[{"file":[{"relation":"main_file","file_size":955755,"checksum":"b816b848f046c48a8357700d9305dce5","date_created":"2021-11-15T10:27:29Z","creator":"cchlebak","file_name":"2018_IACR_Allini.pdf","file_id":"10289","success":1,"content_type":"application/pdf","date_updated":"2021-11-15T10:27:29Z","access_level":"open_access"}],"publication":"IACR Transactions on Cryptographic Hardware and Embedded Systems","_id":"10286","oa_version":"Published Version","date_created":"2021-11-14T23:01:25Z","oa":1,"OA_type":"diamond","publication_identifier":{"eissn":["2569-2925"]},"date_published":"2018-01-01T00:00:00Z","department":[{"_id":"KrPi"}],"day":"01","das_tickbox":"1","article_type":"original","OA_place":"publisher","title":"Evaluation and monitoring of free running oscillators serving as source of randomness","author":[{"full_name":"Allini, Elie Noumon","first_name":"Elie Noumon","last_name":"Allini"},{"id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD","last_name":"Skórski","first_name":"Maciej","full_name":"Skórski, Maciej"},{"first_name":"Oto","last_name":"Petura","full_name":"Petura, Oto"},{"first_name":"Florent","last_name":"Bernard","full_name":"Bernard, Florent"},{"first_name":"Marek","last_name":"Laban","full_name":"Laban, Marek"},{"first_name":"Viktor","last_name":"Fischer","full_name":"Fischer, Viktor"}],"tmp":{"short":"CC BY (4.0)","legal_code_url":"https://creativecommons.org/licenses/by/4.0/legalcode","image":"/images/cc_by.png","name":"Creative Commons Attribution 4.0 International Public License (CC-BY 4.0)"},"date_updated":"2026-07-06T13:16:35Z","status":"public","user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","intvolume":"      2018","has_accepted_license":"1","type":"journal_article","corr_author":"1","publisher":"International Association for Cryptologic Research","publication_status":"published","abstract":[{"text":"In this paper, we evaluate clock signals generated in ring oscillators and self-timed rings and the way their jitter can be transformed into random numbers. We show that counting the periods of the jittery clock signal produces random numbers of significantly better quality than the methods in which the jittery signal is simply sampled (the case in almost all current methods). Moreover, we use the counter values to characterize and continuously monitor the source of randomness. However, instead of using the widely used statistical variance, we propose to use Allan variance to do so. There are two main advantages: Allan variance is insensitive to low frequency noises such as flicker noise that are known to be autocorrelated and significantly less circuitry is required for its computation than that used to compute commonly used variance. We also show that it is essential to use a differential principle of randomness extraction from the jitter based on the use of two identical oscillators to avoid autocorrelations originating from external and internal global jitter sources and that this fact is valid for both kinds of rings. Last but not least, we propose a method of statistical testing based on high order Markov model to show the reduced dependencies when the proposed randomness extraction is applied.","lang":"eng"}],"citation":{"ieee":"E. N. Allini, M. Skórski, O. Petura, F. Bernard, M. Laban, and V. Fischer, “Evaluation and monitoring of free running oscillators serving as source of randomness,” <i>IACR Transactions on Cryptographic Hardware and Embedded Systems</i>, vol. 2018, no. 3. International Association for Cryptologic Research, pp. 214–242, 2018.","ista":"Allini EN, Skórski M, Petura O, Bernard F, Laban M, Fischer V. 2018. Evaluation and monitoring of free running oscillators serving as source of randomness. IACR Transactions on Cryptographic Hardware and Embedded Systems. 2018(3), 214–242.","chicago":"Allini, Elie Noumon, Maciej Skórski, Oto Petura, Florent Bernard, Marek Laban, and Viktor Fischer. “Evaluation and Monitoring of Free Running Oscillators Serving as Source of Randomness.” <i>IACR Transactions on Cryptographic Hardware and Embedded Systems</i>. International Association for Cryptologic Research, 2018. <a href=\"https://doi.org/10.13154/tches.v2018.i3.214-242\">https://doi.org/10.13154/tches.v2018.i3.214-242</a>.","ama":"Allini EN, Skórski M, Petura O, Bernard F, Laban M, Fischer V. Evaluation and monitoring of free running oscillators serving as source of randomness. <i>IACR Transactions on Cryptographic Hardware and Embedded Systems</i>. 2018;2018(3):214-242. doi:<a href=\"https://doi.org/10.13154/tches.v2018.i3.214-242\">10.13154/tches.v2018.i3.214-242</a>","short":"E.N. Allini, M. Skórski, O. Petura, F. Bernard, M. Laban, V. Fischer, IACR Transactions on Cryptographic Hardware and Embedded Systems 2018 (2018) 214–242.","apa":"Allini, E. N., Skórski, M., Petura, O., Bernard, F., Laban, M., &#38; Fischer, V. (2018). Evaluation and monitoring of free running oscillators serving as source of randomness. <i>IACR Transactions on Cryptographic Hardware and Embedded Systems</i>. International Association for Cryptologic Research. <a href=\"https://doi.org/10.13154/tches.v2018.i3.214-242\">https://doi.org/10.13154/tches.v2018.i3.214-242</a>","mla":"Allini, Elie Noumon, et al. “Evaluation and Monitoring of Free Running Oscillators Serving as Source of Randomness.” <i>IACR Transactions on Cryptographic Hardware and Embedded Systems</i>, vol. 2018, no. 3, International Association for Cryptologic Research, 2018, pp. 214–42, doi:<a href=\"https://doi.org/10.13154/tches.v2018.i3.214-242\">10.13154/tches.v2018.i3.214-242</a>."},"doi":"10.13154/tches.v2018.i3.214-242","scopus_import":"1","issue":"3","page":"214-242","file_date_updated":"2021-11-15T10:27:29Z","month":"01","article_processing_charge":"No","volume":2018,"language":[{"iso":"eng"}],"ddc":["000"],"year":"2018","quality_controlled":"1"},{"abstract":[{"text":"A proof system is a protocol between a prover and a verifier over a common input in which an honest prover convinces the verifier of the validity of true statements. Motivated by the success of decentralized cryptocurrencies, exemplified by Bitcoin, the focus of this thesis will be on proof systems which found applications in some sustainable alternatives to Bitcoin, such as the Spacemint and Chia cryptocurrencies. In particular, we focus on proofs of space and proofs of sequential work.\r\nProofs of space (PoSpace) were suggested as more ecological, economical, and egalitarian alternative to the energy-wasteful proof-of-work mining of Bitcoin. However, the state-of-the-art constructions of PoSpace are based on sophisticated graph pebbling lower bounds, and are therefore complex. Moreover, when these PoSpace are used in cryptocurrencies like Spacemint, miners can only start mining after ensuring that a commitment to their space is already added in a special transaction to the blockchain. Proofs of sequential work (PoSW) are proof systems in which a prover, upon receiving a statement x and a time parameter T, computes a proof which convinces the verifier that T time units had passed since x was received. Whereas Spacemint assumes synchrony to retain some interesting Bitcoin dynamics, Chia requires PoSW with unique proofs, i.e., PoSW in which it is hard to come up with more than one accepting proof for any true statement. In this thesis we construct simple and practically-efficient PoSpace and PoSW. When using our PoSpace in cryptocurrencies, miners can start mining on the fly, like in Bitcoin, and unlike current constructions of PoSW, which either achieve efficient verification of sequential work, or faster-than-recomputing verification of correctness of proofs, but not both at the same time, ours achieve the best of these two worlds.","lang":"eng"}],"citation":{"ista":"Abusalah HM. 2018. Proof systems for sustainable decentralized cryptocurrencies. Institute of Science and Technology Austria.","ieee":"H. M. Abusalah, “Proof systems for sustainable decentralized cryptocurrencies,” Institute of Science and Technology Austria, 2018.","chicago":"Abusalah, Hamza M. “Proof Systems for Sustainable Decentralized Cryptocurrencies.” Institute of Science and Technology Austria, 2018. <a href=\"https://doi.org/10.15479/AT:ISTA:TH_1046\">https://doi.org/10.15479/AT:ISTA:TH_1046</a>.","ama":"Abusalah HM. Proof systems for sustainable decentralized cryptocurrencies. 2018. doi:<a href=\"https://doi.org/10.15479/AT:ISTA:TH_1046\">10.15479/AT:ISTA:TH_1046</a>","short":"H.M. Abusalah, Proof Systems for Sustainable Decentralized Cryptocurrencies, Institute of Science and Technology Austria, 2018.","apa":"Abusalah, H. M. (2018). <i>Proof systems for sustainable decentralized cryptocurrencies</i>. Institute of Science and Technology Austria. <a href=\"https://doi.org/10.15479/AT:ISTA:TH_1046\">https://doi.org/10.15479/AT:ISTA:TH_1046</a>","mla":"Abusalah, Hamza M. <i>Proof Systems for Sustainable Decentralized Cryptocurrencies</i>. Institute of Science and Technology Austria, 2018, doi:<a href=\"https://doi.org/10.15479/AT:ISTA:TH_1046\">10.15479/AT:ISTA:TH_1046</a>."},"related_material":{"record":[{"id":"559","relation":"part_of_dissertation","status":"public"},{"status":"public","relation":"part_of_dissertation","id":"1236"},{"id":"1235","relation":"part_of_dissertation","status":"public"},{"status":"public","id":"1229","relation":"part_of_dissertation"}]},"doi":"10.15479/AT:ISTA:TH_1046","pubrep_id":"1046","has_accepted_license":"1","supervisor":[{"full_name":"Pietrzak, Krzysztof Z","orcid":"0000-0002-9139-1654","first_name":"Krzysztof Z","last_name":"Pietrzak","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87"}],"type":"dissertation","publisher":"Institute of Science and Technology Austria","corr_author":"1","publication_status":"published","doi_confirm":"1","language":[{"iso":"eng"}],"ddc":["004"],"year":"2018","page":"59","file_date_updated":"2020-07-14T12:48:11Z","month":"09","article_processing_charge":"No","oa":1,"publication_identifier":{"issn":["2663-337X"]},"date_published":"2018-09-05T00:00:00Z","publist_id":"7971","file":[{"creator":"dernst","file_name":"2018_Thesis_Abusalah.pdf","relation":"main_file","date_created":"2019-04-09T06:43:41Z","checksum":"c4b5f7d111755d1396787f41886fc674","file_size":876241,"date_updated":"2020-07-14T12:48:11Z","content_type":"application/pdf","access_level":"open_access","file_id":"6245"},{"relation":"source_file","file_size":2029190,"checksum":"0f382ac56b471c48fd907d63eb87dafe","date_created":"2019-04-09T06:43:41Z","creator":"dernst","file_name":"2018_Thesis_Abusalah_source.tar.gz","file_id":"6246","content_type":"application/x-gzip","date_updated":"2020-07-14T12:48:11Z","access_level":"closed"}],"project":[{"_id":"258C570E-B435-11E9-9278-68D0E5697425","grant_number":"259668","name":"Provable Security for Physical Cryptography","call_identifier":"FP7"},{"name":"Teaching Old Crypto New Tricks","call_identifier":"H2020","grant_number":"682815","_id":"258AA5B2-B435-11E9-9278-68D0E5697425"}],"_id":"83","oa_version":"Published Version","date_created":"2018-12-11T11:44:32Z","date_updated":"2026-07-29T13:38:08Z","status":"public","user_id":"8b945eb4-e2f2-11eb-945a-df72226e66a9","day":"05","department":[{"_id":"KrPi"},{"_id":"GradSch"}],"ec_funded":1,"OA_place":"publisher","degree_awarded":"PhD","alternative_title":["ISTA Thesis"],"title":"Proof systems for sustainable decentralized cryptocurrencies","author":[{"id":"40297222-F248-11E8-B48F-1D18A9856A87","first_name":"Hamza M","last_name":"Abusalah","full_name":"Abusalah, Hamza M"}]},{"day":"01","department":[{"_id":"KrPi"}],"author":[{"first_name":"Sanjit","last_name":"Chatterjee","full_name":"Chatterjee, Sanjit"},{"first_name":"Chethan","last_name":"Kamath Hosdurg","orcid":"0009-0006-6812-7317","full_name":"Kamath Hosdurg, Chethan","id":"4BD3F30E-F248-11E8-B48F-1D18A9856A87"},{"full_name":"Kumar, Vikas","last_name":"Kumar","first_name":"Vikas"}],"title":"Private set-intersection with common set-up","date_updated":"2026-08-12T09:13:26Z","status":"public","user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","publication":"Advances in Mathematics of Communications","_id":"5980","date_created":"2019-02-13T13:49:41Z","oa_version":"None","external_id":{"isi":["000430950400002"]},"publication_identifier":{"issn":["1930-5346"]},"date_published":"2018-02-01T00:00:00Z","issue":"1","page":"17-47","month":"02","isi":1,"article_processing_charge":"No","volume":12,"language":[{"iso":"eng"}],"year":"2018","quality_controlled":"1","intvolume":"        12","type":"journal_article","publisher":"AIMS","publication_status":"published","abstract":[{"text":"The problem of private set-intersection (PSI) has been traditionally treated as an instance of the more general problem of multi-party computation (MPC). Consequently, in order to argue security, or compose these protocols one has to rely on the general theory that was developed for the purpose of MPC. The pursuit of efficient protocols, however, has resulted in designs that exploit properties pertaining to PSI. In almost all practical applications where a PSI protocol is deployed, it is expected to be executed multiple times, possibly on related inputs. In this work we initiate a dedicated study of PSI in the multi-interaction (MI) setting. In this model a server sets up the common system parameters and executes set-intersection multiple times with potentially different clients. We discuss a few attacks that arise when protocols are naïvely composed in this manner and, accordingly, craft security definitions for the MI setting and study their inter-relation. Finally, we suggest a set of protocols that are MI-secure, at the same time almost as efficient as their parent, stand-alone, protocols.","lang":"eng"}],"citation":{"apa":"Chatterjee, S., Kamath Hosdurg, C., &#38; Kumar, V. (2018). Private set-intersection with common set-up. <i>Advances in Mathematics of Communications</i>. AIMS. <a href=\"https://doi.org/10.3934/amc.2018002\">https://doi.org/10.3934/amc.2018002</a>","mla":"Chatterjee, Sanjit, et al. “Private Set-Intersection with Common Set-Up.” <i>Advances in Mathematics of Communications</i>, vol. 12, no. 1, AIMS, 2018, pp. 17–47, doi:<a href=\"https://doi.org/10.3934/amc.2018002\">10.3934/amc.2018002</a>.","ista":"Chatterjee S, Kamath Hosdurg C, Kumar V. 2018. Private set-intersection with common set-up. Advances in Mathematics of Communications. 