<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
  <channel>
    <title>Cryptology ePrint Archive Forum</title>
    <link>http://eprint.iacr.org/forum/index.php</link>
    <description><![CDATA[]]></description>
    <language>EN</language>
    <pubDate>Sat, 04 Feb 2012 11:44:21 -0700</pubDate>
    <lastBuildDate>Sat, 04 Feb 2012 11:44:21 -0700</lastBuildDate>
    <category>Cryptology ePrint Archive Forum</category>
    <generator>Phorum 5.1.22</generator>
    <ttl>600</ttl>
    <item>
      <title>[2012 Reports] plagiarism or ignorance</title>
      <link>http://eprint.iacr.org/forum/read.php?12,597,597#msg-597</link>
      <author>ncourtois</author>
      <description><![CDATA[Qichun Wang and Thomas Johansson
Higher Order Algebraic Attacks on Stream Ciphers
http://eprint.iacr.org/2012/013.pdf

Plagiarism or ignorance of (very ample) literature on this topic??? 
The authors write: 
&quot;In this paper we introduce a new type of algebraic attacks, called higher order algebraic
attacks, with applications towards cryptanalysis of stream ciphers.&quot; 
The authors claim that their attack is new while it is entirely old. 
There is no new attack in this paper and it is just applying already known attacks to some new special cases. 
There are tens of papers which already explain and use countless variants of this type of attack. 

In Section 4 we read:
&quot;If we add the 1st equation and the ith equation...&quot; 
&quot;Remark 1: The classical algebraic attack is the special case r =1&quot; 
No, the case with several shifted versions of one single Boolean function was already covered as early in 2003. 
What the authors call here a &quot;new attack&quot; is actually described in Section 7.1. page 15 of 
the extended version of the Courtois-Meier original paper from 2003 
under the name of scenario S5 in 
see http://www.nicolascourtois.me.uk/toyolili.pdf

S5 and variants are also covered in countless other papers. 
I recommend also to read these slides from 2002-2007 which contain many important remarks not found in papers: 
http://www.nicolascourtois.com/papers/toyolili_slides.pdf
A very general formulation of an algebraic attack on a stream cipher appears also here: 
Nicolas Courtois: General Principles of Algebraic Attacks and New Design Criteria for Components of Symmetric Ciphers, Invited talk, AES 4 Conference, LNCS 3373, Springer.
and here 
Nicolas Courtois: Algebraic Attacks on Combiners with Memory and Several Outputs, In ICISC 2004, LNCS, Springer. The extended and recently updated version of this paper is available at eprint.iacr.org/2003/125/.
however in these definitions the states of the cipher used are assume to be consecutive 
(mostly because it used used to prove many worst-case attacks whcih are proven to exist always for components of certain size). 
The fact that the outputs used do NOT have to be consecutive or regularly spaced is widely known since the initial Eurocrypt 2003 attack on LILI-128. 

BTW. 
S5 is also actually a basis of all the &quot;fast&quot; algebraic attacks on stream ciphers [Crypto 2003], 
so it is really very strange to claim that this type of attack has any novelty while the authors 
amply cite work on fast algebraic attacks and on Ronjom-Helleseth attack 
which is also a special case of a fast algebraic attack from Crypto 2004 and thus also a sub-class of S5 attacks 
with a specific kind of final step. 

Further comments: 
&quot;To measure the resistance against algebraic attacks, the notion of algebraic immunity 
has been proposed by Courtois and Meier: 
for a given Boolean function f, any Boolean function g =0 
such that f*g =0 or (f +1)*g =0 should have high algebraic degree.&quot;

Indeed but the exact name of &quot;algebraic immunity&quot; was only used 1 year later 
at Eurocrypt 2004: C.Carlet, W. Meier, E. Pasalic &quot;Algebraic attacks and decomposition  of Boolean functions&quot;, 
Again the authors show that they do NOT know the (very ample) literature on this topic. 

Remark: even the annihiliators are already there 
see sub-scenario S3_0 and S3_1 in Table 5 on page 19 in http://www.nicolascourtois.me.uk/toyolili.pdf.
which sets cover exactly the sets of annihilators for f and f+1 
BUT again the exact name of annihilator was only used 1 year later at Eurocrypt 2004 C.Carlet, W. Meier, E. Pasalic
see slide 133 in http://www.nicolascourtois.com/papers/toyolili_slides.pdf]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,597,597#msg-597</guid>
      <pubDate>Sat, 04 Feb 2012 11:44:21 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] 2011/694</title>
      <link>http://eprint.iacr.org/forum/read.php?11,596,596#msg-596</link>
      <author>eoswald</author>
      <description><![CDATA[Just to point towards report number 2011/380
which has appeared in CARDIS 2011.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,596,596#msg-596</guid>
      <pubDate>Fri, 13 Jan 2012 08:36:55 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] On Report 2011/361</title>
      <link>http://eprint.iacr.org/forum/read.php?11,595,595#msg-595</link>
      <author>jsbaek</author>
      <description><![CDATA[Dear Authors,

Thank you very much for pointing out the &quot;flaw&quot; in the proof of our stateful IBE scheme. Actually I do understand your point. 

