Band 3, Heft 2

Let G 1 be a cyclic multiplicative group of order n . It is known that the computational Diffie–Hellman (CDH) problem is random self-reducible in G 1 if φ ( n ) is known. That is, given g , g x ∈ G 1 for some generator g and oracle access to a “Diffie-Hellman Problem solver” for g , it is possible to compute g 1/ x ∈ G 1 in polynomial time (with which we can then solve the CDH problem w.r.t. any other generator). On the other hand, it is not clear if such a reduction exists when φ ( n ) is unknown. We exploit this “gap” to construct a novel cryptographic primitive, which we call an Oracle-based Group with Infeasible Inversion (O-GII). O-GIIs have applications in multiparty protocols. We demonstrate this by presenting a novel multi-party key agreement protocol that does not require interaction between the parties. Instead, the protocol requires each party to query a remote stateless device. Our method relies on the observation that it is considerably more expensive to interact with every party connected via an unreliable network, than it is to query one of several identical stateless devices, some of which may be located in a more reliable sub-network.

This paper shows that the advantage of any q -query adversary (which makes at most q queries) for distinguishing OMAC from a uniform random function is roughly Lq 2 /2 n . Here L is the number of blocks of the longest query and n is the output size of the uniform random function. The so far best bound is roughly σ 2 /2 n = O( L 2 q 2 /2 n ) and hence our new bound is an improved bound. Our improved security analysis also works for OMAC1 and CMAC which has been recommended by NIST as a candidate of blockcipher based MAC.

We show how to accelerate the subset sum pseudorandom number generator with arbitrary weights. Some special choices of weights speed up the naive usage of this generator without losing the property of uniform distribution which has recently been established in the general case. Our results confirm that this generator can be useful for both cryptographic and Quasi Monte Carlo applications.

In this work we re-examine a modular multiplication and a modular exponentiation method. The multiplication method, proposed by Hayashi in 1998, uses knowledge of the factorization of both N + 1 and N + 2 to compute a multiplication modulo N . If both N + 1 and N + 2 can be factored into k equally sized relatively prime factors then the computations are done modulo each of the factors and then combined using the Chinese Remainder Theorem. It was suggested that the (asymptotic) computational costs of the method is 1/ k of simply multiplying and reducing modulo N . We show, however, that the computational costs of the method is (asymptotically) at least as costly as simply multiplying and reducing modulo N for both squarings and general multiplications when efficient arithmetic is used. The exponentiation method, proposed by Hwang, Su, Yeh and Chen in 2005, is based on Hayashi's method and uses knowledge of the factorization of P + 1 and P – 1 to compute an exponentiation modulo an odd prime P . We begin by showing that the method cannot be used as a general purpose exponentiation method and then modify the method so that it can work as a general purpose modular multiplication method. Like Hayashi's method, however, this method is at best (asymptotically) only as efficient as simply multiplying and reducing modulo P .