12(1), 17–47.","ieee":"S. Chatterjee, C. Kamath Hosdurg, and V. Kumar, “Private set-intersection with common set-up,” <i>Advances in Mathematics of Communications</i>, vol. 12, no. 1. AIMS, pp. 17–47, 2018.","chicago":"Chatterjee, Sanjit, Chethan Kamath Hosdurg, and Vikas Kumar. “Private Set-Intersection with Common Set-Up.” <i>Advances in Mathematics of Communications</i>. AIMS, 2018. <a href=\"https://doi.org/10.3934/amc.2018002\">https://doi.org/10.3934/amc.2018002</a>.","short":"S. Chatterjee, C. Kamath Hosdurg, V. Kumar, Advances in Mathematics of Communications 12 (2018) 17–47.","ama":"Chatterjee S, Kamath Hosdurg C, Kumar V. Private set-intersection with common set-up. <i>Advances in Mathematics of Communications</i>. 2018;12(1):17-47. doi:<a href=\"https://doi.org/10.3934/amc.2018002\">10.3934/amc.2018002</a>"},"doi":"10.3934/amc.2018002","scopus_import":"1"},{"publication_identifier":{"issn":["1868-8969"]},"date_published":"2017-03-01T00:00:00Z","external_id":{"isi":["000521077300057"]},"oa":1,"project":[{"call_identifier":"H2020","name":"Teaching Old Crypto New Tricks","_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815"}],"_id":"1174","article_number":"57","oa_version":"Submitted Version","date_created":"2018-12-11T11:50:32Z","publist_id":"6180","user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","date_updated":"2025-07-10T11:50:14Z","status":"public","alternative_title":["LIPIcs"],"main_file_link":[{"url":"http://drops.dagstuhl.de/opus/volltexte/2017/6976","open_access":"1"}],"author":[{"last_name":"Skórski","first_name":"Maciej","full_name":"Skórski, Maciej","id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD"}],"title":"Lower bounds on key derivation for square-friendly applications","department":[{"_id":"KrPi"}],"day":"01","ec_funded":1,"doi":"10.4230/LIPIcs.STACS.2017.57","scopus_import":"1","abstract":[{"text":"Security of cryptographic applications is typically defined by security games. The adversary, within certain resources, cannot win with probability much better than 0 (for unpredictability applications, like one-way functions) or much better than 1/2 (indistinguishability applications for instance encryption schemes). In so called squared-friendly applications the winning probability of the adversary, for different values of the application secret randomness, is not only close to 0 or 1/2 on average, but also concentrated in the sense that its second central moment is small. The class of squared-friendly applications, which contains all unpredictability applications and many indistinguishability applications, is particularly important for key derivation. Barak et al. observed that for square-friendly applications one can beat the &quot;RT-bound&quot;, extracting secure keys with significantly smaller entropy loss. In turn Dodis and Yu showed that in squared-friendly applications one can directly use a &quot;weak&quot; key, which has only high entropy, as a secure key. In this paper we give sharp lower bounds on square security assuming security for &quot;weak&quot; keys. We show that any application which is either (a) secure with weak keys or (b) allows for entropy savings for keys derived by universal hashing, must be square-friendly. Quantitatively, our lower bounds match the positive results of Dodis and Yu and Barak et al. (TCC\\'13, CRYPTO\\'11) Hence, they can be understood as a general characterization of squared-friendly applications. While the positive results on squared-friendly applications where derived by one clever application of the Cauchy-Schwarz Inequality, for tight lower bounds we need more machinery. In our approach we use convex optimization techniques and some theory of circular matrices.","lang":"eng"}],"citation":{"ieee":"M. Skórski, “Lower bounds on key derivation for square-friendly applications,” presented at the STACS: Symposium on Theoretical Aspects of Computer Science, Hannover, Germany, 2017, vol. 66.","ista":"Skórski M. 2017. Lower bounds on key derivation for square-friendly applications. STACS: Symposium on Theoretical Aspects of Computer Science, LIPIcs, vol. 66, 57.","chicago":"Skórski, Maciej. “Lower Bounds on Key Derivation for Square-Friendly Applications,” Vol. 66. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017. <a href=\"https://doi.org/10.4230/LIPIcs.STACS.2017.57\">https://doi.org/10.4230/LIPIcs.STACS.2017.57</a>.","short":"M. Skórski, in:, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017.","ama":"Skórski M. Lower bounds on key derivation for square-friendly applications. In: Vol 66. Schloss Dagstuhl - Leibniz-Zentrum für Informatik; 2017. doi:<a href=\"https://doi.org/10.4230/LIPIcs.STACS.2017.57\">10.4230/LIPIcs.STACS.2017.57</a>","mla":"Skórski, Maciej. <i>Lower Bounds on Key Derivation for Square-Friendly Applications</i>. Vol. 66, 57, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017, doi:<a href=\"https://doi.org/10.4230/LIPIcs.STACS.2017.57\">10.4230/LIPIcs.STACS.2017.57</a>.","apa":"Skórski, M. (2017). Lower bounds on key derivation for square-friendly applications (Vol. 66). Presented at the STACS: Symposium on Theoretical Aspects of Computer Science, Hannover, Germany: Schloss Dagstuhl - Leibniz-Zentrum für Informatik. <a href=\"https://doi.org/10.4230/LIPIcs.STACS.2017.57\">https://doi.org/10.4230/LIPIcs.STACS.2017.57</a>"},"publisher":"Schloss Dagstuhl - Leibniz-Zentrum für Informatik","type":"conference","publication_status":"published","intvolume":"        66","year":"2017","conference":{"start_date":"2017-03-08","name":"STACS: Symposium on Theoretical Aspects of Computer Science","end_date":"2017-03-11","location":"Hannover, Germany"},"quality_controlled":"1","volume":66,"language":[{"iso":"eng"}],"isi":1,"article_processing_charge":"No","month":"03"},{"type":"conference","corr_author":"1","publisher":"Schloss Dagstuhl - Leibniz-Zentrum für Informatik","publication_status":"published","intvolume":"        67","pubrep_id":"927","has_accepted_license":"1","doi":"10.4230/LIPIcs.ITCS.2017.38","scopus_import":"1","abstract":[{"lang":"eng","text":"We study space complexity and time-space trade-offs with a focus not on peak memory usage but on overall memory consumption throughout the computation.  Such a cumulative space measure was introduced for the computational model of parallel black pebbling by [Alwen and Serbinenko ’15] as a tool for obtaining results in cryptography. We consider instead the non- deterministic black-white pebble game and prove optimal cumulative space lower bounds and trade-offs, where in order to minimize pebbling time the space has to remain large during a significant fraction of the pebbling. We also initiate the study of cumulative space in proof complexity, an area where other space complexity measures have been extensively studied during the last 10–15 years. Using and extending the connection between proof complexity and pebble games in [Ben-Sasson and Nordström ’08, ’11] we obtain several strong cumulative space results for (even parallel versions of) the resolution proof system, and outline some possible future directions of study of this, in our opinion, natural and interesting space measure."}],"citation":{"apa":"Alwen, J. F., De Rezende, S., Nordstrom, J., &#38; Vinyals, M. (2017). Cumulative space in black-white pebbling and resolution. In C. Papadimitriou (Ed.) (Vol. 67, p. 38:1-38-21). Presented at the ITCS: Innovations in Theoretical Computer Science, Berkeley, CA, United States: Schloss Dagstuhl - Leibniz-Zentrum für Informatik. <a href=\"https://doi.org/10.4230/LIPIcs.ITCS.2017.38\">https://doi.org/10.4230/LIPIcs.ITCS.2017.38</a>","mla":"Alwen, Joel F., et al. <i>Cumulative Space in Black-White Pebbling and Resolution</i>. Edited by Christos Papadimitriou, vol. 67, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017, p. 38:1-38-21, doi:<a href=\"https://doi.org/10.4230/LIPIcs.ITCS.2017.38\">10.4230/LIPIcs.ITCS.2017.38</a>.","short":"J.F. Alwen, S. De Rezende, J. Nordstrom, M. Vinyals, in:, C. Papadimitriou (Ed.), Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017, p. 38:1-38-21.","ama":"Alwen JF, De Rezende S, Nordstrom J, Vinyals M. Cumulative space in black-white pebbling and resolution. In: Papadimitriou C, ed. Vol 67. Schloss Dagstuhl - Leibniz-Zentrum für Informatik; 2017:38:1-38-21. doi:<a href=\"https://doi.org/10.4230/LIPIcs.ITCS.2017.38\">10.4230/LIPIcs.ITCS.2017.38</a>","chicago":"Alwen, Joel F, Susanna De Rezende, Jakob Nordstrom, and Marc Vinyals. “Cumulative Space in Black-White Pebbling and Resolution.” edited by Christos Papadimitriou, 67:38:1-38-21. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017. <a href=\"https://doi.org/10.4230/LIPIcs.ITCS.2017.38\">https://doi.org/10.4230/LIPIcs.ITCS.2017.38</a>.","ieee":"J. F. Alwen, S. De Rezende, J. Nordstrom, and M. Vinyals, “Cumulative space in black-white pebbling and resolution,” presented at the ITCS: Innovations in Theoretical Computer Science, Berkeley, CA, United States, 2017, vol. 67, p. 38:1-38-21.","ista":"Alwen JF, De Rezende S, Nordstrom J, Vinyals M. 2017. Cumulative space in black-white pebbling and resolution. ITCS: Innovations in Theoretical Computer Science, LIPIcs, vol. 67, 38:1-38-21."