David Pointcheval obtained a PhD in Computer Science and has since worked on the Cryptography Team at the École Normale Supérieure in France. His research focuses on provable security of cryptographic primitives and protocols.

Foreword xi
David POINTCHEVAL Chapter 1 Public-Key Encryption and Security Notions 1Nuttapong ATTRAPADUNG and Takahiro MATSUDA 1.1. Basic definitions for PKE 2 1.1.1. Basic notation 2 1.1.2. Public-key encryption 2 1.1.3. IND-CPA and IND-CCA security 2 1.1.4. Other basic security notions and relations 4 1.2. Basic PKE schemes 5 1.2.1. Game-based proofs 5 1.2.2. ElGamal encryption 6 1.2.3. Simplified CS encryption 8 1.2.4. Cramer-Shoup encryption 11 1.2.5. Other specific PKE schemes 14 1.3. Generic constructions for IND-CCA secure PKE 16 1.3.1. Hybrid encryption 17 1.3.2. Naor-Yung construction and extensions 19 1.3.3. Fujisaki-Okamoto and other transforms in the RO model 21 1.3.4. Other generic constructions for IND-CCA secure PKE 23 1.4. Advanced topics 25 1.4.1. Intermediate notions related to CCA 25 1.4.2. IND-CCA security in multi-user setting and tight security 26 1.4.3. Key-dependent message security 28 1.4.4. More topics on PKE 30 1.5. References 31 Chapter 2 Signatures and Security Notions 47Marc FISCHLIN 2.1. Signature schemes 47 2.1.1. Definition 47 2.1.2. Examples of practical schemes 49 2.2. Unforgeability 51 2.2.1. Discussion 51 2.2.2. Existential unforgeability under chosen-message attacks 53 2.2.3. Unforgeability of practical schemes 54 2.3. Strong unforgeability 56 2.3.1. Discussion 56 2.3.2. Strong existential unforgeability under chosen-message attacks 57 2.3.3. Strong unforgeability of practical schemes 58 2.3.4. Building strongly unforgeable schemes 59 2.4. Summary 60 2.5. References 60 Chapter 3 Zero-Knowledge Proofs 63Ivan VISCONTI 3.1. Introduction 63 3.2. Notation 64 3.3. Classical zero-knowledge proofs 64 3.3.1. Zero knowledge 65 3.4. How to build a zero-knowledge proof system 68 3.4.1 ZK proofs for all NP 70 3.4.2. Round complexity 71 3.5. Relaxed security in proof systems 72 3.5.1. Honest-verifier ZK 72 3.5.2. Witness hiding/indistinguishability 73 3.5.3. ¿-Protocols 74 3.6. Non-black-box zero knowledge 75 3.7. Advanced notions 75 3.7.1. Publicly verifiable zero knowledge 76 3.7.2. Concurrent ZK and more 77 3.7.3. ZK with stateless players 78 3.7.4. Delayed-input proof systems 79 3.8. Conclusion 80 3.9. References 80 Chapter 4 Secure Multiparty Computation 85Yehuda LINDELL 4.1. Introduction 85 4.1.1. A note on terminology 87 4.2. Security of MPC 87 4.2.1. The definitional paradigm 87 4.2.2. Additional definitional parameters 89 4.2.3. Adversarial power 89 4.2.4. Modular sequential and concurrent composition 91 4.2.5. Important definitional implications 92 4.2.6. The ideal model and using MPC in practice 92 4.2.7. Any inputs are allowed 92 4.2.8. MPC secures the process, but not the output 92 4.3. Feasibility of MPC 93 4.4. Techniques 94 4.4.1. Shamir secret sharing 94 4.4.2. Honest-majority MPC with secret sharing 95 4.4.3. Private set intersection 97 4.4.4. Threshold cryptography 99 4.4.5. Dishonest-majority MPC 100 4.4.6. Efficient and practical MPC 100 4.5. MPC use cases 101 4.5.1. Boston wage gap (Lapets et al. 2018) 101 4.5.2. Advertising conversion (Ion et al. 2017) 101 4.5.3. MPC for cryptographic key protection (Unbound Security; Sepior; Curv) 101 4.5.4. Government collaboration (Sharemind) 102 4.5.5. Privacy-preserving analytics (Duality) 102 4.6. Discussion 102 4.7. References 103 Chapter 5 Pairing-Based Cryptography 107Olivier BLAZY 5.1. Introduction 108 5.1.1. Notations 108 5.1.2. Generalities 108 5.2. One small