Ruhr-Universität Bochum (RUB): Open Journal Systems
Not a member yet
4280 research outputs found
Sort by
Zwischen Schrift, Wort und Bild. Max Imdahls Vortragsstrategie anhand des Beispiels von Poussins Mannalese
Get PDFWhy do we remember our dreams so well? Implications of dream recollection on the imagination vs. hallucination debate
Get PDFWhy is dream memory so good? This loaded question appears to be based on an incorrect assumption, considering that bad memory of dreaming is, after all, well documented. However, whether dream memory is good or bad depends on what we compare these recollections to. Dream recollection is usually compared to memory of waking perceptual experiences, yet there is disagreement about whether this comparison is appropriate. Preliminary evidence suggests that dream memory is not bad compared to imagination memory and this may have implications for what it means to dream. Here we consider exactly how bad – or good – dream memory is compared to imagination that occurs while mindwandering and argue that while, prima facie, dream memory appears to provide an argument for the imagination model, this argument turns out to be unconvincing. There are many adverse conditions that would explain why memory of dreaming is worse than memory of waking events or hallucinations under the hallucination model. Further, if, as preliminary evidence might suggest, dream memory turns out to be somewhat better than imagination memory, this currently has no explanation under the imagination model. However, NREM dreams display the type of memory one might expect from imaginative dreaming. While the goodness or badness of memory in dreams should not be seen as a definitive argument for a particular model of dreaming, it should instead be taken as a piece of the broader landscape of abductive reasoning in this debate
Rethinking intelligent behaviour through the lens of accurate prediction: Adaptive control in uncertain environments
Get PDFWhile recent cognitive science research shows a renewed interest in understanding intelligence, there is still little consensus on what constitutes intelligent behaviour and how it should be assessed. Here we propose a refined approach to biological intelligence as accurate prediction, according to which intelligent behaviour should be understood as adaptive control driven by the minimisation of uncertainty in dynamic environments with limited information. Central to this view is the concept of accuracy, which we argue is key to determining the success of predictions. We identify tensions in applying this framework to contemporary artificial systems such as large-language models, which, despite their impressive capacities for abstract prediction, show deficits in terms of context-sensitive knowledge transfer
Talk: GlueZilla: Efficient and Scalable Software to Hardware Binding using Rowhammer
Get PDFIndustrial-scale reverse engineering affects the majority of companies in the mechanical and plant engineering sector and imposes significant economic damages. Reverse engineering mitigations try to increase the cost involved in reverse engineering until it surpasses the cost of actual development. Although these mitigations exist, economic damage has not been impacted, indicating that they have failed to address the problem. At present, most industrial-scale reverse engineering efforts are spent on replicating hardware components since software can often be copied verbatim without any reverse engineering effort. In this talk, we discuss GlueZilla, our recently published system that binds software to hardware through user-space rowhammer PUFs on commodity hardware. GlueZilla relies on unclonable machine features and thereby forces counterfeiters to reverse-engineer both the hardware and the software, driving up the reverse-engineering cost. In GlueZilla, a program has two fully functional modes of operation. In the intentional mode, GlueZilla performs the expected operations as described by the original source code, whereas in the unintentional mode, the execution differs at unsuspicious-looking junction points. For example, the program could follow conditional branches in the wrong direction, or call different targets at call sites. The unintentional mode should not exhibit obvious signs that something is wrong with the program, e.g., program crashes. The goal of GlueZilla is to only allow execution of the intentional mode on one selected associated machine instance. To this end, GlueZilla transforms the program at compile time to exhibit the unintended behavior by default. At run time, it uses targeted rowhammer-induced bit flips at the junction points to recreate the intentional execution mode in memory, as shown in Figure 1. GlueZilla uses rowhammer because of its unique properties.Since the rowhammer-induced bit flip pattern is unclonable, GlueZilla ensures the intentional execution mode is only reconstructed on the associated machine. If the software runs on any other machine, including exact clones of the associated machine, the required bit flips are absent and the program remains in its unintentional mode. For the same reason, dynamic analyses are ineffective on cloned machines as the intended operations are not performed on cloned machines. Rowhammer, furthermore, allows for stealthy memory changes in the whole