},"isi":1,"article_processing_charge":"No","file_date_updated":"2020-07-14T12:44:37Z","editor":[{"first_name":"Christos","last_name":"Papadimitriou","full_name":"Papadimitriou, Christos"}],"page":"38:1-38-21","month":"01","year":"2017","conference":{"start_date":"2017-01-09","end_date":"2017-01-11","name":"ITCS: Innovations in Theoretical Computer Science","location":"Berkeley, CA, United States"},"ddc":["005","600"],"quality_controlled":"1","volume":67,"language":[{"iso":"eng"}],"_id":"1175","date_created":"2018-12-11T11:50:33Z","oa_version":"Published Version","file":[{"checksum":"dbc94810be07c2fb1945d5c2a6130e6c","date_created":"2018-12-12T10:17:11Z","file_size":557769,"relation":"main_file","file_name":"IST-2018-927-v1+1_LIPIcs-ITCS-2017-38.pdf","creator":"system","file_id":"5263","access_level":"open_access","date_updated":"2020-07-14T12:44:37Z","content_type":"application/pdf"}],"publist_id":"6179","publication_identifier":{"issn":["1868-8969"]},"date_published":"2017-01-01T00:00:00Z","oa":1,"external_id":{"isi":["001532708700038"]},"author":[{"id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87","last_name":"Alwen","first_name":"Joel F","full_name":"Alwen, Joel F"},{"last_name":"De Rezende","first_name":"Susanna","full_name":"De Rezende, Susanna"},{"last_name":"Nordstrom","first_name":"Jakob","full_name":"Nordstrom, Jakob"},{"last_name":"Vinyals","first_name":"Marc","full_name":"Vinyals, Marc"}],"title":"Cumulative space in black-white pebbling and resolution","alternative_title":["LIPIcs"],"day":"01","department":[{"_id":"KrPi"}],"user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","date_updated":"2025-09-10T10:49:13Z","tmp":{"short":"CC BY (4.0)","legal_code_url":"https://creativecommons.org/licenses/by/4.0/legalcode","image":"/images/cc_by.png","name":"Creative Commons Attribution 4.0 International Public License (CC-BY 4.0)"},"status":"public"},{"abstract":[{"lang":"eng","text":"The algorithm Argon2i-B of Biryukov, Dinu and Khovratovich is currently being considered by the IRTF (Internet Research Task Force) as a new de-facto standard for password hashing. An older version (Argon2i-A) of the same algorithm was chosen as the winner of the recent Password Hashing Competition. An important competitor to Argon2i-B is the recently introduced Balloon Hashing (BH) algorithm of Corrigan-Gibs, Boneh and Schechter. A key security desiderata for any such algorithm is that evaluating it (even using a custom device) requires a large amount of memory amortized across multiple instances. Alwen and Blocki (CRYPTO 2016) introduced a class of theoretical attacks against Argon2i-A and BH. While these attacks yield large asymptotic reductions in the amount of memory, it was not, a priori, clear if (1) they can be extended to the newer Argon2i-B, (2) the attacks are effective on any algorithm for practical parameter ranges (e.g., 1GB of memory) and (3) if they can be effectively instantiated against any algorithm under realistic hardware constrains. In this work we answer all three of these questions in the affirmative for all three algorithms. This is also the first work to analyze the security of Argon2i-B. In more detail, we extend the theoretical attacks of Alwen and Blocki (CRYPTO 2016) to the recent Argon2i-B proposal demonstrating severe asymptotic deficiencies in its security. Next we introduce several novel heuristics for improving the attack's concrete memory efficiency even when on-chip memory bandwidth is bounded. We then simulate our attacks on randomly sampled Argon2i-A, Argon2i-B and BH instances and measure the resulting memory consumption for various practical parameter ranges and for a variety of upperbounds on the amount of parallelism available to the attacker. Finally we describe, implement, and test a new heuristic for applying the Alwen-Blocki attack to functions employing a technique developed by Corrigan-Gibs et al. for improving concrete security of memory-hard functions. We analyze the collected data and show the effects various parameters have on the memory consumption of the attack. In particular, we can draw several interesting conclusions about the level of security provided by these functions. · For the Alwen-Blocki attack to fail against practical memory parameters, Argon2i-B must be instantiated with more than 10 passes on memory - beyond the \"paranoid\" parameter setting in the current IRTF proposal. · The technique of Corrigan-Gibs for improving security can also be overcome by the Alwen-Blocki attack under realistic hardware constraints. · On a positive note, both the asymptotic and concrete security of Argon2i-B seem to improve on that of Argon2i-A."}],"citation":{"mla":"Alwen, Joel F., and Jeremiah Blocki. <i>Towards Practical Attacks on Argon2i and Balloon Hashing</i>. 7961977, IEEE, 2017, doi:<a href=\"https://doi.org/10.1109/EuroSP.2017.47\">10.1109/EuroSP.2017.47</a>.","apa":"Alwen, J. F., &#38; Blocki, J. (2017). Towards practical attacks on Argon2i and balloon hashing. Presented at the EuroS&#38;P: European Symposium on Security and Privacy, Paris, France: IEEE. <a href=\"https://doi.org/10.1109/EuroSP.2017.47\">https://doi.org/10.1109/EuroSP.2017.47</a>","ama":"Alwen JF, Blocki J. Towards practical attacks on Argon2i and balloon hashing. In: IEEE; 2017. doi:<a href=\"https://doi.org/10.1109/EuroSP.2017.47\">10.1109/EuroSP.2017.47</a>","short":"J.F. Alwen, J. Blocki, in:, IEEE, 2017.","chicago":"Alwen, Joel F, and Jeremiah Blocki. “Towards Practical Attacks on Argon2i and Balloon Hashing.” IEEE, 2017. <a href=\"https://doi.org/10.1109/EuroSP.2017.47\">https://doi.org/10.1109/EuroSP.2017.47</a>.","ieee":"J. F. Alwen and J. Blocki, “Towards practical attacks on Argon2i and balloon hashing,” presented at the EuroS&#38;P: European Symposium on Security and Privacy, Paris, France, 2017.","ista":"Alwen JF, Blocki J. 2017. Towards practical attacks on Argon2i and balloon hashing. EuroS&#38;P: European Symposium on Security and Privacy, 7961977."},"doi":"10.1109/EuroSP.2017.47","scopus_import":"1","publisher":"IEEE","type":"conference","publication_status":"published","language":[{"iso":"eng"}],"conference":{"end_date":"2017-04-28","name":"EuroS&P: European Symposium on Security and Privacy","location":"Paris, France","start_date":"2017-04-26"},"year":"2017","quality_controlled":"1","month":"07","isi":1,"article_processing_charge":"No","oa":1,"external_id":{"isi":["000424197300011"]},"publication_identifier":{"isbn":["978-150905761-0"]},"date_published":"2017-07-03T00:00:00Z","publist_id":"6178","_id":"1176","date_created":"2018-12-11T11:50:33Z","oa_version":"Submitted Version","article_number":"7961977","date_updated":"2023-09-20T11:22:25Z","status":"public","user_id":"c635000d-4b10-11ee-a964-aac5a93f6ac1","department":[{"_id":"KrPi"}],"day":"03","title":"Towards practical attacks on Argon2i and balloon hashing","author":[{"full_name":"Alwen, Joel F","last_name":"Alwen","first_name":"Joel F","id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87"},{"last_name":"Blocki","first_name":"Jeremiah","full_name":"Blocki, Jeremiah"}],"main_file_link":[{"url":"https://eprint.iacr.org/2016/759","open_access":"1"}]},{"type":"journal_article","publisher":"Springer","publication_status":"published","intvolume":"        30","has_accepted_license":"1","related_material":{"record":[{"id":"3238","relation":"earlier_version","status":"public"}]},"doi":"10.1007/s00145-016-9247-3","scopus_import":"1","abstract":[{"text":"We construct efficient authentication protocols and message authentication codes (MACs) whose security can be reduced to the learning parity with noise (LPN) problem. Despite a large body of work—starting with the (Formula presented.) protocol of Hopper and Blum in 2001—until now it was not even known how to construct an efficient authentication protocol from LPN which is secure against man-in-the-middle attacks. A MAC implies such a (two-round) protocol.","lang":"eng"}],"citation":{"chicago":"Kiltz, Eike, Krzysztof Z Pietrzak, Daniele Venturi, David Cash, and Abhishek Jain. “Efficient Authentication from Hard Learning Problems.” <i>Journal of Cryptology</i>. Springer, 2017. <a href=\"https://doi.org/10.1007/s00145-016-9247-3\">https://doi.org/10.1007/s00145-016-9247-3</a>.","ista":"Kiltz E, Pietrzak KZ, Venturi D, Cash D, Jain A. 2017. Efficient authentication from hard learning problems. Journal of Cryptology. 30(4), 1238–1275.","ieee":"E. Kiltz, K. Z. Pietrzak, D. Venturi, D. Cash, and A. Jain, “Efficient authentication from hard learning problems,” <i>Journal of Cryptology</i>, vol. 30, no. 4. Springer, pp. 1238–1275, 2017.","ama":"Kiltz E, Pietrzak KZ, Venturi D, Cash D, Jain A. Efficient authentication from hard learning problems. <i>Journal of Cryptology</i>. 2017;30(4):1238-1275. doi:<a href=\"https://doi.org/10.1007/s00145-016-9247-3\">10.1007/s00145-016-9247-3</a>","short":"E. Kiltz, K.Z. Pietrzak, D. Venturi, D. Cash, A. Jain, Journal of Cryptology 30 (2017) 1238–1275.","mla":"Kiltz, Eike, et al. “Efficient Authentication from Hard Learning Problems.” <i>Journal of Cryptology</i>, vol. 30, no. 4, Springer, 2017, pp. 1238–75, doi:<a href=\"https://doi.org/10.1007/s00145-016-9247-3\">10.1007/s00145-016-9247-3</a>.","apa":"Kiltz, E., Pietrzak, K. Z., Venturi, D., Cash, D., &#38; Jain, A. (2017). Efficient authentication from hard learning problems. <i>Journal of Cryptology</i>. Springer. <a href=\"https://doi.org/10.1007/s00145-016-9247-3\">https://doi.org/10.1007/s00145-016-9247-3</a>"},"isi":1,"article_processing_charge":"No","page":"1238 - 1275","issue":"4","file_date_updated":"2020-07-14T12:44:37Z","month":"10","year":"2017","ddc":["000"],"quality_controlled":"1","volume":30,"language":[{"iso":"eng"}],"project":[{"name":"Teaching Old Crypto New Tricks","call_identifier":"H2020","grant_number":"682815","_id":"258AA5B2-B435-11E9-9278-68D0E5697425"},{"_id":"258C570E-B435-11E9-9278-68D0E5697425","grant_number":"259668","name":"Provable Security for Physical Cryptography","call_identifier":"FP7"}],"_id":"1187","oa_version":"Submitted Version","date_created":"2018-12-11T11:50:37Z","publist_id":"6166","file":[{"file_id":"7843","access_level":"open_access","date_updated":"2020-07-14T12:44:37Z","content_type":"application/pdf","checksum":"c647520d115b772a1682fc06fa273eb1","date_created":"2020-05-14T16:30:17Z","file_size":516959,"relation":"main_file","file_name":"2017_JournalCrypto_Kiltz.pdf","creator":"dernst"}],"publication":"Journal of Cryptology","date_published":"2017-10-01T00:00:00Z","external_id":{"isi":["000410788600007"]},"oa":1,"author":[{"full_name":"Kiltz, Eike","last_name":"Kiltz","first_name":"Eike"},{"last_name":"Pietrzak","first_name":"Krzysztof Z","orcid":"0000-0002-9139-1654","full_name":"Pietrzak, Krzysztof Z","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87"},{"last_name":"Venturi","first_name":"Daniele","full_name":"Venturi, Daniele"},{"first_name":"David","last_name":"Cash","full_name":"Cash, David"},{"last_name":"Jain","first_name":"Abhishek","full_name":"Jain, Abhishek"}],"title":"Efficient authentication from hard learning problems","day":"01","department":[{"_id":"KrPi"}],"ec_funded":1,"article_type":"original","user_id":"c635000d-4b10-11ee-a964-aac5a93f6ac1","date_updated":"2025-04-14T07:22:06Z","status":"public"},{"date_updated":"2025-09-11T07:36:46Z","status":"public","user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","ec_funded":1,"department":[{"_id":"KrPi"}],"day":"05","author":[{"first_name":"Joshua","last_name":"Brody","full_name":"Brody, Joshua"},{"first_name":"Stefan","last_name":"Dziembowski","full_name":"Dziembowski, Stefan"},{"first_name":"Sebastian","last_name":"Faust","full_name":"Faust, Sebastian"},{"orcid":"0000-0002-9139-1654","full_name":"Pietrzak, Krzysztof Z","first_name":"Krzysztof Z","last_name":"Pietrzak","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87"}],"title":"Position based cryptography and multiparty communication complexity","main_file_link":[{"url":"https://eprint.iacr.org/2016/536","open_access":"1"}],"alternative_title":["LNCS"],"oa":1,"external_id":{"isi":["000739735000003"]},"publication_identifier":{"isbn":["978-331970499-9"]},"date_published":"2017-11-05T00:00:00Z","publist_id":"7200","_id":"605","project":[{"_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815","call_identifier":"H2020","name":"Teaching Old Crypto New Tricks"}],"date_created":"2018-12-11T11:47:27Z","oa_version":"Submitted Version","volume":10677,"language":[{"iso":"eng"}],"year":"2017","conference":{"start_date":"2017-11-12","location":"Baltimore, MD, United States","name":"TCC: Theory of Cryptography Conference","end_date":"2017-11-15"},"quality_controlled":"1","page":"56 - 81","editor":[{"last_name":"Kalai","first_name":"Yael","full_name":"Kalai, Yael"},{"full_name":"Reyzin, Leonid","last_name":"Reyzin","first_name":"Leonid"}],"month":"11","isi":1,"article_processing_charge":"No","abstract":[{"lang":"eng","text":"Position based cryptography (PBC), proposed in the seminal work of Chandran, Goyal, Moriarty, and Ostrovsky (SIAM J. Computing, 2014), aims at constructing cryptographic schemes in which the identity of the user is his geographic position. Chandran et al. construct PBC schemes for secure positioning and position-based key agreement in the bounded-storage model (Maurer, J. Cryptology, 1992). Apart from bounded memory, their security proofs need a strong additional restriction on the power of the adversary: he cannot compute joint functions of his inputs. Removing this assumption is left as an open problem. We show that an answer to this question would resolve a long standing open problem in multiparty communication complexity: finding a function that is hard to compute with low communication complexity in the simultaneous message model, but easy to compute in the fully adaptive model. On a more positive side: we also show some implications in the other direction, i.e.: we prove that lower bounds on the communication complexity of certain multiparty problems imply existence of PBC primitives. Using this result we then show two attractive ways to “bypass” our hardness result: the first uses the random oracle model, the second weakens the locality requirement in the bounded-storage model to online computability. The random oracle construction is arguably one of the simplest proposed so far in this area. Our results indicate that constructing improved provably secure protocols for PBC requires a better understanding of multiparty communication complexity. This is yet another example where negative results in one area (in our case: lower bounds in multiparty communication complexity) can be used to construct secure cryptographic schemes."