But I would like to say something about this. 

As stated in our paper, the stateful IBE scheme was proposed as an extension of our stateful PKE
scheme (StPE) proposed in the same paper. In fact, we do not provide a complete proof for the proposed
stateful IBE scheme but leave it as a future work for the full version of the paper by stating 
&quot;The detailed proof will be provided in the full version of this paper.&quot; . (Unfortunately the full version is yet to be released.) So I'm wondering what
proof you are referring to in Section 3.2 of your paper. - We do not even state this as a theorem.


Rather than giving a full proof, we are providing a sketch of the proof. According to the end of Section 
4 of our paper,  the basic idea is to construct
a normal StPE (We call this &quot;StBDH&quot; for the sake of convenience) out of the proposed stateful IBE and proved 
that the CCA-security of the stateful IBE is reduced to the CCA-security of this StBDH. Then we claim that 

&quot;Using a similar technique used in the proof of stDH+ (Appendix A.2), it can be shown that the derived StPE 
scheme is IND-CCA secure assuming that the Bilinear Diffie 
-Hellman (BDH) [9] is hard (in the random oracle model).&quot;
  
We sincerely accept that this sentence is a mistake in a sense that it is not clear whether 'computational' or 'gap' DH assumption is sufficent for CCA-security of the stBDH scheme. But I really DO NOT think this is serious enough to be written as a paper and deserve the title &quot;On the Exact Security of Baek et al.’s Stateful IBE...&quot;. 

Your observation on the &quot;Exact Security&quot; is trivial and is well-known. We are definitely aware the &quot;inconsistency in answering decryption oracle queries&quot; that the proof for the CCA-security of the StBDH cannot be reduced to the normal computational BDH problem. You may think that I'm bluffing but if we did not know this, we would not be able to prove that the hardness of &quot;gap&quot; Diffie-Hellman problem to the CCA-security of our proposed scheme stDH+ in the same paper. 
 
So I would like you to change the title of your paper by removing &quot;Baek et al.'s stateful IBE&quot; and to focus more on your new constructions. Your criticism is somewhat groundless.

Joonsang Baek]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,595,595#msg-595</guid>
      <pubDate>Thu, 05 Jan 2012 14:31:57 -0700</pubDate>
    </item>
    <item>
      <title>[2004 Reports] Re: md5 collision example</title>
      <link>http://eprint.iacr.org/forum/read.php?4,590,591#msg-591</link>
      <author>russg</author>
      <description><![CDATA[The MD5 collision example is in the wikipedia entry
for MD5, not in 2004/199.

d131dd02c5e6eec4693d9a0698aff95c 2fcab58712467eab4004583eb8fb7f89
55ad340609f4b30283e488832571415a 085125e8f7cdc99fd91dbdf280373c5b
d8823e3156348f5bae6dacd436c919c6 dd53e2b487da03fd02396306d248cda0
e99f33420f577ee8ce54b67080a80d1e c69821bcb6a8839396f9652b6ff72a70

d131dd02c5e6eec4693d9a0698aff95c 2fcab50712467eab4004583eb8fb7f89
55ad340609f4b30283e4888325f1415a 085125e8f7cdc99fd91dbd7280373c5b
d8823e3156348f5bae6dacd436c919c6 dd53e23487da03fd02396306d248cda0
e99f33420f577ee8ce54b67080280d1e c69821bcb6a8839396f965ab6ff72a70]]></description>
      <category>2004 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?4,590,591#msg-591</guid>
      <pubDate>Sun, 18 Dec 2011 17:24:30 -0700</pubDate>
    </item>
    <item>
      <title>[2004 Reports] md5 collision example</title>
      <link>http://eprint.iacr.org/forum/read.php?4,590,590#msg-590</link>
      <author>russg</author>
      <description><![CDATA[report 2004/199 has example of MD5 collision.

It also says column 1 is 'offset'.  I tried to verify
the collision with the following hex translated to
ASCII 128 byte files.  I don't understand what the
'offset' is about.  Here's the hex of the two
collisions I translated to 128 byte .bin files.