memory region without explicit write operations performed by the CPU. This eliminates various dynamic analysis techniques which typically rely on the CPU to intercept certain operations or code changes. Dynamic tools that modify the memory layout also interfere with GlueZilla as the junction points will no longer reside in the required rowhammer-susceptible memory locations. Additionally, the static binary is only an image of the unintentional program and lacks information about the code changes required to recreate the intentional code, rendering static binary analysis unprofitable. The published version of GlueZilla has a few clear disadvantages. Numerous factors, such as temperature and chip aging, might undermine the reliability of bit flips. The current design does not tolerate unreliable bit flips because they might result in an incomplete transition to the intentional program form. Furthermore, Rowhammer can only flip bits in one direction, thus leaving the whole intentional program in memory throughout execution. This makes GlueZilla susceptible to memory snapshotting attacks. We will conclude this talk by discussing our ongoing work that aims to eliminate these weaknesses by using a microarchitectural attack that invalidates the in-memory copy of the program, whilst leaving its functionality intact
Poster: Systematic Evaluation of Automated Tools for Side-Channel Vulnerability Detection in Cryptographic Libraries
Get PDFTo protect cryptographic implementations from side-channel vulnerabilities, developers must adopt constant-time programming practices. As these can be error-prone, many side-channel detection tools have been proposed. Despite this, such vulnerabilities are still manually found in cryptographic libraries. While a recent paper by Jancar et al. shows that developers rarely perform side-channel detection, it is unclear if existing detection tools could have found these vulnerabilities in the first place.
To answer this question we surveyed the literature to build a classification of 34 side-channel detection frameworks. The classification we offer compares multiple criteria, including the methods used, the scalability of the analysis or the threat model considered. We then built a unified common benchmark of representative cryptographic operations on a selection of 5 promising detection tools. This benchmark allows us to better compare the capabilities of each tool, and the scalability of their analysis. Additionally, we offer a classification of recently published side-channel vulnerabilities. We then test each of the selected tools on benchmarks reproducing a subset of these vulnerabilities as well as the context in which they appear. We find that existing tools can struggle to find vulnerabilities for a variety of reasons, mainly the lack of support for SIMD instructions, implicit flows, and internal secret generation. Based on our findings, we develop a set of recommendations for the research community and cryptographic library developers, with the goal to improve the effectiveness of side-channel detection tools.
In addition, we present preliminary results on the impact of compiler optimizations on constant-time source code. Our results bring nuance to the claim that newer compiler versions introduce more vulnerabilities and details new examples where complex interactions between optimizations can introduce secret-dependent branches
Linear Cancellations in the MitM Attacks on Sponge Functions
No full textAt EUROCRYPT 2023, Qin et al. proposed the MitM attack framework on sponge functions by separating the message bits into two sets of neutral bits. By assigning bit cancellations on one of the two sets, the states of the two sets can be computed independently and then filtered by some matching equations. To solve the bit cancellations, Qin et al. exhaustively compute the cancellations of all message bits, and store them in a huge hash table, which leads to attacks with huge memory. In this paper, we separate the bit cancellations into linear and nonlinear cancellations for the MitM attacks, where the linear cancellations are solved by Gaussian elimination, and only the nonlinear cancellations are dealt with the hash table. Hence, the memory cost is significantly reduced. In order to search new attacks with efficient memory (fewer nonlinear cancellations and more linear cancellations), we propose a new MILP model whose encoding scheme can distinguish linear and nonlinear cancellations. Besides, dedicated tricks such as the so-called weak-diffusion structure and two-stage search are proposed to further accelerate solving the MILP models.Finally, the memory complexities of MitM attacks on 4-round Keccak[1024], 3-round Xoodyak-Xof, 4-round Ascon-Xof, and full Subterranean 2.0 are reduced by 249, 259, 216, and 236, respectively. Besides, our memory-efficient approach can turn invalid MitM attacks (where memory complexity is the dominant factor in old framework) into valid MitM attacks. For example, we propose the first MitM preimage attack on 4-round Keccak[768] and the first 3-round collision attack on Xoodyak-Xof with 128-bit tag
Accelerating Hash-Based Polynomial Commitment Schemes with Linear Prover Time
