gap between these two approaches to cryptography. This paper starts to bridge the gap, by providing a computational justification for a formal treatment of encryption.

Research paper thumbnail of Entity Authentication and Key Distribution

Advances in Cryptology — CRYPTO’ 93, 1994

We provide the first formal treatment of entity authentication and authenticated key distribution... more We provide the first formal treatment of entity authentication and authenticated key distribution appropriate to the distributed emironment. Addressed in detail are the problems of mutual authentication and authenticated key exchange for the symmetric, two-party setting. For each we present a definition, protocol, and proof that the protocol meets its goal, assuming only the existence of a pseudorandom function.

Research paper thumbnail of Security with Low Communication Overhead

Lecture Notes in Computer Science, 1991

We consider the communication complexity of secure multiparty computations by networks of process... more We consider the communication complexity of secure multiparty computations by networks of processors each with unlimited computing power. Say that an n-party protocol for a function of m bits is efficient if it uses a constant number of rounds of communication and a total number of message bits that is polynomial in max(m, n). We show that any function has an efficient protocol that achieves (rclog n)/m resilience. Ours is the first secure multiparty protocol in which the communication complexity is independent of the computational complexity of the function being computed. We also consider the communication complexity of zero-knowledge proofs of properties of committed bits. We show that every function / of m bits has an efficient notarized envelope scheme; that is, there is a protocol in which a computationally unlimited prover commits a sequence of bits x to a computationally unlimited verifier and then proves in perfect zero-knowledge (without decommitting x) that f(x) = 1, using a constant number of rounds and poly(m) message bits. Ours is the first notarized envelope scheme in which the communication complexity is independent of the computational complexity of /. Finally, we establish a new upper bound on the number of oracles needed in instance-hiding schemes for arbitrary functions. These schemes allow a computationally limited querier to capitalize on the superior power of one or more computationally unlimited oracles in order to obtain f(x) without revealing its private input x to any one of the oracles. We show that every function of m bits has an (m/logm)-oracle instance-hiding scheme. The central technique used in all of these results is locally random reducibility, which was used for the first time in [7] and is formally defined for the first time here. In addition to the applications that we present, locally random reducibility has been applied to interactive proof systems, program checking, and program testing.

Research paper thumbnail of Optimal asymmetric encryption--how to encrypt with rsa

Theory and Application of Cryptographic Techniques, 1995

Research paper thumbnail of Foundations of garbled circuits

Proceedings of the 2012 ACM conference on Computer and communications security - CCS '12, 2012

Research paper thumbnail of The Security of the Cipher Block Chaining Message Authentication Code

Journal of Computer and System Sciences, 2000

Research paper thumbnail of The Associated-Data Problem

Research paper thumbnail of Method and apparatus for entity authentication and key distribution secure against off-line adversarial attacks

Research paper thumbnail of Practice-Oriented Provable Security and the Social Construction of Cryptography

IEEE Security & Privacy, 2016

Research paper thumbnail of Comments on NIST's RMAC Proposal

Abstract: this paper [JJV], NIST did a lot of further,independent, design. They ended up with a k... more Abstract: this paper [JJV], NIST did a lot of further,independent, design. They ended up with a kind of object that isn't even a conventional MAC,and isn't supported by any published scientific work. We don't think this is a right way to go. Werecommend abandoning RMAC and choosing a more mature construction

Research paper thumbnail of E�cient Instantiations of Tweakable Blockciphers and Re�nements to Modes OCB and PMAC

Research paper thumbnail of Method for data encryption/decryption using cipher block chaining (CBC) and message authentication codes (MAC)

Research paper thumbnail of Deterministic Authenticated-Encryption: A Provable-Security Treatment of the Key-Wrap Problem

Research paper thumbnail of The game-playing technique and its application to triple encryption

Research paper thumbnail of EAX: A Conventional Authenticated-Encryption Mode

Abstract: We propose a block-cipher mode of operation, called EAX, for authenticated-encryption w... more Abstract: We propose a block-cipher mode of operation, called EAX, for authenticated-encryption with associated-data (AEAD). Given a nonce N, a message M, and a header H, the mode protects the privacy of M and the authenticity of both M and H. Strings N, M, H $ ...

Research paper thumbnail of Proposal to NIST for a block-cipher mode of operation which simultaneously provides privacy and authenticity

ABSTRACT accounting. OCB uses djM j=ne + 2 block-cipher calls for a nonempty message M . (The emp... more ABSTRACT accounting. OCB uses djM j=ne + 2 block-cipher calls for a nonempty message M . (The empty string takes three block-cipher invocations, the same as a one-block message). We compare with CBC encryption and CBC encryption plus a CBC MAC:

Research paper thumbnail of Some Comments on WHF Mode

Research paper thumbnail of A paradigm for designing ef cient protocols

Research paper thumbnail of Evaluation of Security Level of Cryptography HIME-1

Research paper thumbnail of On the Construction of Variable-Input-Length Ciphers

Lecture Notes in Computer Science, 1999

Whereas a block cipher enciphers messages of some one particular length (the blocklength), a vari... more Whereas a block cipher enciphers messages of some one particular length (the blocklength), a variable-input-length cipher takes messages of varying (and preferably arbitrary) lengths. Still, the length of the ciphertext must equal the length of the plaintext. This paper introduces the problem of constructing such objects, and provides a practical solution. Our VIL mode of operation makes a variable-input-length cipher from any block cipher. The method is demonstrably secure in the provable-security sense of modern cryptography: we give a quantitative security analysis relating the difficulty of breaking the constructed (variable-input-length) cipher to the difficulty of breaking the underlying block cipher.