131dd02c5e6eec4693d9a0698aff95c2fcab50712467eab4004583eb8fb7f8955ad340609f4b30283e4888325f1415a085125e8f7cdc99fd91dbd7280373c5bd8823e3156348f5bae6dacd436c919c6dd53e23487da03fd02396306d248cda0e99f33420f577ee8ce54b67080280d1ec69821bcb6a8839396f965ab6ff72a70

d131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf280373c5bd8823e3156348f5bae6dacd436c919c6dd53e2b487da03fd02396306d248cda0e99f33420f577ee8ce54b67080a80d1ec69821bcb6a8839396f9652b6ff72a70

I checked the .bin files and they have the bytes as in the ASCII string.

What am I doing wrong?]]></description>
      <category>2004 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?4,590,590#msg-590</guid>
      <pubDate>Sat, 17 Dec 2011 16:39:42 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Paper 2011/631 has a fundamental flaw</title>
      <link>http://eprint.iacr.org/forum/read.php?11,586,586#msg-586</link>
      <author>robdep</author>
      <description><![CDATA[This paper attacks the results of the De Prisco and De Santis paper (hereafter referred to as DD) using a model that is different from the model assumed in the DD paper. Hence this paper is meaningless.

In the original model of the DD paper the attack described in this paper is not possible. 

The authors of this paper can obviously point out that the scheme presented in th DD paper are not immune to cheating in the model they consider, but this point has been already noted in the DD paper.

Probably the mistake is due to the fact that the authors of this paper have not noticed that the DD paper uses a model that is slightly stronger then the usual one. The extra restriction assumed in the DD model were assumed just to avoid the kind of attack the the authors present in this paper. And the proofs and explanations in 
the DD paper make this point clear enough:

1. Definition 3.1 of the model, on page 3, second column;
2. Sentence on page 9, first column, lines 20-25;
3. Sentence on page 9, second column, lines 24-26;
4. Argumentation for the proof of Lemma 6.3
   (on page 10, second column, Case 4).

In particular the above cited argumentation explicitly says that it is possible for the cheaters to construct a fake share that superposed to the one of the honest participant will yield a number of black subpixels STRICTLY GREATER than the threshold h, but the honest participant CAN DETECT this situation because legitimate shares produce a reconstructed black pixel with EXACTLY h black subpixels, as required by the model used in the DD paper.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,586,586#msg-586</guid>
      <pubDate>Sat, 03 Dec 2011 09:17:05 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] 2011/625 double submission to CTRSA2012 and ICISC 2011</title>
      <link>http://eprint.iacr.org/forum/read.php?11,584,584#msg-584</link>
      <author>ethz69</author>
      <description><![CDATA[As far as I know, this paper has been submitted simultaneously to CTRSA2012 and ICISC 2011.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,584,584#msg-584</guid>
      <pubDate>Mon, 21 Nov 2011 15:55:10 -0700</pubDate>
    </item>
    <item>
      <title>[General] Re: Welcome to the discussion forum</title>
      <link>http://eprint.iacr.org/forum/read.php?2,2,583#msg-583</link>
      <author>jmclaugh</author>
      <description><![CDATA[Thanks!

I've had a look, but can't find any more posts with hidden spam links.

That said, sherardson's post above looks like it was made by a spambot, mainly because it seems so utterly out of context compared to the rest of the posts in this thread. I think the idea there might have been to make an innocent post and then edit it later on to add a spam link - don't know why this hasn't happened.

So... could you take a look at it and decide if it should be deleted?]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,2,583#msg-583</guid>
      <pubDate>Sat, 19 Nov 2011 14:18:12 -0700</pubDate>
    </item>
    <item>
      <title>[General] Re: Welcome to the discussion forum</title>
      <link>http://eprint.iacr.org/forum/read.php?2,2,582#msg-582</link>
      <author>Orr</author>
      <description><![CDATA[jmclaugh hi,

Thanks for the heads up. The problem of the two users you have mentioned have been fixed.

