Publikationen

Faust, Sebastian; Hazay, Carmit; Kretzler, David; Schlosser, Benjamin

Putting the Online Phase on a Diet: Covert Security from Short MACs Inproceedings

CT-RSA 2023, 2023.

Esser, Andre; Zweydinger, Floyd

New Time-Memory Trade-Offs for Subset Sum - Improving ISD in Theory and Practice Inproceedings

Eurocrypt 2023, 2023.

Frassetto, Tommaso; Jauernig, Patrick; Koisser, David; Kretzler, David; Schlosser, Benjamin; Faust, Sebastian; Sadeghi, Ahmad-Reza

POSE: Practical Off-chain Smart Contract Execution Inproceedings

NDSS 2023, 2023.

Kölbel, Tobias; Härdtner, Mahia-Cara; Weinhardt, Christof

Enterprise Business Models Leveraging Self-Sovereign Identity: Towards a User-Empowering Me2X Economy Inproceedings

Hawaii International Conference on System Sciences (HICSS), 2023.

Kölbel, Tobias ; Linkenheil, Marcel ; Weinhardt, Christof

Requirements and Design Principles for Blockchain-enabled Matchmaking-Marketplaces in Additive Manufacturing Inproceedings

Hawaii International Conference on System Sciences (HICSS), 2023.

Bellini, Emanuele; Chávez-Saab, Jorge; Chi-Domínguez, Jesús-Javier; Esser, Andre; Ionica, Sorina; Rivera-Zamarripa, Luis; Rodríguez-Henríquez, Francisco; Trimoska, Monika; Zweydinger, Floyd

Parallel Isogeny Path Finding with Limited Memory Inproceedings

Isobe, Takanori; Sarkar, Santanu (Ed.): Progress in Cryptology - {INDOCRYPT} 2022 - 23rd International Conference on Cryptology in India, Kolkata, India, December 11-14, 2022, Proceedings, pp. 294–316, Springer, 2022.

Sterk, Felix; Heinz, Daniel; Peukert, Christian; Fleuchaus, Felix; Kölbel, Tobias; Weinhardt, Christof

Fostering Value Co-Creation in Incumbent Firms: The Case of Bosch’s IoT Ecosystem Landscape Inproceedings

International Conference on Information Systems (ICIS) 2022, 2022.

Erwig, Andreas ; Riahi, Siavash

Deterministic Wallets for Adaptor Signatures Inproceedings

Atluri, Vijayalakshmi ; Di Pietro, Roberto ; Jensen, Christian D; Meng, Weizhi (Ed.): Computer Security - ESORICS 2022, pp. 487–506, Springer, 2022, ISBN: 978-3-031-17146-8.

Lichti, Constantin; Sandner, Philipp; Schaub, Benjamin

The Green Bitcoin - CO2 Compensation for the World’s Largest Cryptocurrency Miscellaneous

Medium.com, 2022.

May, Alexander; Zweydinger, Floyd

Legendre PRF (Multiple) Key Attacks and the Power of Preprocessing Inproceedings

35th IEEE Computer Security Foundations Symposium, pp. 11, IEEE, 2022.

Kölbel, Tobias; Lamberty, Ricky; Sterk, Felix; Weinhardt, Christof

Spotlight on DeFi Centerpieces Towards an Economic Perspective on Asset Tokenization Services Inproceedings

Pacific Asia Conference on Information Systems: PACIS 2022 Proceedings, 2022.

Richter, David ; Kretzler, David ; Weisenburger, Pascal ; Salvaneschi, Guido ; Faust, Sebastian ; Mezini, Mira

Prisma: A Tierless Language for Enforcing Contract-Client Protocols in Decentralized Applications (Extended Abstract) Inproceedings

36th European Conference on Object-Oriented Programming (ECOOP 2022), pp. 35:1–35:4, Schloss Dagstuhl -- Leibniz-Zentrum für Informatik, 2022, ISBN: 978-3-95977-225-9.

