Band 8, Heft 2

Abstract. In this paper we cryptanalyze two protocols: the Grigoriev–Shpilrain authentication protocol and a public key cryptosystem due to Wang, Wang, Cao, Okamoto and Shao. Both of these protocols use the computational hardness of some variations of the conjugacy search problem in a class of noncommutative monoids. We devise a practical heuristic algorithm solving those problems. As a conclusion we claim that these protocols are insecure for the proposed parameter values.

Abstract. We provide unconditional results and conditional ones under the assumption of GRH (Generalized Riemann Hypothesis) on the distribution of quadratic residues and quadratic non-residues in ℤ/Nℤ$\mathbb {Z}/N\mathbb {Z}$, where N=pq$N= pq$ is an RSA modulus used in the Goldwasser–Micali cryptosystem. The paper also discusses cryptographic implications of the results obtained.

Abstract. The motivation for extending secret sharing schemes to cases when either the set of players is infinite or the domain from which the secret and/or the shares are drawn is infinite or both, is similar to the case when switching to abstract probability spaces from classical combinatorial probability. It might shed new light on old problems, could connect seemingly unrelated problems, and unify diverse phenomena. Definitions equivalent in the finitary case could be very much different when switching to infinity, signifying their difference. The standard requirement that qualified subsets should be able to determine the secret has different interpretations in spite of the fact that, by assumption, all participants have infinite computing power. The requirement that unqualified subsets should have no or limited information on the secret suggests that we also need some probability distribution. In the infinite case events with zero probability are not necessarily impossible, and we should decide whether bad events with zero probability are allowed or not. In this paper, rather than giving precise definitions, we enlist an abundance of hopefully interesting infinite secret sharing schemes. These schemes touch quite diverse areas of mathematics such as projective geometry, stochastic processes and Hilbert spaces. Nevertheless our main tools are from probability theory. The examples discussed here serve as foundation and illustration to the more theory oriented companion paper [arXiv:1310.7423].

Abstract. We propose a new simple and efficient family of hash functions based on matrix-vector multiplications with a competitive software implementation. The hash design combines a hard mathematical problem based on solving a system of linear equations with special-random requirements and the fast computation of the convolution product algorithm. Such a mixing was often unrealizable. For security, the one-way and collision resistant criteria are based on the fact that inverting the compression function for random values is infeasible in reasonable time. In a subsequent result, we conjecture a general framework for producing secure matrix multiplication hash functions.

Abstract. Proof-of-retrievability schemes have been a topic of considerable recent interest. In these schemes, a client 𝖢$\mathsf {C}$ gives a file M to a server 𝖲$\mathsf {S}$ with the understanding that 𝖲$\mathsf {S}$ will securely store M . A suitable challenge-response protocol is invoked by 𝖢$\mathsf {C}$ in order for 𝖢$\mathsf {C}$ to gain confidence that M is indeed being correctly stored by 𝖲$\mathsf {S}$. The definition of proof-of-retrievability schemes is based on the notion of an extractor ℰ$\mathcal {E}$ that can recover the file once the challenge-response protocol is executed a sufficient number of times. In this paper, we propose a new type of scheme that we term a proof-of-data-observability scheme . Our definition tries to capture the stronger requirement that 𝖲$\mathsf {S}$ must have an actual copy of M in its memory space while it executes the challenge-response protocol. We give some examples of schemes that satisfy this new security definition. As well, we analyze the efficiency and security of the protocols we present, and we prove some necessary conditions for the existence of these kinds of protocols.