Band 2, Heft 4

We examine several versions of the one-more-discrete-log and one-more-Diffie-Hellman problems. In attempting to evaluate their intractability, we find conflicting evidence of the relative hardness of the different problems. Much of this evidence comes from natural families of groups associated with curves of genus 2, 3, 4, 5, and 6. This leads to questions about how to interpret reductionist security arguments that rely on these non-standard problems.

We prove NP -hardness of equivalence and representation problems of quadratic forms under probabilistic reductions, in particular for indefinite, ternary quadratic forms with integer coefficients. We present identifications and signatures based on these hard problems. The bit complexity of signature generation and verification is quadratic using integers of bit length 150.

We present a two-round argument system for NP languages with polylogarithmic communication complexity. We introduce a novel property of private information retrieval (PIR) schemes, that we call database-awareness. We construct a concrete database-aware PIR scheme and build our argument system by combining a database-aware PIR scheme with a probabilistically checkable proof system (PCP). Dwork et al. (2004) pointed out difficulties to prove the soundness of such constructions for arbitrary PIR schemes. But we show the restriction to database-aware PIR schemes is sufficient to overcome these difficulties.

For applications to cryptography, it is important to represent numbers with a small number of non-zero digits (Hamming weight) or with small absolute sum of digits. The problem of finding representations with minimal weight has been solved for integer bases, e.g. by the non-adjacent form in base 2. In this paper, we consider numeration systems with respect to real bases β which are Pisot numbers and prove that the expansions with minimal absolute sum of digits are recognizable by finite automata. When β is the Golden Ratio, the Tribonacci number or the smallest Pisot number, we determine expansions with minimal number of digits ± 1 and give explicitely the finite automata recognizing all these expansions. The average weight is lower than for the non-adjacent form.

A sensor network key distribution scheme for hierarchical sensor networks was recently proposed by Cheng and Agrawal. A feature of their scheme is that pairwise keys exist between any pair of high-level nodes (which are called cluster heads) and between any (low-level) sensor node and the nearest cluster head. We present two attacks on their scheme. The first attack can be applied for certain parameter sets. If it is applicable, then this attack can result in the compromise of most if not all of the sensor node keys after a small number of cluster heads are compromised. The second attack can always be applied, though it is weaker.