In case you have other posts which should be handled, please let me know. Thanks!]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,2,582#msg-582</guid>
      <pubDate>Tue, 15 Nov 2011 07:12:58 -0700</pubDate>
    </item>
    <item>
      <title>[General] Subforums for the Online Proceedings?</title>
      <link>http://eprint.iacr.org/forum/read.php?2,581,581#msg-581</link>
      <author>jmclaugh</author>
      <description><![CDATA[Given that, as well as the eprint archive, this site contains the &quot;IACR Online Proceedings&quot;, does anyone else think it might be a good idea to extend the remit of the forum to include discussion of these? sci.crypt is too full of spammers and trolls, and sci.crypt.research is extremely low activity, so there really doesn't seem to be anywhere to discuss recently published research.]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,581,581#msg-581</guid>
      <pubDate>Mon, 14 Nov 2011 13:57:51 -0700</pubDate>
    </item>
    <item>
      <title>[General] Re: Welcome to the discussion forum</title>
      <link>http://eprint.iacr.org/forum/read.php?2,2,580#msg-580</link>
      <author>jmclaugh</author>
      <description><![CDATA[Orr, when you're doing the next round of spam deletions, could you include ashantycapre's various posts in these? Not only does the visible text appear to have originated from some sort of automatic fake forum posting generator, but if you highlight the text a spam link using white text becomes visible (as if designed to be found via a Google search, or to increase the pagerank for the site it links to, but concealed from forum moderators)

(&quot;ashantycapre&quot; has been pulling this stuntt on unity3d.com as well.)

The post above by &quot;orangewine6&quot; is another example of this.]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,2,580#msg-580</guid>
      <pubDate>Mon, 14 Nov 2011 11:47:34 -0700</pubDate>
    </item>
    <item>
      <title>[2010 Reports] 2010/625: Reason for revision 5</title>
      <link>http://eprint.iacr.org/forum/read.php?10,576,576#msg-576</link>
      <author>Ben.Smyth</author>
      <description><![CDATA[Version 20111110:012334 (posted 10-Nov-2011 01:23:34 UTC) contains a more detailed description of our results and includes complete proofs.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,576,576#msg-576</guid>
      <pubDate>Wed, 09 Nov 2011 18:29:27 -0700</pubDate>
    </item>
    <item>
      <title>[2004 Reports] 2004/057 - entries of the variance-covariance matrix</title>
      <link>http://eprint.iacr.org/forum/read.php?4,575,575#msg-575</link>
      <author>jmclaugh</author>
      <description><![CDATA[Near to the bottom of page 5, this paper states that the vector (\hat{c}_1, ..., \hat{c}_m) will be &quot;distributed around&quot; the vector

((-1)^{z_{1}^{*}}c_1, ..., (-1)^{z_{m}^{*}}c_m)

according to a distribution with a variance-covariance matrix M in which:

* All entries not on the top-left - bottom-right diagonal are zero. (This clearly follows from the assumed independence of the linear approximations)

* All entries M_{ii} on this diagonal are equal to 1/sqrt(N).

Now, the paper has already relied on each t_j having variance \approx N/4. Since

(2t_{j}/N) - 1 = \hat{c}_j

we expect \hat{c}_j to have variance

(2/N)^{2} * (N/4) = 1/N.

Given this, I can't understand why the entries on the diagonal are 1/sqrt(N) and not 1/N. Can someone explain?]]></description>
      <category>2004 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?4,575,575#msg-575</guid>
      <pubDate>Sun, 06 Nov 2011 12:20:26 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,554#msg-554</link>
      <author>djb</author>
      <description><![CDATA[Hi Orr,

The problem is that you say things like &quot;The New Single-Key Even-Mansour Scheme&quot; and &quot;We develop our new variant of the Even-Mansour scheme&quot; when in fact exactly the same K+F(K+n) construction has been known for many years. There's a serious risk that readers will give you credit for &quot;SEM&quot; when in fact you deserve none of that credit.

Rivest proposed K2+DES(K1+n,K0) as a way to improve the security of DES(n,K0). Kilian and Rogaway analyzed the security of K2+F(K1+n,K0) for uniform random keyed permutations F. (I understand that you're reporting tighter security bounds.)

Kilian and Rogaway mentioned that Even and Mansour had proposed K2+F(K1+n), and that this was tantamount to the special case |K0|=0 of the K2+F(K1+n,K0) construction. They also proposed simplifying K2+F(K1+n,K0) by taking K2=K1, producing K1+F(K1+n,K0), and they claimed that this didn't lose security. (I understand that you're proving something along these lines.)

Your &quot;new&quot; proposal K+F(K+n) is a special case of the Kilian--Rogaway proposal K1+F(K1+n,K0), namely the special case |K0|=0. Compared to the original K2+F(K1+n,K0) construction, you're taking K1=K2 as proposed by Kilian and Rogaway, and you're taking |K0|=0 as proposed by Even and Mansour (and discussed by Kilian and Rogaway).

You say that _simultaneously_ taking K1=K2 and |K0|=0 is new. I find this more than a little bit absurd. Have you been spending too much time talking to patent lawyers?