No full textZero-knowledge proofs (ZKPs) are cryptographic protocols that enable one party to prove the validity of a statement without revealing any information beyond its truth. Central building blocks in many ZKPs are polynomial commitment schemes (PCS) where constructions with linear-time provers are especially attractive. Two such examples are Brakedown and its extension Orion, which enable linear-time and quantum-resistant proving by leveraging linear-time encodable Spielman codes. However, these PCS operate over large datasets, creating significant computational bottlenecks. For example, committing to and proving a degree 228 polynomial requires around 1.1 GB of data while taking 463 seconds on a high-end server CPU.This work addresses the performance bottleneck in Orion-like PCS by optimizing their most critical operations: Spielman encoding and Merkle commitments. These operations involve Gigabytes of data and suffer from random off-chip memory access patterns that drastically reduce off-chip bandwidth. We resolve this issue and introduce inverted expander graphs to eliminate random writes and reduce off-chip memory accesses by over 50%. Additionally, we propose an on-the-fly graph sampling method that avoids streaming large auxiliary data by generating expander graphs dynamically on-chip. We also provide a formal security proof for our proposed graph transformation. Beyond encoding, we accelerate Merkle Tree construction over large data sets through a scalable multi-pass SHA3 pipeline. Finally, we reutilize existing hardware components used in commitment to accelerate the so-called proximity and consistency checks during proof generation.Building upon these concepts, we present the first hardware architecture for PCS – with linear prover time – on an Xilinx Alveo U280 FPGA. In addition, we discuss the practical challenges of manually partitioning, placing, and routing our large-scale architecture to efficiently map it to the multi-SLR and HBM-equipped FPGA. The final implementation achieves a speedup of two orders of magnitude for full proof generation, covering commitment and proving steps. When combined with Virgo as an outer CP-SNARK protocol, our accelerator reduces end-to-end latency by up to 3.85x – close to the theoretical maximum of 3.9x
A Fast Heuristic for Mapping Boolean Circuits to Functional Bootstrapping
No full textFunctional bootstrapping in FHE schemes such as FHEW and TFHE allows the evaluation of arbitrary functions on encrypted data, while simultaneously reducing noise. Implementing programs that directly use functional bootstrapping is challenging and error-prone. In this paper, we propose a heuristic that automatically maps Boolean circuits to functional bootstrapping instructions. Unlike prior approaches, our method does not limit the encrypted data plaintext space to a power-of-two size, allowing the instantiation of functional bootstrapping with smaller parameters. Furthermore, the negacyclic property of functional bootstrapping is exploited to extend the plaintext effective space. Despite the inherently greedy nature of the heuristic, experimental results show that the mapped circuits exhibit a significant reduction in evaluation time. Our heuristic demonstrates a 45% reduction in evaluation time when compared to hand-optimized Trivium and Kreyvium implementations
Let us walk on the 3-isogeny graph: efficient, fast, and simple
No full textConstructing and implementing isogeny-based cryptographic primitives is an active research. In particular, performing length-n isogenies walks over quadratic field extensions of Fp plays an exciting role in some constructions, including Hash functions, Verifiable Delay Functions, Key-Encapsulation Mechanisms, and generic proof systems for isogeny knowledge. Remarkably, many isogeny-based constructions, for efficiency, perform 2-isogenies through square root calculations.This work analyzes the idea of using 3-isogenies instead of 2-isogenies, which replaces the requirement of calculating square roots with cube roots. Performing length-m 3-isogenies allows shorter isogeny walks than when employing length-n 2-isogenies since a cube root calculation costs essentially the same as computing a square root, and we require 3m ≈ 2n to provide the same security level.We propose an efficient mapping from arbitrary supersingular Montgomery curves defined over Fp2 to the 3-isogeny curve model from Castryck, Decru, and Vercauteren (Asiacrypt 2020); a deterministic algorithm to compute all order-3 points on arbitrary supersingular Montgomery curves, and an efficient algorithm to compute length-m 3-isogeny chains.We improve the length-m 3-isogeny walks required by the KEM from Nakagawa and Onuki (CRYPTO 2024) by using our results and introducing more suitable parameter sets that are friendly with C-code implementations. In particular, our experiments illustrate an improvement between 26.41% and 35.60% in savings when calculating length-m 3-isogeny chains and using our proposed parameters instead of those proposed by Nakagawa and Onuki (CRYPTO 2024).Finally, we enhance the key generation of CTIDH-2048 by including radical 3-isogeny chains over the basefield Fp, reducing the overhead of finding a 3-torsion basis as required in some instantiations of the CSIDH protocol. Our experiments illustrate the advantage of radical 3 isogenies in the key generation of CTIDH-2048, with an improvement up to 4 times faster than the original CTIDH