Search

The BUFF transform is a generic transformation for digital signature schemes, with the purpose of obtaining additional security properties beyond standard unforgeability, e.g., exclusive ownership and non-resignability. In the call for additional post-quantum signatures, these were explicitly mentioned by the NIST as “additional desirable security properties”, and some of the submissions indeed refer to the BUFF transform with the purpose of achieving them, while some other submissions follow the design of the BUFF transform without mentioning it explicitly. In this work, we show the following negative results regarding the non-resignability property in general, and the BUFF transform in particular. In the plain model, we observe by means of a simple attack that any signature scheme for which the message has a high entropy given the signature does not satisfy the non-resignability property (while non-resignability is trivially not satisfied if the message can be efficiently computed from its signature). Given that the BUFF transform has high entropy in the message given the signature, it follows that the BUFF transform does not achieve non-resignability whenever the random oracle is instantiated with a hash function, no matter what hash function. When considering the random oracle model (ROM), the matter becomes slightly more delicate since prior works did not rigorously define the non-resignability property in the ROM. For the natural extension of the definition to the ROM, we observe that our impossibility result still holds, despite there having been positive claims about the non-resignability of the BUFF transform in the ROM. Indeed, prior claims of the non-resignability of the BUFF transform rely on faulty argumentation. On the positive side, we prove that a salted version of the BUFF transform satisfies a slightly weaker variant of non-resignability in the ROM, covering both classical and quantum attacks, if the entropy requirement in the (weakened) definition

Contains fulltext : 295958.pdf (Publisher’s version ) (Open Access), PURPOSE: There is an unmet need for therapeutic options that prolong survival for patients with heavily pretreated, metastatic castration-resistant prostate cancer (mCRPC). The phase III, open-label KEYLYNK-010 study evaluated pembrolizumab plus olaparib versus a next-generation hormonal agent (NHA) for biomarker-unselected, previously treated mCRPC. METHODS: Eligible participants had mCRPC that progressed on or after abiraterone or enzalutamide (but not both) and docetaxel. Participants were randomly assigned (2:1) to pembrolizumab plus olaparib or NHA (abiraterone or enzalutamide). The dual primary end points were radiographic progression-free survival (rPFS) by blinded independent central review per Prostate Cancer Working Group-modified RECIST 1.1 and overall survival (OS). Time to first subsequent therapy (TFST) was a key secondary end point. Safety and objective response rate (ORR) were secondary end points. RESULTS: Between May 30, 2019, and July 16, 2021, 529 participants were randomly assigned to pembrolizumab plus olaparib and 264 to NHA. At final rPFS analysis, median rPFS was 4.4 months (95% CI, 4.2 to 6.0) with pembrolizumab plus olaparib and 4.2 months (95% CI, 4.0 to 6.1) with NHA (hazard ratio [HR], 1.02 [95% CI, 0.82 to 1.25]; P = .55). At final OS analysis, median OS was 15.8 months (95% CI, 14.6 to 17.0) and 14.6 months (95% CI, 12.6 to 17.3), respectively (HR, 0.94 [95% CI, 0.77 to 1.14]; P = .26). At final TFST analysis, median TFST was 7.2 months (95% CI, 6.7 to 8.1) versus 5.7 months (95% CI, 5.0 to 7.1), respectively (HR, 0.86 [95% CI, 0.71 to 1.03]). ORR was higher with pembrolizumab plus olaparib versus NHA (16.8% v 5.9%). Grade ≥3 treatment-related adverse events occurred in 34.6% and 9.0% of participants, respectively. CONCLUSION: Pembrolizumab plus olaparib did not significantly improve rPFS or OS versus NHA in participants with biomarker-unselected, heavily pretreated mCRPC. The study was stopped for futility. No new safety signals occu

The BUFF transform is a generic transformation for digital signature schemes, with the purpose of obtaining additional security properties beyond standard unforgeability, e.g., exclusive ownership and non-resignability. In the call for additional post-quantum signatures, these were explicitly mentioned by the NIST as ``additional desirable security properties'', and some of the submissions indeed refer to the BUFF transform with the purpose of achieving them, while some other submissions follow the design of the BUFF transform without mentioning it explicitly. In this work, we show the following negative results regarding the non-resignability property in general, and the BUFF transform in particular. In the plain model, we observe by means of a simple attack that any signature scheme for which the message has a high entropy given the signature does not satisfy the non-resignability property (while non-resignability is trivially not satisfied if the message can be efficiently computed from its signature). Given that the BUFF transform has high entropy in the message given the signature, it follows that the BUFF transform does not achieve non-resignability whenever the random oracle is instantiated with a hash function, no matter what hash function. When considering the random oracle model (ROM), the matter becomes slightly more delicate since prior works did not rigorously define the non-resignability property in the ROM. For the natural extension of the definition to the ROM, we observe that our impossibility result still holds, despite there having been positive claims about the non-resignability of the BUFF transform in the ROM. Indeed, prior claims of the non-resignability of the BUFF transform rely on faulty argumentation. On the positive side, we prove that a salted version of the BUFF transform satisfies a slightly weaker variant of non-resignability in the ROM, covering both classical and quantum attacks, if the entropy requirement in the (weakened) definiti

In this paper, we prove the quantum security of the signature scheme HAWK, proposed by Ducas, Postlethwaite, Pulles and van Woerden (ASIACRYPT 2022). More precisely, we reduce its strong unforgeability in the quantum random oracle model (QROM) to the hardness of the one-more SVP problem, which is the computational problem on which also the classical security analysis of HAWK relies. Our security proof deals with the quantum aspects in a rather black-box way, making it accessible also to non-quantum-experts.

We extend and consolidate the security justification for the Dilithium signature scheme. In particular, we identify a subtle but crucial gap that appears in several ROM and QROM security proofs for signature schemes that are based on the Fiat-Shamir with aborts paradigm, including Dilithium. The gap lies in the CMA-to-NMA reduction and was uncovered when trying to formalize a variant of the QROM security proof by Kiltz, Lyubashevsky, and Schaffner (Eurocrypt 2018). The gap was confirmed by the authors, and there seems to be no simple patch for it. We provide new, fixed proofs for the affected CMA-to-NMA reduction, both for the ROM and the QROM, and we perform a concrete security analysis for the case of Dilithium to show that the claimed security level is still valid after addressing the gap. Furthermore, we offer a fully mechanized ROM proof for the CMA-security of Dilithium in the EasyCrypt proof assistant. Our formalization includes several new tools and techniques of independent interest for future formal verification results.