@inproceedings{richter_et_al:LIPIcs.ECOOP.2022.35,
title = {Prisma: A Tierless Language for Enforcing Contract-Client Protocols in Decentralized Applications (Extended Abstract)},
author = {Richter, David and Kretzler, David and Weisenburger, Pascal and Salvaneschi, Guido and Faust, Sebastian and Mezini, Mira},
url = {https://drops.dagstuhl.de/opus/volltexte/2022/16263/pdf/LIPIcs-ECOOP-2022-35.pdf},
doi = {10.4230/LIPIcs.ECOOP.2022.35},
isbn = {978-3-95977-225-9},
year = {2022},
date = {2022-06-23},
booktitle = {36th European Conference on Object-Oriented Programming (ECOOP 2022)},
pages = {35:1--35:4},
publisher = {Schloss Dagstuhl -- Leibniz-Zentrum für Informatik},
series = {Leibniz International Proceedings in Informatics (LIPIcs)},
abstract = {Decentralized applications (dApps) consist of smart contracts that run on blockchains and clients that model collaborating parties. dApps are used to model financial and legal business functionality. Today, contracts and clients are written as separate programs - in different programming languages - communicating via send and receive operations. This makes distributed program flow awkward to express and reason about, increasing the potential for mismatches in the client-contract interface, which can be exploited by malicious clients, potentially leading to huge financial losses. In this paper, we present Prisma, a language for tierless decentralized applications, where the contract and its clients are defined in one unit. Pairs of send and receive actions that "belong together" are encapsulated into a single direct-style operation, which is executed differently by sending and receiving parties. This enables expressing distributed program flow via standard control flow and renders mismatching communication impossible. We prove formally that our compiler preserves program behavior in presence of an attacker controlling the client code. We systematically compare Prisma with mainstream and advanced programming models for dApps and provide empirical evidence for its expressiveness and performance.
The design space of dApp programming and other multi-party languages depends on one major choice: a local model versus a global model. In a local model, parties are defined in separate programs and their interactions are encoded via send and receive effects. In a global language, parties are defined within one shared program and interactions are encoded via combined send-and-receive operations with no effects visible to the outside world. The global model is followed by tierless [Christian Queinnec, 2000; Cooper et al., 2007; Choi and Chang, 2019; Fowler et al., 2019; Serrano et al., 2006; Serrano and Prunet, 2016; Radanne et al., 2016; Weisenburger et al., 2018] and choreographic [Kohei Honda et al., 2011; Fabrizio Montesi et al., 2014; Saverio Giallorenzo et al., 2020] languages. However, known approaches to dApp programming follow the local model, thus rely on explicitly specifying the client-contract interaction protocol. Moreover, the contract and clients are implemented in different languages, hence, developers have to master two technology stacks. The dominating approach in industry is Solidity [Mix, 2019] for the contract and JavaScript for clients. Solidity relies on expressing the protocol using assertions in the contract code, which are checked at run time [Solidity documentation - common patterns, 2020]. Failing to insert the correct assertions may give parties illegal access to monetary values to the detriment of others [Nikolić et al., 2018; Luu et al., 2016]. In research, contract languages [Ankush Das et al., 2019; Michael J. Coblenz, 2017; Franklin Schrans et al., 2018; Franklin Schrans et al., 2019; Michael J. Coblenz et al., 2019; Michael J. Coblenz et al., 2019; Reed Oei et al., 2020; Sam Blackshear et al., 2019] have been proposed that rely on advanced type systems such as session types, type states, and linear types. The global model has not been explored for dApp programming. This is unfortunate given the potential to get by with a standard typing discipline and to avoid intricacies and potential mismatches of a two-language stack. Our work fills this gap by proposing Prisma - the first language that features a global programming model for Ethereum dApps. While we focus on the Ethereum blockchain, we believe our techniques to be applicable to other smart contract platforms. Prisma enables interleaving contract and client logic within the same program and adopts a direct style (DS) notation for encoding send-and-receive operations (with our awaitCl language construct) akin to languages with async/await [Gavin M. Bierman et al., 2012; Scala async rfc]. DS addresses shortcomings with the currently dominant encoding of the protocol’s finite state machines (FSM) [Mix, 2019; Michael J. Coblenz, 2017; Franklin Schrans et al., 2018; Franklin Schrans et al., 2019; Michael J. Coblenz et al., 2019; Michael J. Coblenz et al., 2019]. We argue writing FSM style corresponds to a control-flow graph of basic blocks, which is low-level and more suited to be written by a compiler than by a human. With FSM style, the contract is a passive entity whose execution is driven by clients. whereas the DS encoding allows the contract to actively ask clients for input, fitting dApp execution where a dominant contract controls execution and diverts control to other parties when their input is needed.
In the following Prisma snippet, the payout function is a function invoked by the contract when it is time to pay money to a client. In Prisma, variables, methods and classes are separated into two namespaces, one for the contract and one for the clients. The payout method is located on the contract via the annotation @co. The body of the method diverts the control to the client using awaitCl(...) { ... }, hence the contained readLine call is executed on the client. Note that no explicit send/receive operations are needed but the communication protocol is expressed through the program control flow. Only after the check client == toBePayed that the correct client replied, the current contact balance balance() is transferred to the client via transfer. @co def payout(toBePayed: Arr[Address]): Unit = {
awaitCl(client => client == toBePayed) {
readLine("Press enter for payout") }
toBePayed.transfer(balance())
}

Overall, Prisma relieves the developer from the responsibility of correctly managing distributed, asynchronous program flows and the heterogeneous technology stack. Instead, the burden is put on the compiler, which distributes the program flow by means of selective continuation-passing-style (CPS) translation and defunctionalisation and inserts guards against malicious client interactions.
We needed to develop a CPS translation for the code that runs on the Ethereum Virtual Machine (EVM) since the EVM has no built-in support for concurrency primitives which could be used for asynchronous communication. While CPS translations are well-known, we cannot use them out-of-the-box because the control flow is interwoven with distribution in our case. A CPS translation that does not take distribution into account would allow malicious clients to force the contract to deviate from the intended control flow by sending a spoofed continuation. Thus, it was imperative to prove correctness of our distributed CPS translation to ensure control-flow integrity of the contract. },
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}