Two minutes on Google lead me to a 2002 eprint paper by Kurosawa, with the first paragraph discussing &quot;F(x+S)+S&quot; where &quot;S is a secret mask&quot; and &quot;F is publicly accessible.&quot; You might correctly point out that Kurosawa's credits in the same paragraph are bogus, but you can't deny that he's talking about exactly your &quot;minimal&quot; block cipher.

As for further simplifications: I find it obvious that having _two_ cipher oracles, one for encryption F(n+S)+S and one for its inverse, is not as simple as having just the first oracle. Being unable to decrypt blocks puts a constraint on the mode of operation, but we can further simplify by choosing one mode of operation, namely counter mode, which of course doesn't need to decrypt blocks.

You seem to be complaining that the resulting stream cipher (e.g., Salsa20) isn't as simple as a one-time pad. Does it also bother you that your favorite block ciphers aren't as simple as a randomly generated codebook? The whole point here is to be able to simulate the large random objects using a _small_ key.

---D. J. Bernstein
Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,554#msg-554</guid>
      <pubDate>Sat, 08 Oct 2011 09:41:19 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,553#msg-553</link>
      <author>Orr</author>
      <description><![CDATA[Dear Dan,

Thank you very much for bringing to our attention the Kilian-Rogaway [KR] paper, which we somehow missed. We will be happy to add this reference to the next revision of our paper.

Our paper contains many results such as the introduction of the new *slidex* attack and a description of its many applications to various cryptographic schemes. We understand that your only objection is related to the novelty of the single-key variant of the EM scheme, which is one of these results.

Rivest's original DESX scheme contained three independent keys. You correctly point out that the [KR] paper briefly mentions the idea of using the same pre/post whitening keys in DESX. In a similar way, the [EM] paper suggests the idea of eliminating the middle encryption key in the DESX construction. However, neither one of these papers explicitly talks about a scheme which performs BOTH changes simultaneously. Since we were interested in getting a minimal construction, we pointed out that such a combination is simpler than any one of the previous proposals. If you object to our proposal since it is a special case of the previous constructions, you should also object to the [EM] and [KR] proposals since they are also special cases of the previously discovered DESX construction.

A deeper problem with your argument is that you cannot deduce that the single and double key versions of EM have equivalent security from the fact that the two schemes have the same lower bound and the same upper bound proven on their security. This is true only if these bounds are TIGHT, which is exactly what we prove as the main technical result of our paper. Without this new result, one scheme could have a security matching the lower bound and the other scheme could have a security matching the upper bound, which would contradict your argument that the schemes are equivalent since the [KR] lower bound applies to both of them.

Finally, we would like to point out that the counter mode of operation you mention is used as a STREAM CIPHER, and in this category a one time pad is conceptually simpler. Our goal was to analyze the simplest possible BLOCK CIPHER, which is defined as a keyed collection of permutations over blocks of b bits, with no memorized state.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,553#msg-553</guid>
      <pubDate>Fri, 07 Oct 2011 07:43:04 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,551#msg-551</link>
      <author>djb</author>
      <description><![CDATA[The 2011 Dunkelman--Keller--Shamir &quot;New Single-Key Even-Mansour Scheme&quot; was actually published at least ten years earlier. See, e.g., the 2001 Kilian--Rogaway J. Cryptology paper, specifically the &quot;Setting k1=k2&quot; subsection.

It's of course even more minimal to use the k1=k2 construction with only an encryption oracle in counter mode, without a decryption oracle. The cryptanalyst is limited by the inability to see the inverse, and also by the structure of the counters: if blocks are large then many input bits are constant. This usually reduces the number of rounds needed to protect against differential attacks.

I used the same K+F(K+n) structure in Salsa20 several years ago, with a 128-bit counter n, a 256-bit secret key K, and a 512-bit output block.

---D. J. Bernstein
   Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,551#msg-551</guid>
      <pubDate>Mon, 03 Oct 2011 13:53:23 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Error in Report 2011/516: Protecting AES with Shamir's Secret Sharing Scheme by Louis Goubin and Ange Martinelli</title>
      <link>http://eprint.iacr.org/forum/read.php?11,549,549#msg-549</link>
      <author>JPulkus</author>
      <description><![CDATA[At the end of section 3.1 the authors claim that affine component A of the AES S-box (which is the composition of inversion in GF(256) with an GF(2)-affine map that is NOT affine over GF(256)) can be simply implemented by applying the affine map A on the shares $y_i$ (ignoring the constant term of the affine map making it linear for simplicity's sake).

This is wrong.

As proof the authors claim that A(P) is a polynomial of degree d. A(P) can be interpreted as such a polynomial, but NOT as a polynomial of one variable over GF(256), ONLY as a polynomial in 8 variables over GF(2) when choosing a basis of GF(256) over GF(2). It is not clear at all, how to convert such a polynomial back to the form the authors need.

An easy way to see that replacing $y_i$ by $A(y_i)$ does NOT correspond to applying the affine map A to the secret value is by taking equation (1) of section 2.2:

The secret $a_0$ can be reconstructed given the shares $y_i$ by evaluating the sum $\sum_0^d y_i \cdot \beta_i$. Applying the affine map A on both sides (for simplicity, we assume again A to be linear over GF(2)) one gets $A(a_0) = A(\sum_0^d y_i \cdot \beta_i) = \sum_0^d A(y_i \cdot \beta_i)$.

As $A$ is NOT affine/linear over GF(256), in general $A(y_i \cdot \beta_i)$ does NOT equal $A(y_i) \cdot \beta_i$ and having $A(a_0)$ equal to $\sum_0^d A(y_i) \cdot \beta_i$ would be pure coincidence.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,549,549#msg-549</guid>
      <pubDate>Mon, 26 Sep 2011 03:53:27 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] two questions about paper 2011/258</title>
      <link>http://eprint.iacr.org/forum/read.php?11,547,547#msg-547</link>
      <author>Edition2</author>
      <description><![CDATA[Hi, 
     I noticed that the estimation error correction in Algorithm 3 is not fairly specified. Since the base sets selection is not satisfied with 2^(r-1)]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,547,547#msg-547</guid>
      <pubDate>Sat, 17 Sep 2011 08:28:10 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: [2011/063] Does anyone feel the notations in this paper are very difficult to follow?</title>
      <link>http://eprint.iacr.org/forum/read.php?11,363,526#msg-526</link>
      <author>michel2tiffin</author>
      <description><![CDATA[Hi,
Thanks for sharing this information.  I think you’re very interested  about codes for the wiretap channel.


Subramanian, A.;   Suresh, A.T.;   Raj, S.;   Thangaraj, A.;   Bloch, M.;   McLaughlin, S.;  
Sch. of Electr. &amp; Comput. Eng., Georgia Inst. of Technol., Atlanta, GA, USA 

This paper appears in: Turbo Codes and Iterative Information Processing (ISTC), 2010 6th International Symposium on
Issue Date: 6-10 Sept. 2010
On page(s): 30 - 34
Location: Brest
E-ISBN: 978-1-4244-6745-7
Print ISBN: 978-1-4244-6744-0
References Cited: 14
INSPEC Accession Number: 11616887
Digital Object Identifier: 10.1109/ISTC.2010.5613867 
Date of Current Version: 28 October 2010


Abstract:

In the wiretap channel model, symbols transmitted through a main channel to a legitimate receiver are observed by an eavesdropper across a wiretapper's channel. The goal of coding for wiretap channels is to facilitate error-free decoding across the main channel, while ensuring zero information transfer across the wiretapper's channel. Strong secrecy requires the total information transfer to the eavesdropper to tend to zero, while weak secrecy requires the per-symbol information transfer to go to zero. In this paper, we will consider coding methods for binary wiretap channels with a noiseless main channel and a BEC or a BSC wiretapper's channel. We will provide conditions and codes that achieve strong and weak secrecy for the BEC case. For the BSC case, we will discuss some existing coding methods and develop additional criteria for secrecy.


Thanks again,
Michel]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,363,526#msg-526</guid>
      <pubDate>Fri, 09 Sep 2011 20:14:30 -0600</pubDate>
    </item>
    <item>
      <title>[2010 Reports] Re: Some views on 2010/652</title>
      <link>http://eprint.iacr.org/forum/read.php?10,521,522#msg-522</link>
      <author>wai2ha</author>
      <description><![CDATA[The mode is not a wide-pipe hash,it doesn't really
produce CV of 2 size big,besides this,for a wide-pipe hash,it must transform the CV of 2 size big back into one size big in the end.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,521,522#msg-522</guid>
      <pubDate>Tue, 26 Jul 2011 21:16:48 -0600</pubDate>
    </item>
    <item>
      <title>[2010 Reports] Some views on 2010/652</title>
      <link>http://eprint.iacr.org/forum/read.php?10,521,521#msg-521</link>
      <author>wai2ha</author>
      <description><![CDATA[This paper tried to give a new mode to improve a codomain reducing problem for narrow-pipe hash functions.The paper is very badly written and full of typos.But I don't think those views on the  mode are right:
1.It fails to be secure against multicollision attacks.
    To see this, group calls to F by pairs calling the result G and consider messages of the restricted form (M_1, -M_1, M_2, -M_2, M_3, -M_3, ...)
   Then, all calls to G are of the form G(CV_i,0,M_i)=F(F(CV_{i-1},0,M_i),M_i,-M_i). As a consequence, G only receives  2 arguments as in a classical Merkle-Damgard and multicollision attacks do apply.

My reason is:
 a.    sum M_{i}=CV_{i-1}+sum M_{i-1}+M_{i},one can't simultaneously select a message and control an  exact value of CV_{i-1} to make the block sum M_{i-1}=0 

b. Even the case of sum M_{i-1}=0,it doesn't mean the mode is in a classical Merkle-Damgard.the sum M_{i-1}=0 is one of the 2^{m}(where,m=1024) results,any a result is additional addend for the normal step functions of compression function.

c. We can improve the step functions as(e.g.):for the steps of first round,the additional addend is m_{i,j} (where j=0,1,...,15),for steps of second round,the additional addend is cv_{i,j},in this way,no matter sum M_{i-1} is 0 or not, at least there will be effective additional addend for one round.  
So,multicollision attacks don't apply.

2.  However, using this method, the hash function is no longer narrow-piped. Therefore the result is not surprised. In general, the method is straightforward.
 
My reason is:
 The mode is not a wide-pipe hash,in reality,it has the attribute of narrow-pipe hash.A normal wide-pipe hash must make CV of 2 size big.e.g,if we make SHA512 tobe a wide-pipe hash,there must be 32 variables in stead of 16 variables,the added 16 variables must be uniformity and indistinguishability as the normal 16 variables strictly.So,it'a hard work.But in the new mode,it produce 16 variables just as a normal SHA512,it needn't the hard work of expanding 16 variables to 32 variables which of uniformity and indistinguishability,it only offers additional addend for the normal 16 step functions in each a round.
 The mode is straightforward,this is not the mistake of itself.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,521,521#msg-521</guid>
      <pubDate>Tue, 26 Jul 2011 03:13:21 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Eprint report 2011/312</title>
      <link>http://eprint.iacr.org/forum/read.php?11,496,496#msg-496</link>
      <author>Orr</author>
      <description><![CDATA[Despite the claims on page 4 (the version of the 18th of June):

&quot;by the top cryptography experts active in the area of block cipher cryptanalysis such as Schneier, Biham, Biryukov, Dunkelman, Wagner, various Australian, Japanese, German and Russian scientists, ISO cryptography experts, and all researchers always seemed to agree that it could be or should be secure.&quot;

I never claimed that GOST is a secure block cipher, following its related-key distinguisher (2 CPs, 2 keys, time of two encryptions).]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,496,496#msg-496</guid>
      <pubDate>Mon, 27 Jun 2011 12:41:03 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: Self-Proving Mix net</title>
      <link>http://eprint.iacr.org/forum/read.php?11,474,475#msg-475</link>
      <author>jivanyan</author>
      <description><![CDATA[[2011/325] Please tell your opinion about this paper.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,474,475#msg-475</guid>
      <pubDate>Fri, 24 Jun 2011 06:39:26 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Self-Proving Mix net</title>
      <link>http://eprint.iacr.org/forum/read.php?11,474,474#msg-474</link>
      <author>jivanyan</author>
      <description><![CDATA[Please tell your opinion about this construction 
2011/325]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,474,474#msg-474</guid>
      <pubDate>Fri, 24 Jun 2011 06:38:31 -0600</pubDate>
    </item>
    <item>
      <title>[2010 Reports] 2010/625: Reason for revision 4</title>
      <link>http://eprint.iacr.org/forum/read.php?10,429,429#msg-429</link>
      <author>Ben.Smyth</author>
      <description><![CDATA[Version 20110321:170045 (posted 01-Jun-2011 12:17:16 UTC) adds further attacks against electronic voting schemes which do not assure ballot independence; in particular, we consider the protocols by Lee et al., Sako &amp; Kilian and Schoenmakers. In addition, we argue that no general relationships exist between independence and privacy properties.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,429,429#msg-429</guid>
      <pubDate>Wed, 01 Jun 2011 06:21:03 -0600</pubDate>
    </item>
    <item>
      <title>[2010 Reports] Re: 2010/251 PUF exaggeration</title>
      <link>http://eprint.iacr.org/forum/read.php?10,247,388#msg-388</link>
      <author>boskom</author>
      <description><![CDATA[luzagodom Wrote:
-------------------------------------------------------
&gt; 2010/251 PUF exaggeration. Posted by: djb (IP
&gt; Logged). Date[url=http://gallstones-gallbladder.blogspot.com]:[/url] 05 May 2010 08:10. The authors of
&gt; 2010/251 are wildly exaggerating the impact of
&gt; their results


