Band 1, Heft 3

In this paper, we propose a new zero-knowledge identification protocol. While the protocol consists of only two message flows, it does not rely on any underlying signature or encryption scheme. Its zero-knowledge property is preserved under concurrent composition and reset settings. It is secure under the strongest attack model which incorporates concurrent attacks, active-intruder attacks and reset attacks. Meanwhile its performance in computation and communication is close to that of the most efficient identification protocols not based on signature or encryption systems, most of which are insecure in this strong attack model.

We study the probability distributions of difference propagation probabilities and input-output correlations for functions and block ciphers of given dimensions, for several of them for the first time. We show that these parameters have distributions that are well-studied in the field of probability such as the normal, Poisson and extreme value distributions. The results of this paper can be used to estimate how much effort will be required to generate functions satisfying certain criteria. The distributions we derive for block ciphers illustrate the significant difference between fixed-key parameters and averaged parameters.

In 1986, D. V. Chudnovsky and G. V. Chudnovsky proposed to use formulae coming from Theta functions for the arithmetic in Jacobians of genus 2 curves. We follow this idea and derive fast formulae for the scalar multiplication in the Kummer surface associated to a genus 2 curve, using a Montgomery ladder. Our formulae can be used to design very efficient genus 2 cryptosystems that should be faster than elliptic curve cryptosystems in some hardware configurations.

Recent progress on pairing implementation has made certain pairings extremely simple and fast to compute. Hence, it is natural to examine if there are consequences for the security of pairing-based cryptography. This paper gives a method to compute eta pairings on certain supersingular curves with a greatly simplified final exponentiation. The method does not lead to any improvement in the speed of pairing implementation. However, we show that it leads to a multivariate attack on the pairing inversion problem. We analyse this attack and show that it is infeasible for elliptic curves.

Exact values and bounds on the k-error linear complexity of p-periodic sequences which are constant on the cyclotomic classes are determined. This family of sequences includes sequences of discrete logarithms, Legendre sequences and Hall's sextic residue sequence.