Decentralized applications (dApps) consist of smart contracts that run on blockchains and clients that model collaborating parties. dApps are used to model financial and legal business functionality. Today, contracts and clients are written as separate programs - in different programming languages - communicating via send and receive operations. This makes distributed program flow awkward to express and reason about, increasing the potential for mismatches in the client-contract interface, which can be exploited by malicious clients, potentially leading to huge financial losses. In this paper, we present Prisma, a language for tierless decentralized applications, where the contract and its clients are defined in one unit. Pairs of send and receive actions that "belong together" are encapsulated into a single direct-style operation, which is executed differently by sending and receiving parties. This enables expressing distributed program flow via standard control flow and renders mismatching communication impossible. We prove formally that our compiler preserves program behavior in presence of an attacker controlling the client code. We systematically compare Prisma with mainstream and advanced programming models for dApps and provide empirical evidence for its expressiveness and performance.
The design space of dApp programming and other multi-party languages depends on one major choice: a local model versus a global model. In a local model, parties are defined in separate programs and their interactions are encoded via send and receive effects. In a global language, parties are defined within one shared program and interactions are encoded via combined send-and-receive operations with no effects visible to the outside world. The global model is followed by tierless [Christian Queinnec, 2000; Cooper et al., 2007; Choi and Chang, 2019; Fowler et al., 2019; Serrano et al., 2006; Serrano and Prunet, 2016; Radanne et al., 2016; Weisenburger et al., 2018] and choreographic [Kohei Honda et al., 2011; Fabrizio Montesi et al., 2014; Saverio Giallorenzo et al., 2020] languages. However, known approaches to dApp programming follow the local model, thus rely on explicitly specifying the client-contract interaction protocol. Moreover, the contract and clients are implemented in different languages, hence, developers have to master two technology stacks. The dominating approach in industry is Solidity [Mix, 2019] for the contract and JavaScript for clients. Solidity relies on expressing the protocol using assertions in the contract code, which are checked at run time [Solidity documentation - common patterns, 2020]. Failing to insert the correct assertions may give parties illegal access to monetary values to the detriment of others [Nikolić et al., 2018; Luu et al., 2016]. In research, contract languages [Ankush Das et al., 2019; Michael J. Coblenz, 2017; Franklin Schrans et al., 2018; Franklin Schrans et al., 2019; Michael J. Coblenz et al., 2019; Michael J. Coblenz et al., 2019; Reed Oei et al., 2020; Sam Blackshear et al., 2019] have been proposed that rely on advanced type systems such as session types, type states, and linear types. The global model has not been explored for dApp programming. This is unfortunate given the potential to get by with a standard typing discipline and to avoid intricacies and potential mismatches of a two-language stack. Our work fills this gap by proposing Prisma - the first language that features a global programming model for Ethereum dApps. While we focus on the Ethereum blockchain, we believe our techniques to be applicable to other smart contract platforms. Prisma enables interleaving contract and client logic within the same program and adopts a direct style (DS) notation for encoding send-and-receive operations (with our awaitCl language construct) akin to languages with async/await [Gavin M. Bierman et al., 2012; Scala async rfc]. DS addresses shortcomings with the currently dominant encoding of the protocol’s finite state machines (FSM) [Mix, 2019; Michael J. Coblenz, 2017; Franklin Schrans et al., 2018; Franklin Schrans et al., 2019; Michael J. Coblenz et al., 2019; Michael J. Coblenz et al., 2019]. We argue writing FSM style corresponds to a control-flow graph of basic blocks, which is low-level and more suited to be written by a compiler than by a human. With FSM style, the contract is a passive entity whose execution is driven by clients. whereas the DS encoding allows the contract to actively ask clients for input, fitting dApp execution where a dominant contract controls execution and diverts control to other parties when their input is needed.
In the following Prisma snippet, the payout function is a function invoked by the contract when it is time to pay money to a client. In Prisma, variables, methods and classes are separated into two namespaces, one for the contract and one for the clients. The payout method is located on the contract via the annotation @co. The body of the method diverts the control to the client using awaitCl(...) { ... }, hence the contained readLine call is executed on the client. Note that no explicit send/receive operations are needed but the communication protocol is expressed through the program control flow. Only after the check client == toBePayed that the correct client replied, the current contact balance balance() is transferred to the client via transfer. @co def payout(toBePayed: Arr[Address]): Unit = {
awaitCl(client => client == toBePayed) {
readLine("Press enter for payout") }
toBePayed.transfer(balance())
}

Overall, Prisma relieves the developer from the responsibility of correctly managing distributed, asynchronous program flows and the heterogeneous technology stack. Instead, the burden is put on the compiler, which distributes the program flow by means of selective continuation-passing-style (CPS) translation and defunctionalisation and inserts guards against malicious client interactions.
We needed to develop a CPS translation for the code that runs on the Ethereum Virtual Machine (EVM) since the EVM has no built-in support for concurrency primitives which could be used for asynchronous communication. While CPS translations are well-known, we cannot use them out-of-the-box because the control flow is interwoven with distribution in our case. A CPS translation that does not take distribution into account would allow malicious clients to force the contract to deviate from the intended control flow by sending a spoofed continuation. Thus, it was imperative to prove correctness of our distributed CPS translation to ensure control-flow integrity of the contract.

Das, Poulami; Eckey, Lisa; Faust, Sebastian; Loss, Julian; Maitra, Monosij

Round Efficient Byzantine Agreement from VDFs Miscellaneous

Cryptology ePrint Archive, Paper 2022/823, 2022.

Esser, Andre; Zweydinger, Floyd; May, Alexander

McEliece needs a Break -- Solving McEliece-1284 and Quasi-Cyclic-2918 with Modern ISD Inproceedings

Eurocrypt 2022 , IACR, 2022.

@inproceedings{Esser2022,
title = {McEliece needs a Break -- Solving McEliece-1284 and Quasi-Cyclic-2918 with Modern ISD },
author = {Andre Esser and Floyd Zweydinger and Alexander May },
url = {https://eprint.iacr.org/2021/1634},
year = {2022},
date = {2022-05-30},
booktitle = {Eurocrypt 2022 },
publisher = {IACR},
abstract = {With the recent shift to post-quantum algorithms it becomes increasingly important to provide precise bit-security estimates for code-based cryptography such as McEliece and quasi-cyclic schemes like BIKE and HQC. While there has been significant progress on information set decoding (ISD) algorithms within the last decade, it is still unclear to which extent this affects current cryptographic security estimates.

We provide the first concrete implementations for representation-based ISD, such as May-Meurer-Thomae (MMT) or Becker-Joux-May-Meurer (BJMM), that are parameter-optimized for the McEliece and quasi-cyclic setting. Although MMT and BJMM consume more memory than naive ISD algorithms like Prange, we demonstrate that these algorithms lead to significant speedups for practical cryptanalysis on medium-sized instances (around 60 bit). More concretely, we provide data for the record computations of McEliece-1223 and McEliece-1284 (old record: 1161), and for the quasi-cyclic setting up to code length 2918 (before: 1938).

