Band 1, Heft 4

Redundant number systems (e.g., signed binary representations) have been utilized to efficiently implement algebraic operations required by public-key cryptosystems, especially those based on elliptic curves. Several families of integer representations have been proposed that have a minimal number of nonzero digits (so-called minimal weight representations). We observe that many of the constructions for minimal weight representations actually work by building representations which are minimal in another sense. For a given set of digits, these constructions build colexicographically minimal representations; that is, they build representations where each nonzero digit is positioned as far left (toward the most significant digit) as possible. We utilize this strategy in a new algorithm which constructs a very general family of minimal weight dimension- d joint representations for any d ≥ 1. The digits we use are from the set { a ∈ Z : l ≤ a ≤ u } where l ≤ 0 and u ≥ 1 are integers. By selecting particular values of l and u , it is easily seen that our algorithm generalizes many of the minimal weight representations previously described in the literature. From our algorithm, we obtain a syntactical description of a particular family of dimension- d joint representations; any representation which obeys this syntax must be both colexicographically minimal and have minimal weight; moreover, every vector of integers has exactly one representation that satisfies this syntax. We utilize this syntax in a combinatorial analysis of the weight of the representations.

The distributional properties and the collision probability for the hash function VSH recently introduced by Contini, Lenstra and Steinfeld, are studied. The study leads to some interesting number theoretic questions which have apparently not been studied. These and related questions on VSH are considered in this work.

The paper cryptanalyses a public-key cryptosystem recently proposed by Grigoriev and Ponomarenko, which encrypts an element from a fixed finite group defined in terms of generators and relations to produce a ciphertext from . The paper presents a heuristic method for recovering the secret key from the public key, and so this cryptosystem should not be used in practice.

The length-based approach is a heuristic for solving randomly generated equations in groups that possess a reasonably behaved length function. We describe several improvements of the previously suggested length-based algorithms, which make them applicable to Thompson's group with significant success rates. In particular, this shows that the Shpilrain-Ushakov public key cryptosystem based on Thompson's group is insecure, and suggests that no practical public key cryptosystem based on the difficulty of solving an equation in this group can be secure.

We consider broadcast encryption schemes wherein a center needs to broadcast a secret message to a privileged set of receivers. We prescribe a probability distribution P on the privileged set. In this setting, the transmission overhead can be viewed as a random variable over P and we define its expected value as the average transmission overhead (or ATO). Given P , the Shannon's entropy function H (.) provides a lower bound on the average number of bits required to identify every privileged set. This implies a natural lower bound for the ATO in terms of H ( P ). For session key distribution, we consider the subset cover framework and bound the ATO in terms of the size of the cover. We further specialize our bound to accommodate storage constraints at receivers. We consider two families of distributions for P that occur naturally in broadcast networks. 1. Each receiver independently joins the privileged set with probability p . 2. The privileged set is selected uniformly from a collection of subsets of receivers. We evaluate the ATO of some practical schemes such as the subset difference method, the LSD scheme and the Partition-and-Power scheme under these distributions. Our investigations lead us to conclude that each scheme is inherently tailored to perform optimally for specific distributions.

I examine the use of automated theorem-proving for reductionist security arguments in cryptography and discuss three papers that purport to show the potential of computer-assisted proof-writing and proof-checking. I look at the proofs that the authors give to illustrate the “game-hopping” technique — for Full-Domain Hash signatures, ElGamal encryption, and Cramer-Shoup encryption — and ask whether there is evidence that automated theorem-proving can contribute anything of value to the security analysis of cryptographic protocols.