CT-ISG: On the Design of Secure Hash Functions and Privacy-Preserving Protocols

虽然密码学的数学研究已经产生了丰富的理论，虽然密码学的使用已经变得相当广泛，但不幸的是，密码学的理论和实践之间仍然存在着巨大的差距。 这项研究的目的就是试图弥合这一差距。 重点是设计和分析的基本密码原语，是实际的，但理论上的声音。 本研究集中在两个特定领域：安全哈希函数的设计和使用，以及更有效的隐私保护协议的设计。由于最近发现的行业标准散列函数的弱点，有新的兴趣和紧迫性，研究散列函数的基本设计原则，以及如何在应用程序中适当地使用这种散列函数。 实际上，尽管散列函数最初被设计为充当消息转发器，它应该提供一种称为抗冲突的安全形式，但它们实际上用于许多不同类型的应用程序中，其中安全要求可能有所不同：有时给定应用程序中散列函数的安全要求可能比抗冲突性弱，强，或者可能无法与之相比。 该项目研究用于构建满足应用程序中所需的各种安全要求的散列函数的新方法，以及如何调整应用程序本身，以最大限度地减少对散列函数的安全要求。随着计算机和互联网在日常交易中的广泛使用，对隐私问题的关注变得更加紧迫。 隐私的一个关键方面是可否认性：如果用户运行一个协议，窃听者甚至协议的其他参与者都不可能说服第三方交易确实发生了。 虽然有令人信服的理由专注于这个领域，但也有一些技术问题与哈希函数相关的一些子问题重叠。

While the mathematical study of cryptography has yielded a rich theory, and while the use of cryptography has become quite widespread, there is unfortunately still a significant gap between the theory and practice of cryptography. The goal of this research is to try to bridge this gap. The emphasis is on the design and analysis of fundamental cryptographic primitives that are practical yet theoretically sound. This research focuses on two specific areas: the design and use of secure hash functions, and the design of more efficient privacy-preserving protocols. Because of recently discovered weaknesses in industry-standard hash functions, there is renewed interest and urgency to study the basic design principles of hash functions, as well as how such hash functions should be appropriately used in applications. Indeed, although hash functions were originally designed to serve as message digests, which should provide a form of security known as collision resistance, they are actually used in many different types of applications where the security requirements may be somewhat different: sometimes the security requirement of the hash function in a given application may be weaker than, stronger than, or perhaps just incomparable to collision resistance. This project investigates new methodologies for constructing hash functions that satisfy the various security requirements required in applications, as well as how the applications themselves may be adapted so as to minimize the security requirements placed on the hash function. With the widespread use of computers and the Internet in daily transactions, concerns about privacy issues have taken on new urgency. One key aspect of privacy is deniability: if a user runs a protocol, it should not be possible for an eavesdropper, or even another participant in the protocol, to convince a third party that the transaction actually occurred. While there are compelling reasons to focus on this area for its own sake, there are also a number of technical issues that arise that overlap with some of the subproblems associated with hash functions.