Based on our record computations we extrapolate to the bit-security level of the proposed BIKE, HQC and McEliece parameters in NIST's standardization process.
For BIKE/HQC, we also show how to transfer the Decoding-One-Out-of-Many (DOOM) technique to MMT/BJMM. Although we achieve significant DOOM speedups, our estimates confirm the bit-security levels of BIKE and HQC.

For the proposed McEliece round-3 parameter sets of 192 and 256 bit, however, our extrapolation indicates a security level overestimate by roughly 20 and 10 bits, respectively, i.e., the high-security McEliece instantiations may be a bit less secure than desired.},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}

Richter, David ; Kretzler, David ; Weisenburger, Pascal ; Salvaneschi, Guido ; Faust, Sebastian ; Mezini, Mira

Prisma: A Tierless Language for Enforcing Contract-Client Protocols in Decentralized Applications (Extended Version) Miscellaneous

arXiv, 2022.

Kölbel, Tobias; Gawlitza, Tobias; Weinhardt, Christof

Shaping Governance in Self-Sovereign Identity Ecosystems: Towards a Cooperative Business Model Inproceedings

17th International Conference on Wirtschaftsinformatik: WI 2022 Proceedings, 2022.

Sandner, Philipp; Gross, Jonas

The digital euro from a geopolitical perspective: Will Europe lag behind? Technical Report

Frankfurt School Blockchain Center, Digital Euro Association 2022.

Kölbel, Tobias ; Dann, David ; Weinhardt, Christof

Giant or Dwarf? A Literature Review on Blockchain-enabled Marketplaces in Business Ecosystems Inproceedings

WI 2022 Proceedings: 17th International Conference on Wirtschaftsinformatik, 2022.

Meyer, Eva ; Welpe, Isabell M; Sandner, Philipp

Decentralized Finance - A Systematic Literature Review and Research Directions Inproceedings

ECIS 2022 Research Papers., SSRN, 2022.

Faust, Sebastian; Hazay, Carmit; Kretzler, David; Schlosser, Benjamin

Financially Backed Covert Security Inproceedings

Public-Key Cryptography - (PKC) 2022 - 25th {IACR} International Conference on Practice and Theory of Public Key Cryptography, Virtual Event, May 07-11, 2021, Proceedings, 2021.

Esser, Andre ; Kübler, Robert ; Zweydinger, Floyd

A Faster Algorithm for Finding Closest Pairs in Hamming Metric Inproceedings

Bojanczy, Mikolaj ; Chekuri, Chandra (Ed.): 41st IARCS Annual Conference on Foundations of Software Technology and Theoretical Computer Science (FSTTCS 2021), pp. 20:1–20:21, Schloss Dagstuhl -- Leibniz-Zentrum für Informatik, 2021, ISBN: 978-3-95977-215-0.

Sandner, Prof. Dr. Philipp; Lichti, Constantin; Richter, Robert; Heidt, Cedric; Schaub, Benjamin

Study: The Carbon Emissions of Bitcoin From an Investor Perspective Technical Report

Frankfurt School Blockchain Center, INTAS.tech 2021.

Das, Poulami; Erwig, Andreas; Faust, Sebastian; Loss, Julian; Riahi, Siavash

The Exact Security of BIP32 Wallets Inproceedings

CCS ’21- Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, ACM, 2021.

Döttling, Nico; Hartmann, Dominik; Hofheinz, Dennis; Kiltz, Eike; Schäge, Sven; Ursu, Bogdan

On the Impossibility of Purely Algebraic Signatures Inproceedings

Theory of Cryptography (TCC 2021), Springer International Publishing, 2021.

@inproceedings{Döttling2021,
title = {On the Impossibility of Purely Algebraic Signatures},
author = {Nico Döttling and Dominik Hartmann and Dennis Hofheinz and Eike Kiltz and Sven Schäge and Bogdan Ursu},
url = {https://eprint.iacr.org/2021/738},
year = {2021},
date = {2021-11-08},
booktitle = {Theory of Cryptography (TCC 2021)},
publisher = {Springer International Publishing},
abstract = {The existence of one-way functions implies secure digital signatures, but not public-key encryption (at least in a black-box setting). Somewhat surprisingly, though, efficient public-key encryption schemes appear to be much easier to construct from concrete algebraic assumptions (such as the factoring of Diffie-Hellman-like assumptions) than efficient digital signature schemes. In this work, we provide one reason for this apparent difficulty to construct efficient signature schemes.

Specifically, we prove that a wide range of algebraic signature schemes (in which verification essentially checks a number of linear equations over a group) fall to conceptually surprisingly simple linear algebra attacks. In fact, we prove that in an algebraic signature scheme, sufficiently many signatures can be linearly combined to a signature of a fresh message. We present attacks both in known-order and hidden-order groups (although in hidden-order settings, we have to restrict our definition of algebraic signatures a little). More explicitly, we show: - the insecurity of all signature schemes in Maurer's generic group model (in pairing-free groups), as long as the signature schemes do not rely on other cryptographic assumptions, such as hash functions. - the insecurity of a natural class of signatures in hidden-order groups, where verification consists of linear equations over group elements.

We believe that this highlights the crucial role of public verifiability in digital signature schemes. Namely, while public-key encryption schemes do not require any publicly verifiable structure on ciphertexts, it is exactly this structure on signatures that invites attacks like ours and makes it hard to construct efficient signatures. },
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}

Abera, Tigist ; Brasser, Ferdinand ; Gunn, Lachlan ; Jauernig, Patrick ; Koisser, David ; Sadeghi, Ahmad-Reza

GrandDetAuto: Detecting Malicious Nodes in Large-Scale Autonomous Networks Inproceedings

24th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2021), 2021.

Forster, Maximilian; Gross, Jonas; Kamping, Anja Kristina; Katilmis, Serkan; Reichel, Dr. Mario; Sandner, Prof. Dr. Philipp; Schröder, Philipp

The future of payments: Programmable payments for the Internet-of-Things (IoT) Technical Report

CashOnLedger Technologies GmbH, Digital Euro Association, Frankfurt School Blockchain Center, PPI AG 2021.

Giallorenzo, Saverio ; Montesi, Fabrizio ; Peressotti, Marco ; Richter, David ; Salvaneschi, Guido ; Weisenburger, Pascal

Multiparty Languages: The Choreographic and Multitier Cases (Pearl) Inproceedings

Moller, Anders ; Sridharan, Manu (Ed.): 35th European Conference on Object-Oriented Programming (ECOOP 2021), pp. 22:1–22:27, Schloss Dagstuhl -- Leibniz-Zentrum für Informatik, Dagstuhl, Germany, 2021, ISBN: 978-3-95977-190-0, (Distinguished Paper Award).

Amler, Hendrik; Eckey, Lisa; Faust, Sebastian; Kaiser, Marcel; Sandner, Philipp; Schlosser, Benjamin

DeFi-ning DeFi: Challenges & Pathway Miscellaneous

arXiv eprint report arXiv:2101.05589, 2021.

Erwig, Andreas; Faust, Sebastian; Hostáková, Kristina; Maitra, Monosij; Riahi, Siavash

Two-Party Adaptor Signatures From Identification Schemes Miscellaneous

Cryptology ePrint Archive, Report 2021/150, 2021.

@misc{cryptoeprint:2021:150,
title = {Two-Party Adaptor Signatures From Identification Schemes},
author = {Andreas Erwig and Sebastian Faust and Kristina Hostáková and Monosij Maitra and Siavash Riahi},
url = {https://eprint.iacr.org/2021/150},
year = {2021},
date = {2021-01-01},
abstract = {Adaptor signatures are a novel cryptographic primitive with important applications for cryptocurrencies. They have been used to construct second layer solutions such as payment channels or cross-currency swaps. The basic idea of an adaptor signature scheme is to tie the signing process to the revelation of a secret value in the sense that, much like a regular signature scheme, an adaptor signature scheme can authenticate messages, but simultaneously leaks a secret to certain parties. Recently, Aumayr et al. provide the first formalization of adaptor signature schemes, and present provably secure constructions from ECDSA and Schnorr signatures. Unfortunately, the formalization and constructions given in this work have two limitations: (1) current schemes are limited to ECDSA and Schnorr signatures, and no
generic transformation for constructing adaptor signatures is known; (2) they do not offer support for aggregated two-party signing, which can significantly reduce the blockchain footprint in applications of adaptor signatures.
In this work, we address these two shortcomings. First, we show that signature schemes that are constructed from identification (ID) schemes, which additionally satisfy certain homomorphic properties, can generically be transformed into adaptor signature schemes. We further provide an impossibility result which proves that unique signature schemes (e.g., the BLS scheme) cannot be transformed into an adaptor signature scheme. In addition, we define two-party adaptor signature schemes with aggregatable public keys and show how to instantiate them via a generic transformation from ID-based signature schemes. Finally, we give instantiations of our generic transformations for the Schnorr, Katz-Wang and Guillou-Quisquater signature schemes.},
howpublished = {Cryptology ePrint Archive, Report 2021/150},
keywords = {},
pubstate = {published},
tppubtype = {misc}
}

Faust, Sebastian; Hazay, Carmit; Kretzler, David; Schlosser, Benjamin

Generic Compiler for Publicly Verifiable Covert Multi-Party Computation Inproceedings

Advances in Cryptology - EUROCRYPT 2021 - 40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, October 17-21, 2021, Proceedings, Part II, pp. 782–811, Springer, 2021.

iBlockchain Konsortium,

iBlockchain Policy Paper: Empfehlungen und Erkenntnisse für die Politik Miscellaneous

medium.com, 2020.

Hebborn, Phil; Lambin, Baptiste; Leander, Gregor; Todo, Yosuke

Lower Bounds on the Degree of Block Ciphers Inproceedings

Advances in Cryptology - ASIACRYPT 2020 - 26th International Conference on the Theory and Application of Cryptology and Information Security, 2020.

Erwig, Andreas; Faust, Sebastian; Riahi, Siavash; Stöckert, Tobias

CommiTEE: An Efficient and Secure Commit-Chain Protocol using TEEs Miscellaneous

Cryptology ePrint Archive, Report 2020/1486, 2020.

@misc{cryptoeprint:2020:1486,
title = {CommiTEE: An Efficient and Secure Commit-Chain Protocol using TEEs},
author = {Andreas Erwig and Sebastian Faust and Siavash Riahi and Tobias Stöckert},
url = {https://eprint.iacr.org/2020/1486},
year = {2020},
date = {2020-11-27},
abstract = {Permissionless blockchain systems such as Bitcoin or Ethereum are slow and expensive, since transactions are processed in a distributed network by a large set of parties. To improve on these shortcomings, a prominent approach is given by so-called 2nd-layer protocols. In these protocols parties process transactions off-chain directly between each other, thereby drastically reducing the costly and slow interaction with the blockchain. In particular, in the optimistic case, when parties behave honestly, no interaction with the blockchain is needed. One of the most popular off-chain solutions are Plasma protocols (often also called commit-chains). These protocols are orchestrated by a so-called operator that maintains the system and processes transactions between parties. Importantly, the operator is trustless, i.e., even if it is malicious users of the system are guaranteed to not lose funds. To achieve this guarantee, Plasma protocols are highly complex and require involved and expensive dispute resolution processes. This has significantly slowed down development and deployment of these systems.

In this work we propose CommiTEE-- a simple and efficient Plasma system leveraging the power of trusted execution environments (TEE). Besides its simplicity, our protocol requires minimal interaction with the blockchain, thereby drastically reducing costs and improving efficiency. An additional benefit of our solution is that it allows for switching between operators, in case the main operator goes offline due to system failure, or behaving maliciously. We implemented and evaluated our system over Ethereum and show that it is at least 2
times (and in some cases more than 16 times) cheaper in terms of communication complexity when compared to existing Plasma implementations. Moreover, for protocols using zero-knowledge proofs (like NOCUST-ZKP), CommiTEE decreases the on-chain gas cost by a factor ≈19 compared to prior solution. },
howpublished = {Cryptology ePrint Archive, Report 2020/1486},
keywords = {},
pubstate = {published},
tppubtype = {misc}
}

Alkadri, Nabil Alkeilani; Das, Poulami; Erwig, Andreas; Faust, Sebastian; Krämer, Juliane; Riahi, Siavash; Struck, Patrick

Deterministic Wallets in a Quantum World Inproceedings

CCS ’20- Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, ACM, 2020.

Lohr, Matthias; Schlosser, Benjamin; Jürjens, Jan; Staab, Steffen

Cost Fairness for Blockchain-Based Two-Party Exchange Protocols Inproceedings

IEEE International Conference on Blockchain, Blockchain 2020, 2020.

Eckey, Lisa; Faust, Sebastian; Schlosser, Benjamin

OptiSwap: Fast Optimistic Fair Exchange Inproceedings

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, pp. 543–557, ACM, New York, NY, USA, 2020, ISBN: 9781450367509.

Böhme, Rainer ; Eckey, Lisa ; Moore, Tyler ; Narula, Neha ; Ruffing, Tim ; Zohar, Aviv

Responsible Vulnerability Disclosure in Cryptocurrencies Journal Article

Commun. ACM, 63 (10), pp. 62–71, 2020, ISSN: 0001-0782.

Neureither, Jens; Dmitrienko, Alexandra; Koisser, David; Brasser, Ferdinand; Sadeghi, Ahmad-Reza

LegIoT: Ledgered Trust Management Platform for IoT Inproceedings

European Symposium on Research in Computer Security (ESORICS), 2020.

@inproceedings{neureither2020legiot,
title = {LegIoT: Ledgered Trust Management Platform for IoT},
author = {Jens Neureither and Alexandra Dmitrienko and David Koisser and Ferdinand Brasser and Ahmad-Reza Sadeghi },
url = {https://se.informatik.uni-wuerzburg.de/secure-software-systems-group/staff0/alexandra-dmitrienko/?tx_extbibsonomycsl_publicationlist%5BuserName%5D=sssgroup&tx_extbibsonomycsl_publicationlist%5BintraHash%5D=74fa5167627be7d794d5ddd457ba1bbb&tx_extbibsonomycsl_publicationlist%5BfileName%5D=LegIoT_camera_ready-v4.pdf&tx_extbibsonomycsl_publicationlist%5Baction%5D=download&tx_extbibsonomycsl_publicationlist%5Bcontroller%5D=Document&cHash=d3e5fdff7d78ca4cb3b00d4bb92b70ee},
year = {2020},
date = {2020-09-14},
booktitle = {European Symposium on Research in Computer Security (ESORICS)},
abstract = {We investigate and address the currently unsolved problem of trust establishment in large-scale Internet of Things (IoT) networks where heterogeneous devices and mutually mistrusting stakeholders are involved. We design, prototype and evaluate LegIoT, a novel, probabilistic trust management system that enables secure, dynamic and flexible(yet inexpensive) trust relationships in large IoT networks. The core component of LegIoT is a novel graph-based scheme that allows network devices (graph nodes) to re-use the already existing trust associations(graph edges) very efficiently; thus, significantly reducing the number of individually conducted trust assessments. Since no central trusted third party exists, LegIoT leverages Distributed Ledger
Technology(DLT) to create and manage the trust relation graph in a decentralized manner.The trust assessment among devices can be instantiated by any appropriate assessment technique, for which we focus on remote attestation(integrity verification) in this paper. We prototyped LegIoT for Hyper-ledger Sawtooth and demonstrated through evaluation that the number of trust assessments in the network can be significantly reduced – e.g.,by a factor of 20 for a network of 400 nodes and factor 5 for 1000 nodes.},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}

Beyne, Tim; Canteaut, Anne; Dinur, Itai; Eichlseder, Maria; Leander, Gregor; Leurent, Gaëtan; Naya-Plasencia, María; Perrin, Léo; Sasaki, Yu; Todo, Yosuke; Wiemer, Friedrich

Out of Oddity - New Cryptanalytic Techniques against Symmetric Primitives Optimized for Integrity Proof Systems Inproceedings

Advances in Cryptology - CRYPTO 2020 - 40th Annual International Cryptology Conference, 2020.

Couteau, Geoffroy ; Hartmann, Dominik

Shorter Non-interactive Zero-Knowledge Arguments and ZAPs for Algebraic Languages Inproceedings

Micciancio, Daniele ; Ristenpart, Thomas (Ed.): Advances in Cryptology -- CRYPTO 2020, pp. 768–798, Springer International Publishing, 2020, ISBN: 978-3-030-56877-1.