Research paper thumbnail of Reconciling Two Views of Cryptography

Lecture Notes in Computer Science, 2000

Two distinct, rigorous views of cryptography have developed over the years, in two mostly separat... more Two distinct, rigorous views of cryptography have developed over the years, in two mostly separate communities. One of the views relies on a simple but effective formal approach; the other, on a detailed computational model that considers issues of complexity and probability. There is an uncomfortable and interesting gap between these two approaches to cryptography. This paper starts to bridge the gap, by providing a computational justification for a formal treatment of encryption.

Research paper thumbnail of Entity Authentication and Key Distribution

Advances in Cryptology — CRYPTO’ 93, 1994

We provide the first formal treatment of entity authentication and authenticated key distribution... more We provide the first formal treatment of entity authentication and authenticated key distribution appropriate to the distributed emironment. Addressed in detail are the problems of mutual authentication and authenticated key exchange for the symmetric, two-party setting. For each we present a definition, protocol, and proof that the protocol meets its goal, assuming only the existence of a pseudorandom function.

Research paper thumbnail of Security with Low Communication Overhead

Lecture Notes in Computer Science, 1991

We consider the communication complexity of secure multiparty computations by networks of process... more We consider the communication complexity of secure multiparty computations by networks of processors each with unlimited computing power. Say that an n-party protocol for a function of m bits is efficient if it uses a constant number of rounds of communication and a total number of message bits that is polynomial in max(m, n). We show that any function has an efficient protocol that achieves (rclog n)/m resilience. Ours is the first secure multiparty protocol in which the communication complexity is independent of the computational complexity of the function being computed. We also consider the communication complexity of zero-knowledge proofs of properties of committed bits. We show that every function / of m bits has an efficient notarized envelope scheme; that is, there is a protocol in which a computationally unlimited prover commits a sequence of bits x to a computationally unlimited verifier and then proves in perfect zero-knowledge (without decommitting x) that f(x) = 1, using a constant number of rounds and poly(m) message bits. Ours is the first notarized envelope scheme in which the communication complexity is independent of the computational complexity of /. Finally, we establish a new upper bound on the number of oracles needed in instance-hiding schemes for arbitrary functions. These schemes allow a computationally limited querier to capitalize on the superior power of one or more computationally unlimited oracles in order to obtain f(x) without revealing its private input x to any one of the oracles. We show that every function of m bits has an (m/logm)-oracle instance-hiding scheme. The central technique used in all of these results is locally random reducibility, which was used for the first time in [7] and is formally defined for the first time here. In addition to the applications that we present, locally random reducibility has been applied to interactive proof systems, program checking, and program testing.

Research paper thumbnail of Optimal asymmetric encryption--how to encrypt with rsa

Theory and Application of Cryptographic Techniques, 1995

Research paper thumbnail of Foundations of garbled circuits

Proceedings of the 2012 ACM conference on Computer and communications security - CCS '12, 2012

Research paper thumbnail of The Security of the Cipher Block Chaining Message Authentication Code

Journal of Computer and System Sciences, 2000

Research paper thumbnail of The Associated-Data Problem

Research paper thumbnail of Method and apparatus for entity authentication and key distribution secure against off-line adversarial attacks

Research paper thumbnail of Practice-Oriented Provable Security and the Social Construction of Cryptography

IEEE Security & Privacy, 2016

Research paper thumbnail of Comments on NIST's RMAC Proposal

Abstract: this paper [JJV], NIST did a lot of further,independent, design. They ended up with a k... more Abstract: this paper [JJV], NIST did a lot of further,independent, design. They ended up with a kind of object that isn't even a conventional MAC,and isn't supported by any published scientific work. We don't think this is a right way to go. Werecommend abandoning RMAC and choosing a more mature construction

Research paper thumbnail of E�cient Instantiations of Tweakable Blockciphers and Re�nements to Modes OCB and PMAC

Research paper thumbnail of Method for data encryption/decryption using cipher block chaining (CBC) and message authentication codes (MAC)

Research paper thumbnail of Deterministic Authenticated-Encryption: A Provable-Security Treatment of the Key-Wrap Problem

Research paper thumbnail of The game-playing technique and its application to triple encryption

Research paper thumbnail of EAX: A Conventional Authenticated-Encryption Mode

Abstract: We propose a block-cipher mode of operation, called EAX, for authenticated-encryption w... more Abstract: We propose a block-cipher mode of operation, called EAX, for authenticated-encryption with associated-data (AEAD). Given a nonce N, a message M, and a header H, the mode protects the privacy of M and the authenticity of both M and H. Strings N, M, H $ ...

Research paper thumbnail of Proposal to NIST for a block-cipher mode of operation which simultaneously provides privacy and authenticity

ABSTRACT accounting. OCB uses djM j=ne + 2 block-cipher calls for a nonempty message M . (The emp... more ABSTRACT accounting. OCB uses djM j=ne + 2 block-cipher calls for a nonempty message M . (The empty string takes three block-cipher invocations, the same as a one-block message). We compare with CBC encryption and CBC encryption plus a CBC MAC: