Hailun Yan | EPFL Graph Search

I entered Shandong University in 2010 with a major in Mathematics. I received my B.Sc. in Information Security in 2014. I subsequently became a Ph.D. student at Shanghai Jiao Tong University, working in the Cryptography and Information Security (CIS) Lab under supervision of Prof. Xuejia Lai. I received my Ph.D. in Computer Science and Technology in 2019.

I am currently working as a Post Doctoral Researcher in the Security and Cryptography Laboratory (LASEC) of EPFL since November 2019.

Optimal Symmetric Ratcheting for Secure Communication

Andrea Felice Caforio, Daniel Patrick Collins, Serge Vaudenay, Hailun Yan

To mitigate state exposure threats to long-lived instant messaging sessions, ratcheting was introduced, which is used in practice in protocols like Signal. However, existing ratcheting protocols generally come with a high cost. Recently, Caforio et al. proposed pragmatic constructions, which compose a weakly secure 'light' protocol and a strongly secure 'heavy' protocol, in order to achieve so-called ratcheting on-demand. The light protocol they proposed has still a high complexity. In this paper, we propose the lightest possible protocol we could imagine, which essentially encrypts and then hashes the secret key. We prove it secure in the standard model by introducing a new security notion, which relates symmetric encryption with key updates by hashing. Our protocol composes well with the generic transformation techniques by Caforio et al. to offer high security and performance at the same time. In a second step, we propose another protocol based on a newly defined integrated primitive, extending standard one-time authenticated encryption with an additional output block used as a secret key for the next message. We instantiate this primitive firstly from any authenticated encryption with associated data, and then we propose an efficient instantiation using advanced encryption standard (AES) encryption to update the key and AES-Galois/Counter mode of operation to encrypt and decrypt messages.

OXFORD UNIV PRESS2022

Symmetric Asynchronous Ratcheted Communication with Associated Data

Serge Vaudenay, Hailun Yan

Following up mass surveillance and privacy issues, modern secure communication protocols now seek strong security, such as forward secrecy and post-compromise security, in the face of state exposures. To address this problem, ratcheting was thereby introduced, widely used in real-world messaging protocols like Signal. However, ratcheting comes with a high cost. Recently, Caforio et al. proposed pragmatic constructions which compose a weakly secure “light” protocol and a strongly secure “heavy” protocol, in order to achieve the so-called ratcheting on demand. The light protocol they proposed has still a high complexity. In this paper, we prove the security of the lightest possible protocol we could imagine, which essentially encrypts then hashes the secret key. We prove it without any random oracle by introducing a new security notion in the standard model. Our protocol composes well with the generic transformation techniques by Caforio et al. to offer high security and performance at the same time.

Springer, Cham2020

Tweaking Key-Alternating Feistel Block Ciphers

Lei Wang, Hailun Yan

Tweakable block cipher as a cryptographic primitive has found wide applications in disk encryption, authenticated encryption mode and message authentication code, etc. One popular approach of designing tweakable block ciphers is to tweak the generic constructions of classic block ciphers. This paper focuses on how to build a secure tweakable block cipher from the Key-Alternating Feistel (KAF) structure, a dedicated Feistel structure with round functions of the form 𝐹𝑖(𝑘𝑖⊕𝑥𝑖) , where 𝑘𝑖 is the secret round key and 𝐹𝑖 is a public random function in the i-th round. We start from the simplest KAF structures that have been published so far, and then incorporate the tweaks to the round key XOR operations by (almost) universal hash functions. Moreover, we limit the number of rounds with the tweak injections for the efficiency concerns of changing the tweak value. Our results are two-fold, depending on the provable security bound: For the birthday-bound security, we present a 4-round minimal construction with two independent round keys, a single round function and two universal hash functions; For the beyond-birthday-bound security, we present a 10-round construction secure up to 𝑂(min{22𝑛/3,22𝑛𝜖−1‾‾‾‾‾‾√4}) adversarial queries, where n is the output size of the round function and 𝜖 is the upper bound of the collision probability of the universal hash functions. Our security proofs exploit the hybrid argument combined with the H-coefficient technique.

Springer, Cham2020