Band 2, Heft 3

In this paper we examine the problem of linear and nonlinear secure network coding from a finite geometric point of view and give some negative and positive results if we require information theoretic security based on Cai and Yeung [N. Cai and R. W. Yeung, Secure Network Coding . Proceedings of the 2002 IEEE International Symposium on Information Theory (ISIT 2002), 2002.]. On the one hand we show that there is no universal secure network coding scheme. On the other hand we give a little improvement of the result of [N. Cai and R. W. Yeung, Secure Network Coding . Proceedings of the 2002 IEEE International Symposium on Information Theory (ISIT 2002), 2002.] for the bound of the size of the coding alphabet, and a bound similar to Feldman et al. [J. Feldman, T. Malkin, C. Stein, and R. A. Servedio, On the Capacity of Secure Network Coding . Proc. 42nd Annual Allerton Conference on Communication, Control, and Computing, 2004.]. Furthermore we present results for known linear network codings: we give some necessary and some sufficient conditions for the existence of optimal linear secure network coding, when the coding scheme is given.

In this paper, we present several improvements on the best known explicit formulæ for hyperelliptic curves of genus three and four in characteristic two, including the issue of reducing memory requirements. To show the effectiveness of these improvements and to allow a fair comparison of the curves of different genera, we implement all formulæ using a highly optimized software library for arithmetic in binary fields. This library was designed to minimize the impact of a whole series of overheads which have a larger significance as the genus of the curves increases. The current state of the art in attacks against the discrete logarithm problem is taken into account for the choice of the field and group sizes. Performance tests are done on two personal computers with very different architectures. Our results can be shortly summarized as follows: Curves of genus three provide performance similar, or better, to that of curves of genus two, and these two types of curves can perform faster than elliptic curves – indeed on some processors often twice as fast. Curves of genus four attain a performance level comparable to elliptic curves. A large choice of curves is therefore available for the deployment of curve-based cryptography, with curves of genus three and four providing their own advantages as larger cofactors can be allowed for the group order.

In this paper, we provide a complete characterization of the RC4 Pseudo Random Generation Algorithm (PRGA) for one step: i = i + 1; j = j + S [ i ]; swap( S [ i ], S [ j ]); z = S [ S [ i ] + S [ j ]]. This is the first time such an involved description is presented to get a concise view of how RC4 PRGA evolves. Considering all the permutations (we also keep in mind the Finney states), we find that the distribution of z is not uniform given i, j . A corollary of this result shows that information about j is always leaked from z . Next, studying two consecutive steps of RC4 PRGA, we prove that the index j is not produced uniformly at random given the value of j two steps ago. We also provide additional evidence of z leaking information on j . Further, we present a novel distinguisher for RC4 which shows that under certain conditions the equality of two consecutive bytes is more probable than by random association. Our analysis holds regardless of the amount of initial keystream bytes thrown away during the RC4 PRGA.

At CHES 2005 a new stochastic approach for differential side channel cryptanalysis on block ciphers was introduced and studied intensively. In the present paper we focus on a generalized variant that can handle arbitrary masking techniques. Our approach combines engineer's intuition and expertise with precise stochastic methods and provides insight into the ‘nature’ of the leakage signal. In particular, this supports the design of secure cryptosystems constructively. The attacking efficiency of our approach is much better than that of DPA attacks. It is limited by the attacking efficiency of ’classical’ template attacks but profiling is (at least) by an order of magnitude more efficient.