}],"citation":{"short":"J. Brody, S. Dziembowski, S. Faust, K.Z. Pietrzak, in:, Y. Kalai, L. Reyzin (Eds.), Springer, 2017, pp. 56–81.","ama":"Brody J, Dziembowski S, Faust S, Pietrzak KZ. Position based cryptography and multiparty communication complexity. In: Kalai Y, Reyzin L, eds. Vol 10677. Springer; 2017:56-81. doi:<a href=\"https://doi.org/10.1007/978-3-319-70500-2_3\">10.1007/978-3-319-70500-2_3</a>","ieee":"J. Brody, S. Dziembowski, S. Faust, and K. Z. Pietrzak, “Position based cryptography and multiparty communication complexity,” presented at the TCC: Theory of Cryptography Conference, Baltimore, MD, United States, 2017, vol. 10677, pp. 56–81.","chicago":"Brody, Joshua, Stefan Dziembowski, Sebastian Faust, and Krzysztof Z Pietrzak. “Position Based Cryptography and Multiparty Communication Complexity.” edited by Yael Kalai and Leonid Reyzin, 10677:56–81. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-70500-2_3\">https://doi.org/10.1007/978-3-319-70500-2_3</a>.","ista":"Brody J, Dziembowski S, Faust S, Pietrzak KZ. 2017. Position based cryptography and multiparty communication complexity. TCC: Theory of Cryptography Conference, LNCS, vol. 10677, 56–81.","mla":"Brody, Joshua, et al. <i>Position Based Cryptography and Multiparty Communication Complexity</i>. Edited by Yael Kalai and Leonid Reyzin, vol. 10677, Springer, 2017, pp. 56–81, doi:<a href=\"https://doi.org/10.1007/978-3-319-70500-2_3\">10.1007/978-3-319-70500-2_3</a>.","apa":"Brody, J., Dziembowski, S., Faust, S., &#38; Pietrzak, K. Z. (2017). Position based cryptography and multiparty communication complexity. In Y. Kalai &#38; L. Reyzin (Eds.) (Vol. 10677, pp. 56–81). Presented at the TCC: Theory of Cryptography Conference, Baltimore, MD, United States: Springer. <a href=\"https://doi.org/10.1007/978-3-319-70500-2_3\">https://doi.org/10.1007/978-3-319-70500-2_3</a>"},"doi":"10.1007/978-3-319-70500-2_3","scopus_import":"1","intvolume":"     10677","type":"conference","publisher":"Springer","publication_status":"published"},{"user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","status":"public","date_updated":"2025-09-11T07:36:16Z","alternative_title":["LNCS"],"main_file_link":[{"url":"https://eprint.iacr.org/2017/945","open_access":"1"}],"title":"Moderately hard functions: Definition, instantiations, and applications","author":[{"full_name":"Alwen, Joel F","first_name":"Joel F","last_name":"Alwen","id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87"},{"full_name":"Tackmann, Björn","last_name":"Tackmann","first_name":"Björn"}],"department":[{"_id":"KrPi"}],"day":"05","date_published":"2017-11-05T00:00:00Z","publication_identifier":{"isbn":["978-331970499-9"]},"external_id":{"isi":["000739735000017"]},"oa":1,"oa_version":"Submitted Version","date_created":"2018-12-11T11:47:28Z","_id":"609","publist_id":"7196","quality_controlled":"1","year":"2017","conference":{"start_date":"2017-11-12","location":"Baltimore, MD, United States","name":"TCC: Theory of Cryptography","end_date":"2017-11-15"},"language":[{"iso":"eng"}],"volume":10677,"article_processing_charge":"No","isi":1,"month":"11","editor":[{"last_name":"Kalai","first_name":"Yael","full_name":"Kalai, Yael"},{"last_name":"Reyzin","first_name":"Leonid","full_name":"Reyzin, Leonid"}],"page":"493 - 526","scopus_import":"1","doi":"10.1007/978-3-319-70500-2_17","citation":{"ama":"Alwen JF, Tackmann B. Moderately hard functions: Definition, instantiations, and applications. In: Kalai Y, Reyzin L, eds. Vol 10677. Springer; 2017:493-526. doi:<a href=\"https://doi.org/10.1007/978-3-319-70500-2_17\">10.1007/978-3-319-70500-2_17</a>","short":"J.F. Alwen, B. Tackmann, in:, Y. Kalai, L. Reyzin (Eds.), Springer, 2017, pp. 493–526.","ista":"Alwen JF, Tackmann B. 2017. Moderately hard functions: Definition, instantiations, and applications. TCC: Theory of Cryptography, LNCS, vol. 10677, 493–526.","ieee":"J. F. Alwen and B. Tackmann, “Moderately hard functions: Definition, instantiations, and applications,” presented at the TCC: Theory of Cryptography, Baltimore, MD, United States, 2017, vol. 10677, pp. 493–526.","chicago":"Alwen, Joel F, and Björn Tackmann. “Moderately Hard Functions: Definition, Instantiations, and Applications.” edited by Yael Kalai and Leonid Reyzin, 10677:493–526. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-70500-2_17\">https://doi.org/10.1007/978-3-319-70500-2_17</a>.","mla":"Alwen, Joel F., and Björn Tackmann. <i>Moderately Hard Functions: Definition, Instantiations, and Applications</i>. Edited by Yael Kalai and Leonid Reyzin, vol. 10677, Springer, 2017, pp. 493–526, doi:<a href=\"https://doi.org/10.1007/978-3-319-70500-2_17\">10.1007/978-3-319-70500-2_17</a>.","apa":"Alwen, J. F., &#38; Tackmann, B. (2017). Moderately hard functions: Definition, instantiations, and applications. In Y. Kalai &#38; L. Reyzin (Eds.) (Vol. 10677, pp. 493–526). Presented at the TCC: Theory of Cryptography, Baltimore, MD, United States: Springer. <a href=\"https://doi.org/10.1007/978-3-319-70500-2_17\">https://doi.org/10.1007/978-3-319-70500-2_17</a>"},"abstract":[{"lang":"eng","text":"Several cryptographic schemes and applications are based on functions that are both reasonably efficient to compute and moderately hard to invert, including client puzzles for Denial-of-Service protection, password protection via salted hashes, or recent proof-of-work blockchain systems. Despite their wide use, a definition of this concept has not yet been distilled and formalized explicitly. Instead, either the applications are proven directly based on the assumptions underlying the function, or some property of the function is proven, but the security of the application is argued only informally. The goal of this work is to provide a (universal) definition that decouples the efforts of designing new moderately hard functions and of building protocols based on them, serving as an interface between the two. On a technical level, beyond the mentioned definitions, we instantiate the model for four different notions of hardness. We extend the work of Alwen and Serbinenko (STOC 2015) by providing a general tool for proving security for the first notion of memory-hard functions that allows for provably secure applications. The tool allows us to recover all of the graph-theoretic techniques developed for proving security under the older, non-composable, notion of security used by Alwen and Serbinenko. As an application of our definition of moderately hard functions, we prove the security of two different schemes for proofs of effort (PoE). We also formalize and instantiate the concept of a non-interactive proof of effort (niPoE), in which the proof is not bound to a particular communication context but rather any bit-string chosen by the prover."}],"publication_status":"published","type":"conference","publisher":"Springer","intvolume":"     10677"},{"issue":"2","page":"145-161","file_date_updated":"2020-07-14T12:47:24Z","month":"02","volume":2016,"language":[{"iso":"eng"}],"ddc":["000"],"year":"2017","quality_controlled":"1","intvolume":"      2016","has_accepted_license":"1","type":"journal_article","publisher":"Ruhr University Bochum","publication_status":"published","abstract":[{"text":"PMAC is a simple and parallel block-cipher mode of operation, which was introduced by Black and Rogaway at Eurocrypt 2002. If instantiated with a (pseudo)random permutation over n-bit strings, PMAC constitutes a provably secure variable input-length (pseudo)random function. For adversaries making q queries, each of length at most l (in n-bit blocks), and of total length σ ≤ ql, the original paper proves an upper bound on the distinguishing advantage of  Ο(σ2/2n), while the currently best bound is  Ο (qσ/2n).In this work we show that this bound is tight by giving an attack with advantage Ω (q2l/2n). In the PMAC construction one initially XORs a mask to every message block, where the mask for the ith block is computed as τi := γi·L, where L is a (secret) random value, and γi is the i-th codeword of the Gray code. Our attack applies more generally to any sequence of γi’s which contains a large coset of a subgroup of GF(2n). We then investigate if the security of PMAC can be further improved by using τi’s that are k-wise independent, for k > 1 (the original distribution is only 1-wise independent). We observe that the security of PMAC will not increase in general, even if the masks are chosen from a 2-wise independent distribution, and then prove that the security increases to O(q<2/2n), if the τi are 4-wise independent. Due to simple extension attacks, this is the best bound one can hope for, using any distribution on the masks. Whether 3-wise independence is already sufficient to get this level of security is left as an open problem.","lang":"eng"}],"citation":{"ama":"Gazi P, Pietrzak KZ, Rybar M. The exact security of PMAC. <i>IACR Transactions on Symmetric Cryptology</i>. 2017;2016(2):145-161. doi:<a href=\"https://doi.org/10.13154/TOSC.V2016.I2.145-161\">10.13154/TOSC.V2016.I2.145-161</a>","short":"P. Gazi, K.Z. Pietrzak, M. Rybar, IACR Transactions on Symmetric Cryptology 2016 (2017) 145–161.","ista":"Gazi P, Pietrzak KZ, Rybar M. 2017. The exact security of PMAC. IACR Transactions on Symmetric Cryptology. 2016(2), 145–161.","chicago":"Gazi, Peter, Krzysztof Z Pietrzak, and Michal Rybar. “The Exact Security of PMAC.” <i>IACR Transactions on Symmetric Cryptology</i>. Ruhr University Bochum, 2017. <a href=\"https://doi.org/10.13154/TOSC.V2016.I2.145-161\">https://doi.org/10.13154/TOSC.V2016.I2.145-161</a>.","ieee":"P. Gazi, K. Z. Pietrzak, and M. Rybar, “The exact security of PMAC,” <i>IACR Transactions on Symmetric Cryptology</i>, vol. 2016, no. 2. Ruhr University Bochum, pp. 145–161, 2017.","mla":"Gazi, Peter, et al. “The Exact Security of PMAC.” <i>IACR Transactions on Symmetric Cryptology</i>, vol. 2016, no. 2, Ruhr University Bochum, 2017, pp. 145–61, doi:<a href=\"https://doi.org/10.13154/TOSC.V2016.I2.145-161\">10.13154/TOSC.V2016.I2.145-161</a>.","apa":"Gazi, P., Pietrzak, K. Z., &#38; Rybar, M. (2017). The exact security of PMAC. <i>IACR Transactions on Symmetric Cryptology</i>. Ruhr University Bochum. <a href=\"https://doi.org/10.13154/TOSC.V2016.I2.145-161\">https://doi.org/10.13154/TOSC.V2016.I2.145-161</a>"},"related_material":{"record":[{"id":"838","relation":"dissertation_contains","status":"public"}]},"doi":"10.13154/TOSC.V2016.I2.145-161","day":"03","department":[{"_id":"KrPi"}],"ec_funded":1,"author":[{"id":"3E0BFE38-F248-11E8-B48F-1D18A9856A87","last_name":"Gazi","first_name":"Peter","full_name":"Gazi, Peter"},{"orcid":"0000-0002-9139-1654","full_name":"Pietrzak, Krzysztof Z","last_name":"Pietrzak","first_name":"Krzysztof Z","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87"},{"id":"2B3E3DE8-F248-11E8-B48F-1D18A9856A87","full_name":"Rybar, Michal","first_name":"Michal","last_name":"Rybar"}],"title":"The exact security of PMAC","tmp":{"short":"CC BY (4.0)","legal_code_url":"https://creativecommons.org/licenses/by/4.0/legalcode","image":"/images/cc_by.png","name":"Creative Commons Attribution 4.0 International Public License (CC-BY 4.0)"},"date_updated":"2026-04-08T14:18:39Z","status":"public","user_id":"3E5EF7F0-F248-11E8-B48F-1D18A9856A87","file":[{"file_id":"6197","content_type":"application/pdf","date_updated":"2020-07-14T12:47:24Z","access_level":"open_access","relation":"main_file","file_size":597335,"checksum":"f23161d685dd957ae8d7274132999684","date_created":"2019-04-04T13:53:58Z","creator":"dernst","file_name":"2017_IACR_Gazi.pdf"}],"publication":"IACR Transactions on Symmetric Cryptology","project":[{"call_identifier":"H2020","name":"Teaching Old Crypto New Tricks","grant_number":"682815","_id":"258AA5B2-B435-11E9-9278-68D0E5697425"}],"_id":"6196","oa_version":"Published Version","date_created":"2019-04-04T13:48:23Z","oa":1,"publication_identifier":{"eissn":["2519-173X"]},"date_published":"2017-02-03T00:00:00Z"},{"date_created":"2018-12-11T11:47:37Z","oa_version":"Submitted Version","_id":"635","project":[{"_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815","call_identifier":"H2020","name":"Teaching Old Crypto New Tricks"}],"publist_id":"7154","date_published":"2017-01-01T00:00:00Z","publication_identifier":{"isbn":["978-331956616-0"]},"oa":1,"external_id":{"isi":["000419175900002"]},"main_file_link":[{"open_access":"1","url":"https://eprint.iacr.org/2016/989"}],"author":[{"id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87","last_name":"Alwen","first_name":"Joel F","full_name":"Alwen, Joel F"},{"full_name":"Chen, Binchi","first_name":"Binchi","last_name":"Chen"},{"id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87","full_name":"Pietrzak, Krzysztof Z","orcid":"0000-0002-9139-1654","first_name":"Krzysztof Z","last_name":"Pietrzak"},{"full_name":"Reyzin, Leonid","first_name":"Leonid","last_name":"Reyzin"},{"full_name":"Tessaro, Stefano","last_name":"Tessaro","first_name":"Stefano"}],"title":"Scrypt is maximally memory hard","alternative_title":["LNCS"],"ec_funded":1,"day":"01","department":[{"_id":"KrPi"}],"user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","status":"public","date_updated":"2025-09-11T07:24:51Z","publication_status":"published","type":"conference","publisher":"Springer","intvolume":"     10212","scopus_import":"1","doi":"10.1007/978-3-319-56617-7_2","citation":{"short":"J.F. Alwen, B. Chen, K.Z. Pietrzak, L. Reyzin, S. Tessaro, in:, J.