In the context of linear cryptanalysis of block ciphers, let
p
0
(resp.
p
1
) be the probability that a particular linear approximation holds for the right (resp. a wrong) key choice. The standard ...right key randomisation hypothesis states that
p
0
is a constant
p
≠
1
/
2
and the standard wrong key randomisation hypothesis states that
p
1
=
1
/
2
. Using these hypotheses, the success probability
P
S
of the attack can be expressed in terms of the data complexity
N
. The resulting expression for
P
S
is a monotone increasing function of
N
. Building on earlier work by O’Connor (In: Preneel B (ed) Fast Software Encryption: Second International Workshop. Leuven, Belgium, 14–16 December 1994, Proceedings, volume 1008 of Lecture Notes in Computer Science, pp. 131–136. Springer, 1994) and Daemen and Rijmen (J Math Cryptol 1(3):221–242, 2007), Bogdanov and Tischhauser (In: Moriai S (ed) Fast Software Encryption—20th International Workshop, FSE 2013, Singapore, March 11–13, 2013. Revised Selected Papers, volume 8424 of Lecture Notes in Computer Science, pp. 19–38. Springer, 2013) argued that
p
1
should be considered to be a random variable. They postulated the adjusted wrong key randomisation hypothesis which states that
p
1
follows a normal distribution. A non-intuitive consequence is that the resulting expression for
P
S
is no longer a monotone increasing function of
N
. A later work by Blondeau and Nyberg (Des Codes Cryptogr 82(1–2):319–349, 2017) argued that
p
0
should also be considered to be a random variable and they postulated the adjusted right key randomisation hypothesis which states that
p
0
follows a normal distribution. In this work, we revisit the key randomisation hypotheses. While the argument that
p
0
and
p
1
should be considered to be random variables is indeed valid, we show that if
p
0
and
p
1
follow any distributions with supports which are subsets of 0, 1, and
E
p
0
=
p
and
E
p
1
=
1
/
2
, then the expression for
P
S
that is obtained is exactly the same as the one obtained using the standard key randomisation hypotheses. Consequently,
P
S
is a monotone increasing function of
N
even when
p
0
and
p
1
are considered to be random variables.
Cellular automata are simple models of computation which exhibit
fascinatingly complex behavior. They have captured the attention of several generations of researchers, leading to an extensive body ...of work. Here we trace a history of cellular automata from their beginnings with von Neumann to the present day. The emphasis is mainly on topics closer to computer science and mathematics rather than physics, biology or other applications. The work should be of interest to both new entrants into the field as well as researchers working on particular aspects of cellular automata.
The zero correlation zone (ZCZ) ratio, i.e., the ratio of the width of the ZCZ and the length of the sequence plays a major role in reducing interference in an asynchronous environment of ...communication systems. However, to the best of the authors knowledge, for q = 2, the highest ZCZ ratio for even-length Zcomplementary pairs which are directly constructed using generalized Boolean functions (GBFs), is 2/3. In this letter, we present a direct construction of q-ary even-length Z-complementary pairs through GBFs, which can achieve aZCZ ratio of 3/4.In general, the constructed q-ary even-length Z-complementary pairs are of length 2 m-1 + 2 (m ∈ Z + ), having a ZCZ width of 2m -2 + 2 π(m-3) + 1 where π is a permutation over m - 2 variables.
We show the applicability of Simon’s period finding quantum algorithm to the cryptanalysis of several tweakable enciphering schemes (TESs), namely, CMC, EME, XCB, TET and FAST. For all of the five ...TESs, we show distinguishing attacks, while for XCB, TET and FAST, the attacks reveal portions of the secret keys
This work considers the problem of fast and secure scalar multiplication using curves of genus one defined over a field of prime order. Previous work by Gaudry and Lubicz (Finite Fields Appl ...15(2):246–260,
2009
) had suggested the use of the associated Kummer line to speed up scalar multiplication. In the present work, we explore this idea in detail. The first task is to obtain an elliptic curve in Legendre form which satisfies necessary security conditions such that the associated Kummer line has small parameters and a base point with small coordinates. It turns out that the ladder step on the Kummer line supports parallelism and can be implemented very efficiently in constant time using the single-instruction multiple-data (SIMD) operations available in modern processors. For the 128-bit security level, this work presents three Kummer lines denoted as
K
1
:
=
KL
2519
(
81
,
20
)
,
K
2
:
=
KL
25519
(
82
,
77
)
and
K
3
:
=
KL
2663
(
260
,
139
)
over the three primes
2
251
-
9
,
2
255
-
19
and
2
266
-
3
, respectively. Implementations of scalar multiplications for all three Kummer lines using Intel intrinsics have been done, and the code is publicly available. Timing results on the Skylake and the Haswell processors of Intel indicate that both fixed base and variable base scalar multiplications for
K
1
and
K
2
are faster than those achieved by Sandy2x, which is a highly optimised SIMD implementation in assembly of the well-known Curve25519. On Skylake, both fixed base and variable base scalar multiplications for
K
3
are faster than Sandy2x, whereas on Haswell, fixed base scalar multiplication for
K
3
is faster than Sandy2x while variable base scalar multiplication for both
K
3
and Sandy2x takes roughly the same time. In practical terms, the particular Kummer lines that are introduced in this work are serious candidates for deployment and standardisation. We further illustrate the usefulness of the proposed Kummer lines by instantiating the quotient Digital Signature Algorithm on all the three Kummer lines.