step for man, one giant leap for cryptography 109 5.2.1. Opening Pandora's box, demystifying the magic 110 5.2.2. A new world of assumptions 112 5.3. A new world of cryptographic protocols at your fingertips 116 5.3.1. Identity-based encryption made easy 117 5.3.2. Efficient deterministic compact signature 118 5.4. References 119 Chapter 6 Broadcast Encryption and Traitor Tracing 121Duong HIEU PHAN 6.1. Introduction 121 6.2. Security notions for broadcast encryption and TT 123 6.3. Overview of broadcast encryption and TT 125 6.4. Tree-based methods 129 6.5. Code-based TT 132 6.6. Algebraic schemes 135 6.7. Lattice-based approach with post-quantum security 142 6.8. References 143 Chapter 7 Attribute-Based Encryption 151Romain GAY 7.1. Introduction 151 7.2. Pairing groups 152 7.2.1. Cyclic groups 152 7.2.2. Pairing groups 152 7.3. Predicate encodings 153 7.3.1. Definition 153 7.3.2. Constructions 154 7.4. Attribute-based encryption 156 7.4.1. Definition 156 7.4.2. A modular construction 158 7.5. References 165 Chapter 8 Advanced Signatures 167Olivier SANDERS 8.1. Introduction 167 8.2. Some constructions 169 8.2.1. The case of scalar messages 169 8.2.2. The case of non-scalar messages 171 8.3. Applications 173 8.3.1. Anonymous credentials 173 8.3.2. Group signatures 176 8.3.3. Direct anonymous attestations 180 8.4. References 184 Chapter 9 Key Exchange 187Colin BOYD 9.1. Key exchange fundamentals 187 9.1.1. Key exchange parties 188 9.1.2. Key exchange messages 189 9.1.3. Key derivation functions 189 9.2. Unauthenticated key exchange 191 9.2.1. Formal definitions and security models 191 9.2.2. Constructions and examples 192 9.3. Authenticated key exchange 194 9.3.1. Non-interactive key exchange 195 9.3.2. AKE security models 196 9.3.3. Constructions and examples 200 9.4. Conclusion 206 9.5. References 207 Chapter 10 Password Authenticated Key Exchange: Protocols and Security Models 213Stanislaw JARECKI 10.1. Introduction 213 10.2. First PAKE: EKE 215 10.3. Game-based model of PAKE security 218 10.3.1. The BPR security model 218 10.3.2. Implicit versus explicit authentication 221 10.3.3. Limitations of the BPR model 221 10.3.4. EKE instantiated with Diffie-Hellman KE 223 10.3.5. Implementing ideal cipher on arbitrary groups 224 10.4. Simulation-based model of PAKE security 225 10.4.1. The BMP security model 225 10.4.2. Advantages of BMP definition: arbitrary passwords, tight security 229 10.4.3. EKE using RO-derived one-time pad encryption 230 10.4.4. BMP model for PAKE with explicit authentication (pake-ea) 231 10.5. Universally composable model of PAKE security 232 10.6. PAKE protocols in the standard model 236 10.7. PAKE efficiency optimizations 239 10.8. Asymmetric PAKE: PAKE for the client-server setting 242 10.9. Threshold PAKE 244 10.10. References 246 Chapter 11 Verifiable Computation and Succinct Arguments for NP 257Dario FIORE 11.1. Introduction 257 11.1.1. Background 258 11.2. Preliminaries 259 11.3. Verifiable computation 260 11.4. Constructing VC 261 11.4.1. VC for circuits in three steps 261 11.4.2. Succinct non-interactive arguments for non-deterministic computation 263 11.4.3. Verifiable computation from SNARG 264 11.5. A modular construction of SNARGs 264 11.5.1. Algebraic non-interactive linear proofs 265 11.5.2. Bilinear groups 267 11.5.3. SNARGs from algebraic NILPs with degree-2 verifiers using bilinear groups 269 11.6. Constructing algebraic NILPs for arithmetic circuits 271 11.6.1. Arithmetic circuits 271 11.6.2. Quadratic arithmetic programs 271 11.6.3. Algebraic NILP for QAPs 274 11.7. Conclusion 279 11.8. References 279 List of Authors 283 Index 285