-S. Coron, J. Buus Nielsen (Eds.), Springer, 2017, pp. 33–62.","ama":"Alwen JF, Chen B, Pietrzak KZ, Reyzin L, Tessaro S. Scrypt is maximally memory hard. In: Coron J-S, Buus Nielsen J, eds. Vol 10212. Springer; 2017:33-62. doi:<a href=\"https://doi.org/10.1007/978-3-319-56617-7_2\">10.1007/978-3-319-56617-7_2</a>","ista":"Alwen JF, Chen B, Pietrzak KZ, Reyzin L, Tessaro S. 2017. Scrypt is maximally memory hard. EUROCRYPT: Theory and Applications of Cryptographic Techniques, LNCS, vol. 10212, 33–62.","ieee":"J. F. Alwen, B. Chen, K. Z. Pietrzak, L. Reyzin, and S. Tessaro, “Scrypt is maximally memory hard,” presented at the EUROCRYPT: Theory and Applications of Cryptographic Techniques, Paris, France, 2017, vol. 10212, pp. 33–62.","chicago":"Alwen, Joel F, Binchi Chen, Krzysztof Z Pietrzak, Leonid Reyzin, and Stefano Tessaro. “Scrypt Is Maximally Memory Hard.” edited by Jean-Sébastien Coron and Jesper Buus Nielsen, 10212:33–62. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-56617-7_2\">https://doi.org/10.1007/978-3-319-56617-7_2</a>.","apa":"Alwen, J. F., Chen, B., Pietrzak, K. Z., Reyzin, L., &#38; Tessaro, S. (2017). Scrypt is maximally memory hard. In J.-S. Coron &#38; J. Buus Nielsen (Eds.) (Vol. 10212, pp. 33–62). Presented at the EUROCRYPT: Theory and Applications of Cryptographic Techniques, Paris, France: Springer. <a href=\"https://doi.org/10.1007/978-3-319-56617-7_2\">https://doi.org/10.1007/978-3-319-56617-7_2</a>","mla":"Alwen, Joel F., et al. <i>Scrypt Is Maximally Memory Hard</i>. Edited by Jean-Sébastien Coron and Jesper Buus Nielsen, vol. 10212, Springer, 2017, pp. 33–62, doi:<a href=\"https://doi.org/10.1007/978-3-319-56617-7_2\">10.1007/978-3-319-56617-7_2</a>."},"abstract":[{"text":"Memory-hard functions (MHFs) are hash algorithms whose evaluation cost is dominated by memory cost. As memory, unlike computation, costs about the same across different platforms, MHFs cannot be evaluated at significantly lower cost on dedicated hardware like ASICs. MHFs have found widespread applications including password hashing, key derivation, and proofs-of-work. This paper focuses on scrypt, a simple candidate MHF designed by Percival, and described in RFC 7914. It has been used within a number of cryptocurrencies (e.g., Litecoin and Dogecoin) and has been an inspiration for Argon2d, one of the winners of the recent password-hashing competition. Despite its popularity, no rigorous lower bounds on its memory complexity are known. We prove that scrypt is optimally memory-hard, i.e., its cumulative memory complexity (cmc) in the parallel random oracle model is Ω(n2w), where w and n are the output length and number of invocations of the underlying hash function, respectively. High cmc is a strong security target for MHFs introduced by Alwen and Serbinenko (STOC’15) which implies high memory cost even for adversaries who can amortize the cost over many evaluations and evaluate the underlying hash functions many times in parallel. Our proof is the first showing optimal memory-hardness for any MHF. Our result improves both quantitatively and qualitatively upon the recent work by Alwen et al. (EUROCRYPT’16) who proved a weaker lower bound of Ω(n2w/ log2 n) for a restricted class of adversaries.","lang":"eng"}],"article_processing_charge":"No","isi":1,"month":"01","page":"33 - 62","editor":[{"full_name":"Coron, Jean-Sébastien","last_name":"Coron","first_name":"Jean-Sébastien"},{"last_name":"Buus Nielsen","first_name":"Jesper","full_name":"Buus Nielsen, Jesper"}],"quality_controlled":"1","year":"2017","conference":{"location":"Paris, France","name":"EUROCRYPT: Theory and Applications of Cryptographic Techniques","end_date":"2017-05-04","start_date":"2017-04-30"},"language":[{"iso":"eng"}],"volume":10212},{"year":"2017","conference":{"start_date":"2017-07-20","location":"Santa Barbara, CA, United States","end_date":"2017-07-24","name":"CRYPTO: Cryptology"},"quality_controlled":"1","volume":10401,"language":[{"iso":"eng"}],"isi":1,"article_processing_charge":"No","page":"133 - 163","editor":[{"full_name":"Katz, Jonathan","last_name":"Katz","first_name":"Jonathan"},{"full_name":"Shacham, Hovav","last_name":"Shacham","first_name":"Hovav"}],"month":"01","related_material":{"record":[{"status":"public","id":"10035","relation":"dissertation_contains"}]},"doi":"10.1007/978-3-319-63688-7_5","scopus_import":"1","abstract":[{"lang":"eng","text":"For many cryptographic primitives, it is relatively easy to achieve selective security (where the adversary commits a-priori to some of the choices to be made later in the attack) but appears difficult to achieve the more natural notion of adaptive security (where the adversary can make all choices on the go as the attack progresses). A series of several recent works shows how to cleverly achieve adaptive security in several such scenarios including generalized selective decryption (Panjwani, TCC ’07 and Fuchsbauer et al., CRYPTO ’15), constrained PRFs (Fuchsbauer et al., ASIACRYPT ’14), and Yao garbled circuits (Jafargholi and Wichs, TCC ’16b). Although the above works expressed vague intuition that they share a common technique, the connection was never made precise. In this work we present a new framework that connects all of these works and allows us to present them in a unified and simplified fashion. Moreover, we use the framework to derive a new result for adaptively secure secret sharing over access structures defined via monotone circuits. We envision that further applications will follow in the future. Underlying our framework is the following simple idea. It is well known that selective security, where the adversary commits to n-bits of information about his future choices, automatically implies adaptive security at the cost of amplifying the adversary’s advantage by a factor of up to 2n. However, in some cases the proof of selective security proceeds via a sequence of hybrids, where each pair of adjacent hybrids locally only requires some smaller partial information consisting of m ≪ n bits. The partial information needed might be completely different between different pairs of hybrids, and if we look across all the hybrids we might rely on the entire n-bit commitment. Nevertheless, the above is sufficient to prove adaptive security, at the cost of amplifying the adversary’s advantage by a factor of only 2m ≪ 2n. In all of our examples using the above framework, the different hybrids are captured by some sort of a graph pebbling game and the amount of information that the adversary needs to commit to in each pair of hybrids is bounded by the maximum number of pebbles in play at any point in time. Therefore, coming up with better strategies for proving adaptive security translates to various pebbling strategies for different types of graphs."}],"citation":{"apa":"Jafargholi, Z., Kamath Hosdurg, C., Klein, K., Komargodski, I., Pietrzak, K. Z., &#38; Wichs, D. (2017). Be adaptive avoid overcommitting. In J. Katz &#38; H. Shacham (Eds.) (Vol. 10401, pp. 133–163). Presented at the CRYPTO: Cryptology, Santa Barbara, CA, United States: Springer. <a href=\"https://doi.org/10.1007/978-3-319-63688-7_5\">https://doi.org/10.1007/978-3-319-63688-7_5</a>","mla":"Jafargholi, Zahra, et al. <i>Be Adaptive Avoid Overcommitting</i>. Edited by Jonathan Katz and Hovav Shacham, vol. 10401, Springer, 2017, pp. 133–63, doi:<a href=\"https://doi.org/10.1007/978-3-319-63688-7_5\">10.1007/978-3-319-63688-7_5</a>.","short":"Z. Jafargholi, C. Kamath Hosdurg, K. Klein, I. Komargodski, K.Z. Pietrzak, D. Wichs, in:, J. Katz, H. Shacham (Eds.), Springer, 2017, pp. 133–163.","ama":"Jafargholi Z, Kamath Hosdurg C, Klein K, Komargodski I, Pietrzak KZ, Wichs D. Be adaptive avoid overcommitting. In: Katz J, Shacham H, eds. Vol 10401. Springer; 2017:133-163. doi:<a href=\"https://doi.org/10.1007/978-3-319-63688-7_5\">10.1007/978-3-319-63688-7_5</a>","ieee":"Z. Jafargholi, C. Kamath Hosdurg, K. Klein, I. Komargodski, K. Z. Pietrzak, and D. Wichs, “Be adaptive avoid overcommitting,” presented at the CRYPTO: Cryptology, Santa Barbara, CA, United States, 2017, vol. 10401, pp. 133–163.","ista":"Jafargholi Z, Kamath Hosdurg C, Klein K, Komargodski I, Pietrzak KZ, Wichs D. 2017. Be adaptive avoid overcommitting. CRYPTO: Cryptology, LNCS, vol. 10401, 133–163.","chicago":"Jafargholi, Zahra, Chethan Kamath Hosdurg, Karen Klein, Ilan Komargodski, Krzysztof Z Pietrzak, and Daniel Wichs. “Be Adaptive Avoid Overcommitting.” edited by Jonathan Katz and Hovav Shacham, 10401:133–63. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-63688-7_5\">https://doi.org/10.1007/978-3-319-63688-7_5</a>."},"publisher":"Springer","type":"conference","publication_status":"published","intvolume":"     10401","user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","date_updated":"2026-04-08T07:01:44Z","status":"public","alternative_title":["LNCS"],"title":"Be adaptive avoid overcommitting","author":[{"first_name":"Zahra","last_name":"Jafargholi","full_name":"Jafargholi, Zahra"},{"first_name":"Chethan","last_name":"Kamath Hosdurg","full_name":"Kamath Hosdurg, Chethan","orcid":"0009-0006-6812-7317","id":"4BD3F30E-F248-11E8-B48F-1D18A9856A87"},{"first_name":"Karen","last_name":"Klein","full_name":"Klein, Karen","id":"3E83A2F8-F248-11E8-B48F-1D18A9856A87"},{"first_name":"Ilan","last_name":"Komargodski","full_name":"Komargodski, Ilan"},{"id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87","full_name":"Pietrzak, Krzysztof Z","orcid":"0000-0002-9139-1654","first_name":"Krzysztof Z","last_name":"Pietrzak"},{"first_name":"Daniel","last_name":"Wichs","full_name":"Wichs, Daniel"}],"main_file_link":[{"open_access":"1","url":"https://eprint.iacr.org/2017/515"}],"department":[{"_id":"KrPi"}],"day":"01","ec_funded":1,"publication_identifier":{"isbn":["978-331963687-0"]},"date_published":"2017-01-01T00:00:00Z","external_id":{"isi":["000438672600005"]},"oa":1,"project":[{"_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815","call_identifier":"H2020","name":"Teaching Old Crypto New Tricks"}],"_id":"637","oa_version":"Submitted Version","date_created":"2018-12-11T11:47:38Z","publist_id":"7151"},{"oa_version":"Submitted Version","date_created":"2018-12-11T11:47:39Z","project":[{"grant_number":"682815","_id":"258AA5B2-B435-11E9-9278-68D0E5697425","name":"Teaching Old Crypto New Tricks","call_identifier":"H2020"}],"_id":"640","publist_id":"7148","date_published":"2017-04-01T00:00:00Z","publication_identifier":{"isbn":["978-331956616-0"]},"external_id":{"isi":["000419175900001"]},"oa":1,"alternative_title":["LNCS"],"author":[{"id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87","full_name":"Alwen, Joel F","last_name":"Alwen","first_name":"Joel F"},{"full_name":"Blocki, Jeremiah","first_name":"Jeremiah","last_name":"Blocki"},{"id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87","last_name":"Pietrzak","first_name":"Krzysztof Z","orcid":"0000-0002-9139-1654","full_name":"Pietrzak, Krzysztof Z"}],"title":"Depth-robust graphs and their cumulative memory complexity","main_file_link":[{"url":"https://eprint.iacr.org/2016/875","open_access":"1"}],"day":"01","department":[{"_id":"KrPi"}],"ec_funded":1,"user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","status":"public","date_updated":"2025-09-11T07:21:36Z","publication_status":"published","type":"conference","corr_author":"1","publisher":"Springer","intvolume":"     10212","scopus_import":"1","doi":"10.1007/978-3-319-56617-7_1","citation":{"mla":"Alwen, Joel F., et al. <i>Depth-Robust Graphs and Their Cumulative Memory Complexity</i>. Edited by Jean-Sébastien Coron and Jesper Buus Nielsen, vol. 10212, Springer, 2017, pp. 3–32, doi:<a href=\"https://doi.org/10.1007/978-3-319-56617-7_1\">10.1007/978-3-319-56617-7_1</a>.","apa":"Alwen, J. F., Blocki, J., &#38; Pietrzak, K. Z. (2017). Depth-robust graphs and their cumulative memory complexity. In J.