@inproceedings{Couteau2020,
title = {Shorter Non-interactive Zero-Knowledge Arguments and ZAPs for Algebraic Languages},
author = {Couteau, Geoffroy and Hartmann, Dominik},
editor = {Micciancio, Daniele and Ristenpart, Thomas},
url = {https://link.springer.com/chapter/10.1007/978-3-030-56877-1_27},
isbn = {978-3-030-56877-1},
year = {2020},
date = {2020-08-10},
booktitle = {Advances in Cryptology -- CRYPTO 2020},
pages = {768--798},
publisher = {Springer International Publishing},
abstract = {We put forth a new framework for building pairing-based non-interactive zero-knowledge (NIZK) arguments for a wide class of algebraic languages, which are an extension of linear languages, containing disjunctions of linear languages and more. Our approach differs from the Groth-Sahai methodology, in that we rely on pairings to compile a Σ-protocol into a NIZK. Our framework enjoys a number of interesting features:

conceptual simplicity, parameters derive from the Σ

-protocol;

proofs as short as resulting from the Fiat-Shamir heuristic applied to the underlying Σ

-protocol;

fully adaptive soundness and perfect zero-knowledge in the common random string model with a single random group element as CRS;

yields simple and efficient two-round, public coin, publicly-verifiable perfect witness-indistinguishable (WI) arguments(ZAPs) in the plain model. To our knowledge, this is the first construction of two-rounds statistical witness-indistinguishable arguments from pairing assumptions.

Our proof system relies on a new (static, falsifiable) assumption over pairing groups which generalizes the standard kernel Diffie-Hellman assumption in a natural way and holds in the generic group model (GGM) and in the algebraic group model (AGM).

Replacing Groth-Sahai NIZKs
with our new proof system allows to improve several important cryptographic primitives. In particular, we obtain the shortest tightly-secure structure-preserving signature scheme (which are a core component in anonymous credentials), the shortest tightly-secure quasi-adaptive NIZK with unbounded simulation soundness (which in turns implies the shortest tightly-mCCA-secure cryptosystem), and shorter ring signatures.},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}

Frank, Joel; Aschermann, Cornelius; Holz, Thorsten

ETHBMC: A Bounded Model Checker for Smart Contracts Inproceedings

29th USENIX Security Symposium (USENIX Security 20), USENIX Association, Boston, MA, 2020.

@inproceedings{251546,
title = {ETHBMC: A Bounded Model Checker for Smart Contracts},
author = {Joel Frank and Cornelius Aschermann and Thorsten Holz},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/frank},
year = {2020},
date = {2020-08-01},
booktitle = {29th USENIX Security Symposium (USENIX Security 20)},
publisher = {USENIX Association},
address = {Boston, MA},
abstract = {The introduction ofsmart contractshas significantly advancedthe state-of-the-art in cryptocurrencies. Smart contracts areprograms who live on the blockchain, governing the flow ofmoney. However, the promise of monetary gain has attractedmiscreants, resulting in spectacular hacks which resulted inthe loss of millions worth of currency. In response, severalpowerful static analysis tools were developed to address theseproblems. We surveyed eight recently proposed static analyzers for Ethereum smart contracts and found that none ofthem captures all relevant features of the Ethereum ecosystem.For example, we discovered that a precise memory model ismissing and inter-contract analysis is only partially supported. Based on these insights, we present the design and implementation of ETHBMC, a bounded model checker basedon symbolic execution which provides a precise model ofthe Ethereum network. We demonstrate its capabilities in aseries of experiments. First, we compare against the eightaforementioned tools, showing that even relatively simple toyexamples can obstruct other analyzers. Further proving thatprecise modeling is indispensable, we leverage ETHBMC ca-pabilities for automatic vulnerability scanning.We perform alarge-scale analysis of roughly 2.2 million accounts currentlyactive on the blockchain and automatically generate 5,905 valid inputs which trigger a vulnerability. From these, 1,989 can destroy a contract at will (so calledsuicidal contracts) and the rest can be used by an adversary to arbitrarily extractmoney. Finally, we compare our large-scale analysis againsttwo previous analysis runs, finding significantly more inputs (22.8%) than previous approaches.},
keywords = {},
pubstate = {published},
tppubtype = {inproceedings}
}

Ricky Lamberty, Alexander Poddey

Regulation conform DLT-operable payment adapter based on trustless - justified trust combined generalized state channels Miscellaneous

arXiv, Nr. 2007.01605, 2020.

@misc{arXiv:2007.01605,
title = {Regulation conform DLT-operable payment adapter based on trustless - justified trust combined generalized state channels},
author = {Ricky Lamberty, Alexander Poddey},
url = {https://arxiv.org/pdf/2007.01605
https://arxiv.org/abs/2007.01605},
year = {2020},
date = {2020-07-03},
abstract = {Open technologies, decentralized computation and intelligent applications enable the third-generation web, Web 3.0, thereby digitizing whole industries. The emerging Economy of Things (EoT) will be based on software agents running on peer-to-peer trustless networks that require a programmable, regulation conform means of payment. We give an overview of current solutions that differ in their fundamental values and technological possibilities, like e.g. private-issued stablecoins, DLT-issued electronic money and genuine cryptocurrencies. Based on this analysis, we present the concept of justified trust and propose to combine the strengths of the crypto based, decentralized trustless elements with established and well regulated means of payment, based on this concept, via a secure external re-balancing interface.
Combining the advantages, e.g. lightweight, trustless, efficient high frequency micro state transfers on the one hand, and ease of use, widely spread, accepted alignment to a multitude of regulative requirements, on the other hand, while neither leading into a lock-in in any of the proposed solutions, nor undermining the basic principles of the crypto-movement or unnecessarily reinforcing the banking system provides a synergy and the necessary flexibility for further evolution alongside the regulative framework. This offers a regulation conform transitional solution that can be implemented in the short term, which enables companies to place their decentralized business operations in a regulated environment.
The contribution of our work is twofold: First, we illustrate and discuss different DLT-operable means of payment. Second, our research proposes a novel hybrid payment solution by interfacing trustless with justified trust combined generalized state channels.},
howpublished = {arXiv, Nr. 2007.01605},
keywords = {},
pubstate = {published},
tppubtype = {misc}
}

Aumayr, Lukas; Ersoy, Oguzhan; Erwig, Andreas; Faust, Sebastian; Hostáková, Kristina; Maffei, Matteo; Moreno-Sanchez, Pedro; Riahi, Siavash

Bitcoin-Compatible Virtual Channels Miscellaneous

Cryptology ePrint Archive, Report 2020/554, 2020.

