Band 11, Heft 2

CAST-256 (or CAST6) is a symmetric-key block cipher published in June 1998. It was submitted as a candidate for Advanced Encryption Standard (AES). In this paper, we will propose a new chosen text attack, the multiple differential-zero correlation linear attack, to analyze the CAST-256 block cipher. Our attack is the best-known attack on CAST-256 according to the number of rounds without the weak-key assumption. We first construct a 30-round differential-zero correlation linear distinguisher. Based on the distinguisher, we propose a first 33-round attack on CAST-256 with data complexity of 2115.63{2^{115.63}} and time complexity 2238.26{2^{238.26}}. In the end, the 111-bit subkey is recovering.

We introduce a new cryptographic primitive identity-based anonymous proxy signcryption which provides anonymity to the proxy sender while also providing a mechanism to the original sender to expose the identity of the proxy sender in case of misuse. We introduce a formal definition of an identity-based anonymous proxy signcryption (IBAPS) scheme and give a security model for it. We also construct an IBAPS scheme and prove its security under the discrete logarithm assumption and computational Diffie–Hellman assumption. Moreover, we do an efficiency comparison with the existing identity-based signcryption schemes and anonymous signcryption schemes and show that our scheme is much more efficient than those schemes, we also compare the efficiency of our scheme with the available proxy signcryption schemes and show that our scheme provides anonymity to the proxy sender at cost less than those of existing proxy signcryption schemes.

In this paper, we observe simple yet subtle interconnections among design theory, coding theory and cryptography. Maximum distance separable (MDS) matrices have applications not only in coding theory but are also of great importance in the design of block ciphers and hash functions. It is nontrivial to find MDS matrices which could be used in lightweight cryptography. In the SAC 2004 paper [12], Junod and Vaudenay considered bi-regular matrices which are useful objects to build MDS matrices. Bi-regular matrices are those matrices all of whose entries are nonzero and all of whose 2×2{2\times 2} submatrices are nonsingular. Therefore MDS matrices are bi-regular matrices, but the converse is not true. They proposed the constructions of efficient MDS matrices by studying the two major aspects of a d×d{d\times d} bi-regular matrix M , namely v1⁢(M){v_{1}(M)}, i.e. the number of occurrences of 1 in M , and c1⁢(M){c_{1}(M)}, i.e. the number of distinct elements in M other than 1. They calculated the maximum number of ones that can occur in a d×d{d\times d} bi-regular matrices, i.e. v1d,d{v_{1}^{d,d}} for d up to 8, but with their approach, finding v1d,d{v_{1}^{d,d}} for d≥9{d\geq 9} seems difficult. In this paper, we explore the connection between the maximum number of ones in bi-regular matrices and the incidence matrices of Balanced Incomplete Block Design (BIBD). In this paper, tools are developed to compute v1d,d{v_{1}^{d,d}} for arbitrary d . Using these results, we construct a restrictive version of d×d{d\times d} bi-regular matrices, introducing by calling almost-bi-regular matrices, having v1d,d{v_{1}^{d,d}} ones for d≤21{d\leq 21}. Since, the number of ones in any d×d{d\times d} MDS matrix cannot exceed the maximum number of ones in a d×d{d\times d} bi-regular matrix, our results provide an upper bound on the number of ones in any d×d{d\times d} MDS matrix. We observe an interesting connection between Latin squares and bi-regular matrices and study the conditions under which a Latin square becomes a bi-regular matrix and finally construct MDS matrices from Latin squares. Also a lower bound of c1⁢(M){c_{1}(M)} is computed for d×d{d\times d} bi-regular matrices M such that v1⁢(M)=v1d,d{v_{1}(M)=v_{1}^{d,d}}, where d=q2+q+1{d=q^{2}+q+1} and q is any prime power. Finally, d×d{d\times d} efficient MDS matrices are constructed for d up to 8 from bi-regular matrices having maximum number of ones and minimum number of other distinct elements for lightweight applications.

In this paper we study an RSA variant with moduli of the form N=pr⁢ql{N=p^{r}q^{l}} (r>l≥2{r>l\geq 2}). This variant was mentioned by Boneh, Durfee and Howgrave-Graham [2]. Later Lim, Kim, Yie and Lee [11] showed that this variant is much faster than the standard RSA moduli in the step of decryption procedure. There are two proposals of RSA variants when N=pr⁢ql{N=p^{r}q^{l}}. In the first proposal, the encryption exponent e and the decryption exponent d satisfy e⁢d≡1modpr-1⁢ql-1⁢(p-1)⁢(q-1)ed\equiv 1\bmod p^{r-1}q^{l-1}(p-1)(q-1), whereas in the second proposal e⁢d≡1mod(p-1)⁢(q-1)ed\equiv 1\bmod(p-1)(q-1). We prove that for the first case if d<N1-(3⁢r+l)⁢(r+l)-2{d<N^{1-({3r+l}){(r+l)^{-2}}}}, one can factor N in polynomial time. We also show that polynomial time factorization is possible if d<N(7-2⁢7)/(3⁢(r+l)){d<N^{({7-2\sqrt{7}})/{(3(r+l))}}} for the second case. Finally, we study the case when few bits of one prime are known to the attacker for this variant of RSA. We show that given min⁡(lr+l,2⁢(r-l)r+l)⁢log2⁡p{\min(\frac{l}{r+l},\frac{2(r-l)}{r+l})\log_{2}p} least significant bits of one prime, one can factor N in polynomial time.