-S. Coron &#38; J. Buus Nielsen (Eds.) (Vol. 10212, pp. 3–32). Presented at the EUROCRYPT: Theory and Applications of Cryptographic Techniques, Paris, France: Springer. <a href=\"https://doi.org/10.1007/978-3-319-56617-7_1\">https://doi.org/10.1007/978-3-319-56617-7_1</a>","ieee":"J. F. Alwen, J. Blocki, and K. Z. Pietrzak, “Depth-robust graphs and their cumulative memory complexity,” presented at the EUROCRYPT: Theory and Applications of Cryptographic Techniques, Paris, France, 2017, vol. 10212, pp. 3–32.","chicago":"Alwen, Joel F, Jeremiah Blocki, and Krzysztof Z Pietrzak. “Depth-Robust Graphs and Their Cumulative Memory Complexity.” edited by Jean-Sébastien Coron and Jesper Buus Nielsen, 10212:3–32. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-56617-7_1\">https://doi.org/10.1007/978-3-319-56617-7_1</a>.","ista":"Alwen JF, Blocki J, Pietrzak KZ. 2017. Depth-robust graphs and their cumulative memory complexity. EUROCRYPT: Theory and Applications of Cryptographic Techniques, LNCS, vol. 10212, 3–32.","short":"J.F. Alwen, J. Blocki, K.Z. Pietrzak, in:, J.-S. Coron, J. Buus Nielsen (Eds.), Springer, 2017, pp. 3–32.","ama":"Alwen JF, Blocki J, Pietrzak KZ. Depth-robust graphs and their cumulative memory complexity. In: Coron J-S, Buus Nielsen J, eds. Vol 10212. Springer; 2017:3-32. doi:<a href=\"https://doi.org/10.1007/978-3-319-56617-7_1\">10.1007/978-3-319-56617-7_1</a>"},"abstract":[{"lang":"eng","text":"Data-independent Memory Hard Functions (iMHFS) are finding a growing number of applications in security; especially in the domain of password hashing. An important property of a concrete iMHF is specified by fixing a directed acyclic graph (DAG) Gn on n nodes. The quality of that iMHF is then captured by the following two pebbling complexities of Gn: – The parallel cumulative pebbling complexity Π∥cc(Gn) must be as high as possible (to ensure that the amortized cost of computing the function on dedicated hardware is dominated by the cost of memory). – The sequential space-time pebbling complexity Πst(Gn) should be as close as possible to Π∥cc(Gn) (to ensure that using many cores in parallel and amortizing over many instances does not give much of an advantage). In this paper we construct a family of DAGs with best possible parameters in an asymptotic sense, i.e., where Π∥cc(Gn) = Ω(n2/ log(n)) (which matches a known upper bound) and Πst(Gn) is within a constant factor of Π∥cc(Gn). Our analysis relies on a new connection between the pebbling complexity of a DAG and its depth-robustness (DR) – a well studied combinatorial property. We show that high DR is sufficient for high Π∥cc. Alwen and Blocki (CRYPTO’16) showed that high DR is necessary and so, together, these results fully characterize DAGs with high Π∥cc in terms of DR. Complementing these results, we provide new upper and lower bounds on the Π∥cc of several important candidate iMHFs from the literature. We give the first lower bounds on the memory hardness of the Catena and Balloon Hashing functions in a parallel model of computation and we give the first lower bounds of any kind for (a version) of Argon2i. Finally we describe a new class of pebbling attacks improving on those of Alwen and Blocki (CRYPTO’16). By instantiating these attacks we upperbound the Π∥cc of the Password Hashing Competition winner Argon2i and one of the Balloon Hashing functions by O (n1.71). We also show an upper bound of O(n1.625) for the Catena functions and the two remaining Balloon Hashing functions."}],"article_processing_charge":"No","isi":1,"month":"04","editor":[{"last_name":"Coron","first_name":"Jean-Sébastien","full_name":"Coron, Jean-Sébastien"},{"full_name":"Buus Nielsen, Jesper","first_name":"Jesper","last_name":"Buus Nielsen"}],"page":"3 - 32","quality_controlled":"1","conference":{"end_date":"2017-05-04","name":"EUROCRYPT: Theory and Applications of Cryptographic Techniques","location":"Paris, France","start_date":"2017-04-30"},"year":"2017","language":[{"iso":"eng"}],"volume":10212},{"abstract":[{"text":"In this thesis we discuss the exact security of message authentications codes HMAC , NMAC , and PMAC . NMAC is a mode of operation which turns a fixed input-length keyed hash function f into a variable input-length function. A practical single-key variant of NMAC called HMAC is a very popular and widely deployed message authentication code (MAC). PMAC is a block-cipher based mode of operation, which also happens to be the most famous fully parallel MAC. NMAC was introduced by Bellare, Canetti and Krawczyk Crypto’96, who proved it to be a secure pseudorandom function (PRF), and thus also a MAC, under two assumptions. Unfortunately, for many instantiations of HMAC one of them has been found to be wrong. To restore the provable guarantees for NMAC , Bellare [Crypto’06] showed its security without this assumption. PMAC was introduced by Black and Rogaway at Eurocrypt 2002. If instantiated with a pseudorandom permutation over n -bit strings, PMAC constitutes a provably secure variable input-length PRF. For adversaries making q queries, each of length at most ` (in n -bit blocks), and of total length σ ≤ q` , the original paper proves an upper bound on the distinguishing advantage of O ( σ 2 / 2 n ), while the currently best bound is O ( qσ/ 2 n ). In this work we show that this bound is tight by giving an attack with advantage Ω( q 2 `/ 2 n ). In the PMAC construction one initially XORs a mask to every message block, where the mask for the i th block is computed as τ i := γ i · L , where L is a (secret) random value, and γ i is the i -th codeword of the Gray code. Our attack applies more generally to any sequence of γ i ’s which contains a large coset of a subgroup of GF (2 n ). As for NMAC , our first contribution is a simpler and uniform proof: If f is an ε -secure PRF (against q queries) and a δ - non-adaptively secure PRF (against q queries), then NMAC f is an ( ε + `qδ )-secure PRF against q queries of length at most ` blocks each. We also show that this ε + `qδ bound is basically tight by constructing an f for which an attack with advantage `qδ exists. Moreover, we analyze the PRF-security of a modification of NMAC called NI by An and Bellare that avoids the constant rekeying on multi-block messages in NMAC and allows for an information-theoretic analysis. We carry out such an analysis, obtaining a tight `q 2 / 2 c bound for this step, improving over the trivial bound of ` 2 q 2 / 2 c . Finally, we investigate, if the security of PMAC can be further improved by using τ i ’s that are k -wise independent, for k &gt; 1 (the original has k = 1). We observe that the security of PMAC will not increase in general if k = 2, and then prove that the security increases to O ( q 2 / 2 n ), if the k = 4. Due to simple extension attacks, this is the best bound one can hope for, using any distribution on the masks. Whether k = 3 is already sufficient to get this level of security is left as an open problem. Keywords: Message authentication codes, Pseudorandom functions, HMAC, PMAC. ","lang":"eng"}],"citation":{"short":"M. Rybar, (The Exact Security of) Message Authentication Codes, Institute of Science and Technology Austria, 2017.","ama":"Rybar M. (The exact security of) Message authentication codes. 2017. doi:<a href=\"https://doi.org/10.15479/AT:ISTA:th_828\">10.15479/AT:ISTA:th_828</a>","ieee":"M. Rybar, “(The exact security of) Message authentication codes,” Institute of Science and Technology Austria, 2017.","ista":"Rybar M. 2017. (The exact security of) Message authentication codes. Institute of Science and Technology Austria.","chicago":"Rybar, Michal. “(The Exact Security of) Message Authentication Codes.” Institute of Science and Technology Austria, 2017. <a href=\"https://doi.org/10.15479/AT:ISTA:th_828\">https://doi.org/10.15479/AT:ISTA:th_828</a>.","mla":"Rybar, Michal. <i>(The Exact Security of) Message Authentication Codes</i>. Institute of Science and Technology Austria, 2017, doi:<a href=\"https://doi.org/10.15479/AT:ISTA:th_828\">10.15479/AT:ISTA:th_828</a>.","apa":"Rybar, M. (2017). <i>(The exact security of) Message authentication codes</i>. Institute of Science and Technology Austria. <a href=\"https://doi.org/10.15479/AT:ISTA:th_828\">https://doi.org/10.15479/AT:ISTA:th_828</a>"},"related_material":{"record":[{"id":"2082","relation":"part_of_dissertation","status":"public"},{"relation":"part_of_dissertation","id":"6196","status":"public"}]},"doi":"10.15479/AT:ISTA:th_828","pubrep_id":"828","has_accepted_license":"1","publisher":"Institute of Science and Technology Austria","corr_author":"1","type":"dissertation","publication_status":"published","language":[{"iso":"eng"}],"ddc":["000"],"year":"2017","page":"86","file_date_updated":"2020-07-14T12:48:12Z","month":"06","article_processing_charge":"No","oa":1,"publication_identifier":{"issn":["2663-337X"]},"date_published":"2017-06-26T00:00:00Z","publist_id":"6810","file":[{"access_level":"open_access","date_updated":"2020-07-14T12:48:12Z","content_type":"application/pdf","file_id":"4799","file_name":"IST-2017-828-v1+3_2017_Rybar_thesis.pdf","creator":"system","checksum":"ff8639ec4bded6186f44c7bd3ee26804","date_created":"2018-12-12T10:10:13Z","file_size":847400,"relation":"main_file"},{"creator":"dernst","file_name":"2017_Thesis_Rybar_source.zip","relation":"source_file","checksum":"3462101745ce8ad199c2d0f75dae4a7e","date_created":"2019-04-05T08:24:11Z","file_size":26054879,"date_updated":"2020-07-14T12:48:12Z","content_type":"application/zip","access_level":"closed","file_id":"6202"}],"_id":"838","oa_version":"Published Version","date_created":"2018-12-11T11:48:46Z","date_updated":"2026-04-08T14:18:39Z","status":"public","user_id":"ba8df636-2132-11f1-aed0-ed93e2281fdd","day":"26","department":[{"_id":"KrPi"}],"OA_place":"publisher","degree_awarded":"PhD","alternative_title":["ISTA Thesis"],"title":"(The exact security of) Message authentication codes","author":[{"last_name":"Rybar","first_name":"Michal","full_name":"Rybar, Michal","id":"2B3E3DE8-F248-11E8-B48F-1D18A9856A87"}]},{"publist_id":"7125","date_created":"2018-12-11T11:47:42Z","oa_version":"Submitted Version","_id":"648","oa":1,"external_id":{"isi":["000425175500043"]},"date_published":"2017-04-01T00:00:00Z","publication_identifier":{"isbn":["978-331955910-0"]},"day":"01","department":[{"_id":"KrPi"}],"author":[{"full_name":"Skórski, Maciej","last_name":"Skórski","first_name":"Maciej","id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD"}],"main_file_link":[{"url":"https://eprint.iacr.org/2016/1186.pdf","open_access":"1"}],"title":"On the complexity of breaking pseudoentropy","alternative_title":["LNCS"],"status":"public","date_updated":"2025-09-11T07:14:42Z","user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","intvolume":"     10185","publication_status":"published","corr_author":"1","publisher":"Springer","type":"conference","citation":{"mla":"Skórski, Maciej. <i>On the Complexity of Breaking Pseudoentropy</i>. Edited by Gerhard Jäger and Silvia Steila, vol. 10185, Springer, 2017, pp. 600–13, doi:<a href=\"https://doi.org/10.1007/978-3-319-55911-7_43\">10.1007/978-3-319-55911-7_43</a>.","apa":"Skórski, M. (2017). On the complexity of breaking pseudoentropy. In G. Jäger &#38; S. Steila (Eds.) (Vol. 10185, pp. 600–613). Presented at the TAMC: Theory and Applications of Models of Computation, Bern, Switzerland: Springer. <a href=\"https://doi.org/10.1007/978-3-319-55911-7_43\">https://doi.org/10.1007/978-3-319-55911-7_43</a>","short":"M. Skórski, in:, G. Jäger, S. Steila (Eds.), Springer, 2017, pp. 600–613.","ama":"Skórski M. On the complexity of breaking pseudoentropy. In: Jäger G, Steila S, eds. Vol 10185. Springer; 2017:600-613. doi:<a href=\"https://doi.org/10.1007/978-3-319-55911-7_43\">10.1007/978-3-319-55911-7_43</a>","ieee":"M. Skórski, “On the complexity of breaking pseudoentropy,” presented at the TAMC: Theory and Applications of Models of Computation, Bern, Switzerland, 2017, vol. 10185, pp. 600–613.","chicago":"Skórski, Maciej. “On the Complexity of Breaking Pseudoentropy.” edited by Gerhard Jäger and Silvia Steila, 10185:600–613. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-55911-7_43\">https://doi.org/10.1007/978-3-319-55911-7_43</a>.","ista":"Skórski M. 2017. On the complexity of breaking pseudoentropy. TAMC: Theory and Applications of Models of Computation, LNCS, vol. 10185, 600–613."