@misc{cryptoeprint:2020:554,
title = {Bitcoin-Compatible Virtual Channels},
author = {Lukas Aumayr and Oguzhan Ersoy and Andreas Erwig and Sebastian Faust and Kristina Hostáková and Matteo Maffei and Pedro Moreno-Sanchez and Siavash Riahi},
url = {https://eprint.iacr.org/2020/554},
year = {2020},
date = {2020-05-12},
abstract = {Current permissionless cryptocurrencies such as Bitcoin suffer from a limited transaction rate and slow confirmation time, which hinders their large scale adoption. Payment channels are one of the most promising solutions to address these problems, as they allow two end-points of the channel to perform arbitrarily many payments in a peer-to-peer fashion while uploading only two transactions on the blockchain. This concept has been generalized into payment-channel networks where a path of payment channels is used to settle the payment between two users that might not share a channel between them. However, this approach requires the active involvement of each user in the path, making the system less reliable (they might be offline), more expensive (they charge fees per payment) and slower (intermediaries need to be actively involved in the payment). To mitigate this issue, recent work has introduced the concept of virtual channels, which involve intermediaries only in the initial creation of a bridge between payer and payee, who can later on independently perform arbitrarily many off-chain transactions. Unfortunately, existing constructions are only available for Ethereum, as they rely on its account model and Turing-complete scripting language. The realization of virtual channels in other blockchain technologies with limited scripting capabilities, like Bitcoin, was considered so far an open challenge.

In this work, we present the first virtual channel protocols that are built on the UTXO-model and require a script language supporting only a digital signature scheme and a timelock functionality, being thus backwards compatible with virtually every cryptocurrency, including Bitcoin. We formalize the security properties of virtual channels as an ideal functionality in the Universal Composability framework, and prove that our protocol constitutes a secure realization thereof. We have prototyped and evaluated our protocol on the Bitcoin blockchain, demonstrating its efficiency: for n
sequential payments, they require an off-chain exchange of 11+2⋅(n−1) transactions or a total of 4219+695⋅(n−1) bytes, with no on-chain footprint in the optimistic case. },
howpublished = {Cryptology ePrint Archive, Report 2020/554},
keywords = {},
pubstate = {published},
tppubtype = {misc}
}

Current permissionless cryptocurrencies such as Bitcoin suffer from a limited transaction rate and slow confirmation time, which hinders their large scale adoption. Payment channels are one of the most promising solutions to address these problems, as they allow two end-points of the channel to perform arbitrarily many payments in a peer-to-peer fashion while uploading only two transactions on the blockchain. This concept has been generalized into payment-channel networks where a path of payment channels is used to settle the payment between two users that might not share a channel between them. However, this approach requires the active involvement of each user in the path, making the system less reliable (they might be offline), more expensive (they charge fees per payment) and slower (intermediaries need to be actively involved in the payment). To mitigate this issue, recent work has introduced the concept of virtual channels, which involve intermediaries only in the initial creation of a bridge between payer and payee, who can later on independently perform arbitrarily many off-chain transactions. Unfortunately, existing constructions are only available for Ethereum, as they rely on its account model and Turing-complete scripting language. The realization of virtual channels in other blockchain technologies with limited scripting capabilities, like Bitcoin, was considered so far an open challenge.

In this work, we present the first virtual channel protocols that are built on the UTXO-model and require a script language supporting only a digital signature scheme and a timelock functionality, being thus backwards compatible with virtually every cryptocurrency, including Bitcoin. We formalize the security properties of virtual channels as an ideal functionality in the Universal Composability framework, and prove that our protocol constitutes a secure realization thereof. We have prototyped and evaluated our protocol on the Bitcoin blockchain, demonstrating its efficiency: for n
sequential payments, they require an off-chain exchange of 11+2⋅(n−1) transactions or a total of 4219+695⋅(n−1) bytes, with no on-chain footprint in the optimistic case.

Tobias Kölbel, Daniel Kunz

Mechanisms of intermediary platforms Miscellaneous

arXiv, Nr. 2005.02111, 2020.

Aumayr, Lukas; Ersoy, Oguzhan; Erwig, Andreas; Faust, Sebastian; Hostakova, Kristina; Maffei, Matteo; Moreno-Sanchez, Pedro; Riahi, Siavash

Generalized Bitcoin-Compatible Channels Miscellaneous

Cryptology ePrint Archive, Report 2020/476, 2020.

Erwig, Andreas; Hesse, Julia; Orlt, Maximilian; Riahi, Siavash

Fuzzy Asymmetric Password-Authenticated Key Exchange Inproceedings

Moriai, Shiho; Wang, Huaxiong (Ed.): Advances in Cryptology - ASIACRYPT 2020 - 26th International Conference on the Theory and Application of Cryptology and Information Security, Daejeon, South Korea, December 7-11, 2020, Proceedings, Part II, pp. 761–784, Springer, 2020.