In this work, we study message authentication code (MAC) schemes supporting variable tag lengths. We provide a formalisation of such a scheme. Several variants of the classical Wegman-Carter MAC ...scheme are considered. Most of these are shown to be insecure by pointing out detailed attacks. One of these schemes is highlighted and proved to be secure. We further build on this scheme to obtain single-key variable tag length MAC schemes utilising either a stream cipher or a short-output pseudo-random function. These schemes can be efficiently instantiated using practical well known primitives.
A pair of the complex-valued sequences is called a <inline-formula><tex-math notation="LaTeX">Z</tex-math></inline-formula>-complementary pair (ZCP) if it has zero aperiodic auto-correlation sum ...(AACS) for all time-shifts within a certain region, commonly known as zero correlation zone (ZCZ). Type-II ZCPs have the ZCZ around the end time shifts position. Till the date, no direct construction technique is available for type-II ZCPs of length non-power-of-two. For the first time, we have advocated a direct construction of <inline-formula><tex-math notation="LaTeX">2^h</tex-math></inline-formula>-ary (<inline-formula><tex-math notation="LaTeX">h</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX">\in</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX">\mathbb {N}</tex-math></inline-formula>) type-II ZCPs of length <inline-formula><tex-math notation="LaTeX">2^mP</tex-math></inline-formula> with ZCZ width <inline-formula><tex-math notation="LaTeX">2^mP</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX">+1-</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX">P</tex-math></inline-formula>, where <inline-formula><tex-math notation="LaTeX">m</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">P</tex-math></inline-formula> are positive integers, using the multivariable function. The proposed type-II ZCPs feature the optimal case, i.e., <inline-formula><tex-math notation="LaTeX">Z</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX">\le</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX"> N</tex-math></inline-formula><inline-formula><tex-math notation="LaTeX">-</tex-math></inline-formula>1 for the lengths in the form of power-of-two and asymptotically optimal for other even lengths.
The Goods and Services Tax (GST) Council of India has a non-conventional weighted voting procedure having a primary player who is a blocker and a set of secondary players. The voting weights are not ...fixed and are determined based on the subset of players which participate in the voting. We introduce the notion of voting schema to formally model such a voting procedure. Individual voting games arise from a voting schema depending on the subset of secondary players who participate in the voting. We make a detailed formal study of the trade-off between the minimal sizes of winning and blocking coalitions in the voting games that can arise from a voting schema. Finally, the GST voting procedure is assessed using the theoretical results leading to suggestions for improvement.
We describe a systematic framework for using a stream cipher supporting an initialisation vector (
IV
) to perform various tasks of authentication and authenticated encryption. These include message ...authentication code (MAC), authenticated encryption (AE), authenticated encryption with associated data (AEAD) and deterministic authenticated encryption (DAE) with associated data. Several schemes are presented and rigourously analysed. A major component of the constructions is a keyed hash function having provably low collision and differential probabilities. Methods are described to efficiently extend such hash functions to take multiple inputs. In particular, double-input hash functions are required for the construction of AEAD schemes. An important practical aspect of our work is that a designer can combine off-the-shelf stream ciphers with off-the-shelf hash functions to obtain secure primitives for MAC, AE, AEAD and DAE(AD).
Within the transport layer security (TLS) protocol version 1.3, RFC 7748 specifies elliptic curves targeted at the 128-bit and the 224-bit security levels. For the 128-bit security level, the ...Montgomery curve Curve25519 and its birationally equivalent twisted Edwards curve Ed25519 are specified; for the 224-bit security level, the Montgomery curve Curve448, the Edwards curve Edwards448 (which is isogenous to Curve448) and another Edwards curve which is birationally equivalent to Curve448 are specified. Our first contribution is to provide the presently best known 64-bit assembly implementations of Diffie–Hellman shared secret computation using Curve25519. The main contribution of this work is to propose new pairs of Montgomery–Edwards curves at the 128-bit and the 224-bit security levels. The new curves are
nice
in the sense that they have very small curve coefficients and base points. Compared to the curves in RFC 7748, the new curves lose two bits of security. The gain is improved efficiency. For Intel processors, we have made different types of implementations of the Diffie–Hellman shared secret computation using the new curves. The new curve at the 128-bit level is faster than Curve25519 for all types of implementations that we considered, while the new curve at the 224-bit level is faster than Curve448 using 64-bit sequential implementation using schoolbook multiplication, but is slower than Curve448 for vectorized implementation using Karatsuba multiplication. Overall, the new curves provide good alternatives to Curve25519 and Curve448.
PDF