},"abstract":[{"lang":"eng","text":"Pseudoentropy has found a lot of important applications to cryptography and complexity theory. In this paper we focus on the foundational problem that has not been investigated so far, namely by how much pseudoentropy (the amount seen by computationally bounded attackers) differs from its information-theoretic counterpart (seen by unbounded observers), given certain limits on attacker’s computational power? We provide the following answer for HILL pseudoentropy, which exhibits a threshold behavior around the size exponential in the entropy amount:– If the attacker size (s) and advantage () satisfy s (formula presented) where k is the claimed amount of pseudoentropy, then the pseudoentropy boils down to the information-theoretic smooth entropy. – If s (formula presented) then pseudoentropy could be arbitrarily bigger than the information-theoretic smooth entropy. Besides answering the posted question, we show an elegant application of our result to the complexity theory, namely that it implies the clas-sical result on the existence of functions hard to approximate (due to Pippenger). In our approach we utilize non-constructive techniques: the duality of linear programming and the probabilistic method."}],"scopus_import":"1","doi":"10.1007/978-3-319-55911-7_43","month":"04","editor":[{"first_name":"Gerhard","last_name":"Jäger","full_name":"Jäger, Gerhard"},{"full_name":"Steila, Silvia","first_name":"Silvia","last_name":"Steila"}],"page":"600 - 613","article_processing_charge":"No","isi":1,"language":[{"iso":"eng"}],"volume":10185,"quality_controlled":"1","year":"2017","conference":{"end_date":"2017-04-22","name":"TAMC: Theory and Applications of Models of Computation","location":"Bern, Switzerland","start_date":"2017-04-20"}},{"date_updated":"2026-04-16T09:59:38Z","status":"public","user_id":"ba8df636-2132-11f1-aed0-ed93e2281fdd","department":[{"_id":"KrPi"}],"day":"01","alternative_title":["LNCS"],"title":"A cryptographic view of regularity lemmas: Simpler unified proofs and refined bounds","author":[{"last_name":"Skórski","first_name":"Maciej","full_name":"Skórski, Maciej","id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD"}],"main_file_link":[{"open_access":"1","url":"https://eprint.iacr.org/2016/965.pdf"}],"external_id":{"isi":["000425175500042"]},"oa":1,"publication_identifier":{"issn":["0302-9743"]},"date_published":"2017-01-01T00:00:00Z","publist_id":"7119","_id":"650","oa_version":"Submitted Version","date_created":"2018-12-11T11:47:42Z","volume":10185,"language":[{"iso":"eng"}],"year":"2017","conference":{"location":"Bern, Switzerland","end_date":"2017-04-22","name":"TAMC: Theory and Applications of Models of Computation","start_date":"2017-04-20"},"quality_controlled":"1","editor":[{"full_name":"Jäger, Gerhard","last_name":"Jäger","first_name":"Gerhard"},{"full_name":"Steila, Silvia","first_name":"Silvia","last_name":"Steila"}],"page":"586 - 599","month":"01","isi":1,"article_processing_charge":"No","abstract":[{"lang":"eng","text":"In this work we present a short and unified proof for the Strong and Weak Regularity Lemma, based on the cryptographic tech-nique called low-complexity approximations. In short, both problems reduce to a task of finding constructively an approximation for a certain target function under a class of distinguishers (test functions), where dis-tinguishers are combinations of simple rectangle-indicators. In our case these approximations can be learned by a simple iterative procedure, which yields a unified and simple proof, achieving for any graph with density d and any approximation parameter the partition size. The novelty in our proof is: (a) a simple approach which yields both strong and weaker variant, and (b) improvements when d = o(1). At an abstract level, our proof can be seen a refinement and simplification of the “analytic” proof given by Lovasz and Szegedy."}],"citation":{"mla":"Skórski, Maciej. <i>A Cryptographic View of Regularity Lemmas: Simpler Unified Proofs and Refined Bounds</i>. Edited by Gerhard Jäger and Silvia Steila, vol. 10185, Springer, 2017, pp. 586–99, doi:<a href=\"https://doi.org/10.1007/978-3-319-55911-7_42\">10.1007/978-3-319-55911-7_42</a>.","apa":"Skórski, M. (2017). A cryptographic view of regularity lemmas: Simpler unified proofs and refined bounds. In G. Jäger &#38; S. Steila (Eds.) (Vol. 10185, pp. 586–599). Presented at the TAMC: Theory and Applications of Models of Computation, Bern, Switzerland: Springer. <a href=\"https://doi.org/10.1007/978-3-319-55911-7_42\">https://doi.org/10.1007/978-3-319-55911-7_42</a>","short":"M. Skórski, in:, G. Jäger, S. Steila (Eds.), Springer, 2017, pp. 586–599.","ama":"Skórski M. A cryptographic view of regularity lemmas: Simpler unified proofs and refined bounds. In: Jäger G, Steila S, eds. Vol 10185. Springer; 2017:586-599. doi:<a href=\"https://doi.org/10.1007/978-3-319-55911-7_42\">10.1007/978-3-319-55911-7_42</a>","ista":"Skórski M. 2017. A cryptographic view of regularity lemmas: Simpler unified proofs and refined bounds. TAMC: Theory and Applications of Models of Computation, LNCS, vol. 10185, 586–599.","chicago":"Skórski, Maciej. “A Cryptographic View of Regularity Lemmas: Simpler Unified Proofs and Refined Bounds.” edited by Gerhard Jäger and Silvia Steila, 10185:586–99. Springer, 2017. <a href=\"https://doi.org/10.1007/978-3-319-55911-7_42\">https://doi.org/10.1007/978-3-319-55911-7_42</a>.","ieee":"M. Skórski, “A cryptographic view of regularity lemmas: Simpler unified proofs and refined bounds,” presented at the TAMC: Theory and Applications of Models of Computation, Bern, Switzerland, 2017, vol. 10185, pp. 586–599."},"doi":"10.1007/978-3-319-55911-7_42","scopus_import":"1","intvolume":"     10185","corr_author":"1","type":"conference","publisher":"Springer","publication_status":"published"},{"oa":1,"external_id":{"isi":["000440307700063"]},"date_published":"2017-10-30T00:00:00Z","publication_identifier":{"isbn":["9781450349468"]},"publication":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","date_created":"2019-06-06T13:21:29Z","oa_version":"Submitted Version","_id":"6527","project":[{"_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815","name":"Teaching Old Crypto New Tricks","call_identifier":"H2020"}],"status":"public","date_updated":"2025-09-18T10:40:38Z","user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","ec_funded":1,"day":"30","department":[{"_id":"KrPi"}],"author":[{"first_name":"Joel F","last_name":"Alwen","full_name":"Alwen, Joel F","id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87"},{"full_name":"Blocki, Jeremiah","last_name":"Blocki","first_name":"Jeremiah"},{"first_name":"Ben","last_name":"Harsha","full_name":"Harsha, Ben"}],"main_file_link":[{"url":"https://eprint.iacr.org/2017/443","open_access":"1"}],"title":"Practical graphs for optimal side-channel resistant memory-hard functions","citation":{"apa":"Alwen, J. F., Blocki, J., &#38; Harsha, B. (2017). Practical graphs for optimal side-channel resistant memory-hard functions. In <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i> (pp. 1001–1017). Dallas, TX, USA: ACM. <a href=\"https://doi.org/10.1145/3133956.3134031\">https://doi.org/10.1145/3133956.3134031</a>","mla":"Alwen, Joel F., et al. “Practical Graphs for Optimal Side-Channel Resistant Memory-Hard Functions.” <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>, ACM, 2017, pp. 1001–17, doi:<a href=\"https://doi.org/10.1145/3133956.3134031\">10.1145/3133956.3134031</a>.","short":"J.F. Alwen, J. Blocki, B. Harsha, in:, Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ACM, 2017, pp. 1001–1017.","ama":"Alwen JF, Blocki J, Harsha B. Practical graphs for optimal side-channel resistant memory-hard functions. In: <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>. ACM; 2017:1001-1017. doi:<a href=\"https://doi.org/10.1145/3133956.3134031\">10.1145/3133956.3134031</a>","chicago":"Alwen, Joel F, Jeremiah Blocki, and Ben Harsha. “Practical Graphs for Optimal Side-Channel Resistant Memory-Hard Functions.” In <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>, 1001–17. ACM, 2017. <a href=\"https://doi.org/10.1145/3133956.3134031\">https://doi.org/10.1145/3133956.3134031</a>.","ista":"Alwen JF, Blocki J, Harsha B. 2017. Practical graphs for optimal side-channel resistant memory-hard functions. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. CCS: Conference on Computer and Communications Security, 1001–1017.","ieee":"J. F. Alwen, J. Blocki, and B. Harsha, “Practical graphs for optimal side-channel resistant memory-hard functions,” in <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>, Dallas, TX, USA, 2017, pp. 1001–1017."},"abstract":[{"lang":"eng","text":"A memory-hard function (MHF) ƒn with parameter n can be computed in sequential time and space n. Simultaneously, a high amortized parallel area-time complexity (aAT) is incurred per evaluation. In practice, MHFs are used to limit the rate at which an adversary (using a custom computational device) can evaluate a security sensitive function that still occasionally needs to be evaluated by honest users (using an off-the-shelf general purpose device). The most prevalent examples of such sensitive functions are Key Derivation Functions (KDFs) and password hashing algorithms where rate limits help mitigate off-line dictionary attacks. As the honest users' inputs to these functions are often (low-entropy) passwords special attention is given to a class of side-channel resistant MHFs called iMHFs.\r\n\r\nEssentially all iMHFs can be viewed as some mode of operation (making n calls to some round function) given by a directed acyclic graph (DAG) with very low indegree. Recently, a combinatorial property of a DAG has been identified (called \"depth-robustness\") which results in good provable security for an iMHF based on that DAG. Depth-robust DAGs have also proven useful in other cryptographic applications. Unfortunately, up till now, all known very depth-robust DAGs are impractically complicated and little is known about their exact (i.e. non-asymptotic) depth-robustness both in theory and in practice.\r\n\r\nIn this work we build and analyze (both formally and empirically) several exceedingly simple and efficient to navigate practical DAGs for use in iMHFs and other applications. For each DAG we:\r\n*Prove that their depth-robustness is asymptotically maximal.\r\n*Prove bounds of at least 3 orders of magnitude better on their exact depth-robustness compared to known bounds for other practical iMHF.\r\n*Implement and empirically evaluate their depth-robustness and aAT against a variety of state-of-the art (and several new) depth-reduction and low aAT attacks. \r\nWe find that, against all attacks, the new DAGs perform significantly better in practice than Argon2i, the most widely deployed iMHF in practice.\r\n\r\nAlong the way we also improve the best known empirical attacks on the aAT of Argon2i by implementing and testing several heuristic versions of a (hitherto purely theoretical) depth-reduction attack. Finally, we demonstrate practicality of our constructions by modifying the Argon2i code base to use one of the new high aAT DAGs. Experimental benchmarks on a standard off-the-shelf CPU show that the new modifications do not adversely affect the impressive throughput of Argon2i (despite seemingly enjoying significantly higher aAT).\r\n"}],"scopus_import":"1","doi":"10.1145/3133956.3134031","publication_status":"published","publisher":"ACM","type":"conference","language":[{"iso":"eng"}],"quality_controlled":"1","conference":{"start_date":"2017-10-30","end_date":"2017-11-03","name":"CCS: Conference on Computer and Communications Security","location":"Dallas, TX, USA"},"year":"2017","month":"10","page":"1001-1017","article_processing_charge":"No","isi":1},{"article_processing_charge":"No","month":"07","file_date_updated":"2020-07-14T12:47:46Z","quality_controlled":"1","ddc":["005"],"conference":{"start_date":"2017-07-10","location":"Warsaw, Poland","name":"ICALP: Automata, Languages and Programming","end_date":"2017-07-14"},"year":"2017","language":[{"iso":"eng"}],"volume":80,"publication_status":"published","publisher":"Schloss Dagstuhl - Leibniz-Zentrum für Informatik","corr_author":"1","type":"conference","has_accepted_license":"1","pubrep_id":"893","intvolume":"        80","scopus_import":"1","doi":"10.4230/LIPIcs.ICALP.2017.39","citation":{"ama":"Pietrzak KZ, Skórski M. Non uniform attacks against pseudoentropy. In: Vol 80. Schloss Dagstuhl - Leibniz-Zentrum für Informatik; 2017. doi:<a href=\"https://doi.org/10.4230/LIPIcs.ICALP.2017.39\">10.4230/LIPIcs.ICALP.2017.39</a>","short":"K.Z. Pietrzak, M. Skórski, in:, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017.","chicago":"Pietrzak, Krzysztof Z, and Maciej Skórski. “Non Uniform Attacks against Pseudoentropy,” Vol. 80. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017. <a href=\"https://doi.org/10.4230/LIPIcs.ICALP.2017.39\">https://doi.org/10.4230/LIPIcs.ICALP.2017.39</a>.","ista":"Pietrzak KZ, Skórski M. 2017. Non uniform attacks against pseudoentropy. ICALP: Automata, Languages and Programming, LIPIcs, vol. 80, 39.","ieee":"K. Z. Pietrzak and M. Skórski, “Non uniform attacks against pseudoentropy,” presented at the ICALP: Automata, Languages and Programming, Warsaw, Poland, 2017, vol. 80.","apa":"Pietrzak, K. Z., &#38; Skórski, M. (2017). Non uniform attacks against pseudoentropy (Vol. 80). Presented at the ICALP: Automata, Languages and Programming, Warsaw, Poland: Schloss Dagstuhl - Leibniz-Zentrum für Informatik. <a href=\"https://doi.org/10.4230/LIPIcs.ICALP.2017.39\">https://doi.org/10.4230/LIPIcs.ICALP.2017.39</a>","mla":"Pietrzak, Krzysztof Z., and Maciej Skórski. <i>Non Uniform Attacks against Pseudoentropy</i>. Vol. 80, 39, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017, doi:<a href=\"https://doi.org/10.4230/LIPIcs.ICALP.2017.39\">10.4230/LIPIcs.ICALP.2017.39</a>."},"abstract":[{"lang":"eng","text":"De, Trevisan and Tulsiani [CRYPTO 2010] show that every distribution over n-bit strings which has constant statistical distance to uniform (e.g., the output of a pseudorandom generator mapping n-1 to n bit strings), can be distinguished from the uniform distribution with advantage epsilon by a circuit of size O( 2^n epsilon^2). We generalize this result, showing that a distribution which has less than k bits of min-entropy, can be distinguished from any distribution with k bits of delta-smooth min-entropy with advantage epsilon by a circuit of size O(2^k epsilon^2/delta^2). As a special case, this implies that any distribution with support at most 2^k (e.g., the output of a pseudoentropy generator mapping k to n bit strings) can be distinguished from any given distribution with min-entropy k+1 with advantage epsilon by a circuit of size O(2^k epsilon^2). Our result thus shows that pseudoentropy distributions face basically the same non-uniform attacks as pseudorandom distributions. "}],"alternative_title":["LIPIcs"],"title":"Non uniform attacks against pseudoentropy","author":[{"id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87","last_name":"Pietrzak","first_name":"Krzysztof Z","orcid":"0000-0002-9139-1654","full_name":"Pietrzak, Krzysztof Z"},{"id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD","full_name":"Skórski, Maciej","first_name":"Maciej","last_name":"Skórski"}],"day":"01","department":[{"_id":"KrPi"}],"ec_funded":1,"user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","status":"public","tmp":{"short":"CC BY (4.0)","legal_code_url":"https://creativecommons.org/licenses/by/4.0/legalcode","image":"/images/cc_by.png","name":"Creative Commons Attribution 4.0 International Public License (CC-BY 4.0)"},"date_updated":"2025-07-10T11:54:07Z","article_number":"39","oa_version":"Published Version","date_created":"2018-12-11T11:47:59Z","project":[{"call_identifier":"H2020","name":"Teaching Old Crypto New Tricks","_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815"}],"_id":"697","publist_id":"7003","file":[{"file_name":"IST-2017-893-v1+1_LIPIcs-ICALP-2017-39.pdf","creator":"system","checksum":"e95618a001692f1af2d68f5fde43bc1f","date_created":"2018-12-12T10:08:40Z","file_size":601004,"relation":"main_file","access_level":"open_access","date_updated":"2020-07-14T12:47:46Z","content_type":"application/pdf","file_id":"4701"}],"date_published":"2017-07-01T00:00:00Z","publication_identifier":{"issn":["1868-8969"]},"oa":1},{"date_published":"2017-08-01T00:00:00Z","publication_identifier":{"issn":["1868-8969"]},"oa":1,"oa_version":"Published Version","article_number":"20","date_created":"2018-12-11T11:48:04Z","project":[{"grant_number":"682815","_id":"258AA5B2-B435-11E9-9278-68D0E5697425","name":"Teaching Old Crypto New Tricks","call_identifier":"H2020"}],"_id":"710","publist_id":"6979","file":[{"file_id":"4991","access_level":"open_access","content_type":"application/pdf","date_updated":"2020-07-14T12:47:49Z","file_size":604813,"date_created":"2018-12-12T10:13:10Z","checksum":"89225c7dcec2c93838458c9102858985","relation":"main_file","file_name":"IST-2017-888-v1+1_LIPIcs-APPROX-RANDOM-2017-20.pdf","creator":"system"}],"user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","status":"public","tmp":{"short":"CC BY (4.0)","legal_code_url":"https://creativecommons.org/licenses/by/4.0/legalcode","image":"/images/cc_by.png","name":"Creative Commons Attribution 4.0 International Public License (CC-BY 4.0)"},"date_updated":"2025-07-10T11:54:14Z","alternative_title":["LIPIcs"],"title":"Renyi entropy estimation revisited","author":[{"full_name":"Obremski, Maciej","first_name":"Maciej","last_name":"Obremski"},{"id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD","full_name":"Skórski, Maciej","last_name":"Skórski","first_name":"Maciej"}],"day":"01","department":[{"_id":"KrPi"}],"ec_funded":1,"scopus_import":"1","doi":"10.4230/LIPIcs.APPROX-RANDOM.2017.20","citation":{"apa":"Obremski, M., &#38; Skórski, M. (2017). Renyi entropy estimation revisited (Vol. 81). Presented at the 20th International Workshop on Approximation Algorithms for Combinatorial Optimization Problems, APPROX, Berkeley, USA: Schloss Dagstuhl - Leibniz-Zentrum für Informatik. <a href=\"https://doi.org/10.4230/LIPIcs.APPROX-RANDOM.2017.20\">https://doi.org/10.4230/LIPIcs.APPROX-RANDOM.2017.20</a>","mla":"Obremski, Maciej, and Maciej Skórski. <i>Renyi Entropy Estimation Revisited</i>. Vol. 81, 20, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017, doi:<a href=\"https://doi.org/10.4230/LIPIcs.APPROX-RANDOM.2017.20\">10.4230/LIPIcs.APPROX-RANDOM.2017.20</a>.","chicago":"Obremski, Maciej, and Maciej Skórski. “Renyi Entropy Estimation Revisited,” Vol. 81. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017. <a href=\"https://doi.org/10.4230/LIPIcs.APPROX-RANDOM.2017.20\">https://doi.org/10.4230/LIPIcs.APPROX-RANDOM.2017.20</a>.","ieee":"M. Obremski and M. Skórski, “Renyi entropy estimation revisited,” presented at the 20th International Workshop on Approximation Algorithms for Combinatorial Optimization Problems, APPROX, Berkeley, USA, 2017, vol. 81.","ista":"Obremski M, Skórski M. 2017. Renyi entropy estimation revisited. 20th International Workshop on Approximation Algorithms for Combinatorial Optimization Problems, APPROX, LIPIcs, vol. 81, 20.","short":"M. Obremski, M. Skórski, in:, Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2017.","ama":"Obremski M, Skórski M. Renyi entropy estimation revisited. In: Vol 81. Schloss Dagstuhl - Leibniz-Zentrum für Informatik; 2017. doi:<a href=\"https://doi.org/10.4230/LIPIcs.APPROX-RANDOM.2017.20\">10.4230/LIPIcs.APPROX-RANDOM.2017.20</a>"},"abstract":[{"text":"We revisit the problem of estimating entropy of discrete distributions from independent samples, studied recently by Acharya, Orlitsky, Suresh and Tyagi (SODA 2015), improving their upper and lower bounds on the necessary sample size n. For estimating Renyi entropy of order alpha, up to constant accuracy and error probability, we show the following * Upper bounds n = O(1) 2^{(1-1/alpha)H_alpha} for integer alpha&gt;1, as the worst case over distributions with Renyi entropy equal to H_alpha. * Lower bounds n = Omega(1) K^{1-1/alpha} for any real alpha&gt;1, with the constant being an inverse polynomial of the accuracy, as the worst case over all distributions on K elements. Our upper bounds essentially replace the alphabet size by a factor exponential in the entropy, which offers improvements especially in low or medium entropy regimes (interesting for example in anomaly detection). As for the lower bounds, our proof explicitly shows how the complexity depends on both alphabet and accuracy, partially solving the open problem posted in previous works. The argument for upper bounds derives a clean identity for the variance of falling-power sum of a multinomial distribution. Our approach for lower bounds utilizes convex optimization to find a distribution with possibly worse estimation performance, and may be of independent interest as a tool to work with Le Cam’s two point method. ","lang":"eng"}],"publication_status":"published","corr_author":"1","publisher":"Schloss Dagstuhl - Leibniz-Zentrum für Informatik","type":"conference","has_accepted_license":"1","pubrep_id":"888","intvolume":"        81","quality_controlled":"1","year":"2017","ddc":["005","600"],"conference":{"start_date":"2017-08-18","name":"20th International Workshop on Approximation Algorithms for Combinatorial Optimization Problems, APPROX","end_date":"2017-08-18","location":"Berkeley, USA"},"language":[{"iso":"eng"}],"volume":81,"article_processing_charge":"No","month":"08","file_date_updated":"2020-07-14T12:47:49Z"},{"scopus_import":"1","doi":"10.1109/isit.2017.8006529","citation":{"apa":"Skórski, M. (2017). On the complexity of estimating Rènyi divergences. In <i>2017 IEEE International Symposium on Information Theory</i>. Aachen, Germany: IEEE. <a href=\"https://doi.org/10.1109/isit.2017.8006529\">https://doi.org/10.1109/isit.2017.8006529</a>","mla":"Skórski, Maciej. “On the Complexity of Estimating Rènyi Divergences.” <i>2017 IEEE International Symposium on Information Theory</i>, 8006529, IEEE, 2017, doi:<a href=\"https://doi.org/10.1109/isit.2017.8006529\">10.1109/isit.2017.8006529</a>.","chicago":"Skórski, Maciej. “On the Complexity of Estimating Rènyi Divergences.” In <i>2017 IEEE International Symposium on Information Theory</i>. IEEE, 2017. <a href=\"https://doi.org/10.1109/isit.2017.8006529\">https://doi.org/10.1109/isit.2017.8006529</a>.","ieee":"M. Skórski, “On the complexity of estimating Rènyi divergences,” in <i>2017 IEEE International Symposium on Information Theory</i>, Aachen, Germany, 2017.","ista":"Skórski M. 2017. On the complexity of estimating Rènyi divergences. 2017 IEEE International Symposium on Information Theory. ISIT: International Symposium on Information Theory, 8006529.","ama":"Skórski M. On the complexity of estimating Rènyi divergences. In: <i>2017 IEEE International Symposium on Information Theory</i>. IEEE; 2017. doi:<a href=\"https://doi.org/10.1109/isit.2017.8006529\">10.1109/isit.2017.8006529</a>","short":"M. Skórski, in:, 2017 IEEE International Symposium on Information Theory, IEEE, 2017."},"abstract":[{"text":"This paper studies the complexity of estimating Rényi divergences of discrete distributions: p observed from samples and the baseline distribution q known a priori. Extending the results of Acharya et al. (SODA'15) on estimating Rényi entropy, we present improved estimation techniques together with upper and lower bounds on the sample complexity. We show that, contrarily to estimating Rényi entropy where a sublinear (in the alphabet size) number of samples suffices, the sample complexity is heavily dependent on events occurring unlikely in q, and is unbounded in general (no matter what an estimation technique is used). For any divergence of integer order bigger than 1, we provide upper and lower bounds on the number of samples dependent on probabilities of p and q (the lower bounds hold for non-integer orders as well). We conclude that the worst-case sample complexity is polynomial in the alphabet size if and only if the probabilities of q are non-negligible. This gives theoretical insights into heuristics used in the applied literature to handle numerical instability, which occurs for small probabilities of q. Our result shows that they should be handled with care not only because of numerical issues, but also because of a blow up in the sample complexity.","lang":"eng"}],"publication_status":"published","publisher":"IEEE","type":"conference","quality_controlled":"1","conference":{"start_date":"2017-06-25","name":"ISIT: International Symposium on Information Theory","end_date":"2017-06-30","location":"Aachen, Germany"},"year":"2017","language":[{"iso":"eng"}],"article_processing_charge":"No","month":"08","date_published":"2017-08-09T00:00:00Z","publication_identifier":{"isbn":["9781509040964"]},"arxiv":1,"external_id":{"arxiv":["1702.01666"]},"oa":1,"oa_version":"Preprint","article_number":"8006529","date_created":"2019-06-06T12:53:09Z","project":[{"_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815","name":"Teaching Old Crypto New Tricks","call_identifier":"H2020"}],"_id":"6526","publication":"2017 IEEE International Symposium on Information Theory","user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","status":"public","date_updated":"2026-07-07T13:32:59Z","author":[{"first_name":"Maciej","last_name":"Skórski","full_name":"Skórski, Maciej","id":"EC09FA6A-02D0-11E9-8223-86B7C91467DD"}],"main_file_link":[{"url":"https://arxiv.org/abs/1702.01666","open_access":"1"}],"title":"On the complexity of estimating Rènyi divergences","department":[{"_id":"KrPi"}],"day":"09","ec_funded":1,"das_tickbox":"1"}]