Band 2, Heft 1

We present an attack on one of the Hidden Pairing schemes proposed by Dent and Galbraith. We drastically reduce the number of variables necessary to perform a multivariate attack and in some cases we can completely recover the private key. Our attack relies only on knowledge of the public system parameters.

A ( k , n ; w ) multi-receiver multi-message authentication code allows a transmitter to broadcast up to w − 1 distinct authenticated messages to n receivers in such a way that (1) not only an opponent but also any up to k − 1 receivers cannot cheat any other receivers, and (2) all the receivers can independently verify the authenticity of the messages. Obana and Kurosawa [ Designs, Codes and Cryptography , 22 (2001), pp. 47–63] used a special pair of orthogonal arrays, called TWOOA, to construct a ( k , n ; 2) multi-receiver single-message authentication code. In this paper, we generalize the notion of a TWOOA, and then use this generalized TWOOA to construct a ( k , n ; w ) multi-receiver multi-message authentication code, which exceeds that of Safavi-Naini and Wang [ Proc. of Eurocrypt'98, LNCS 1403, Springer (1998), pp. 527–541] at least in the numbers of receivers and authenticated messages. The structures of TWOOAs are investigated. Two constructions for TWOOAs are also provided.

In this paper we discuss generic properties of “random subgroups” of a given group G . It turns out that in many groups G (even in most exotic of them) the random subgroups have a simple algebraic structure and they “sit” inside G in a very particular way. This gives a strong mathematical foundation for cryptanalysis of several group-based cryptosystems and indicates on how to chose “strong keys”. To illustrate our technique we analyze the Anshel-Anshel-Goldfeld (AAG) cryptosystem and give a mathematical explanation of recent success of some heuristic length-based attacks on it. Furthermore, we design and analyze a new type of attack, which we term the quotient attacks. Mathematical methods we develop here also indicate how one can try to choose “parameters” in AAG to foil the attacks.

This paper considers the geometric properties of the Relinearisation algorithm and of the XL algorithm used in cryptology for equation solving. We give a formal description of each algorithm in terms of projective geometry, making particular use of the Veronese variety. We establish the fundamental geometrical connection between the two algorithms and show how both algorithms can be viewed as being equivalent to the problem of finding a matrix of low rank in the linear span of a collection of matrices, a problem sometimes known as the MinRank problem. Furthermore, we generalise the XL algorithm to a geometrically invariant algorithm, which we term the GeometricXL algorithm. The GeometricXL algorithm is a technique which can solve certain equation systems that are not easily soluble by the XL algorithm or by Groebner basis methods.