I must say that I desagree, but that is my opinion.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,247,388#msg-388</guid>
      <pubDate>Tue, 17 May 2011 12:29:54 -0600</pubDate>
    </item>
    <item>
      <title>[2009 Reports] Re: 2009/137 (Kiev card, par. 4.4)</title>
      <link>http://eprint.iacr.org/forum/read.php?9,77,387#msg-387</link>
      <author>damir</author>
      <description><![CDATA[zveriu Wrote:
-------------------------------------------------------
&gt; Hello,
&gt; 
&gt; Thanks to Roel and Nicholas (among many others -
&gt; thanks! - they know who they are) research and
&gt; papers, crapto1 3.1 have some reference
&gt; implementation of state recovery based on
&gt; &quot;dark-side paper&quot; attack.
&gt; 
&gt; Also, a reference implementation demo is available
&gt; - &quot;Mifare Classic Dark-Side Key Recovery Tool&quot;
&gt; 
&gt; http://code.google.com/p/tk-libnfc-crapto1/
&gt; 
&gt; Comments, questions, suggestions, (bug)reports are
&gt; welcome.
&gt; 
&gt; Thanks a lot
&gt; 
&gt; Regards,
&gt; Andrei Costin [url=http://quotesaboutlifeandhappiness.blogspot.com/]-[/url] http://andreicostin.com


I have visited your blog and I find it very interesting.]]></description>
      <category>2009 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?9,77,387#msg-387</guid>
      <pubDate>Tue, 17 May 2011 12:11:29 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] [211/2011] Been referred articles of V. Shorin and others have some mistakes.</title>
      <link>http://eprint.iacr.org/forum/read.php?11,384,384#msg-384</link>
      <author>bzdtn</author>
      <description><![CDATA[In the article 211 some proofs of results about GOST security against differential and linear cryptanalysis obtained by V. Shorin and others are discussed in detail (see [19, 20] in 211). But it should be remarked that these works contain some rough mistakes and their results could not be considered as scientifically grounded. In particular authors have analysed an effectiveness of linear approximation of addition modulo 2^32 in [19] under faulty assumption (p.6) that “the best approximation of the i-th bit of result is the sum mod 2 of the i-th bit of the values”. In general, the arguments in [19, 20] are mostly heuristic and don’t satisfy modern criteria for mathematical ground for security proof of block ciphers.
It seems that the detailed analysis of the GOST security against linear and differential cryptanalysis needs a great amount of further investigations.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,384,384#msg-384</guid>
      <pubDate>Fri, 13 May 2011 03:35:22 -0600</pubDate>
    </item>
    <item>
      <title>[2010 Reports] Re: 2010/485</title>
      <link>http://eprint.iacr.org/forum/read.php?10,296,372#msg-372</link>
      <author>Cihangir Tezcan</author>
      <description><![CDATA[This paper uses the ideas from Improbable Differential Cryptanalysis (see 2010/435) and present it as if they are something new. Even though I warned the author about this plagiarism, no proper citations are added. Please remove this so-called paper from eprint.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,296,372#msg-372</guid>
      <pubDate>Wed, 30 Mar 2011 16:26:17 -0600</pubDate>
    </item>
    <item>
      <title>[2010 Reports] Re: One Question of  2010/384</title>
      <link>http://eprint.iacr.org/forum/read.php?10,329,371#msg-371</link>
      <author>wai2ha</author>
      <description><![CDATA[We can always only use one surjection round in the last iteration to recovere the domain $X$ by a sum block $ÓM_(L-1)$(assume the message was L- blocks),whenever the previous reductions were great or not.For the last iteration of a narrow-pipe hash function,the active domain $X$ is at least 2^2n ,then it's the case that the ideal random functions W map the
domain of (n+w)-bit strings $X = {0,1}^(n+w )$ to the domain $Y = {0,1}^n$ ,the probability of empty set is about $e^(-2^w)$,where $w&gt;2n-n=n$.
  So,a narrow pipe hash function can easily be amend by a sum block $ÓM_(L-1)$,and the same question in MAC can also be done.I'll  expound  on 2010/652 before toolong.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,329,371#msg-371</guid>
      <pubDate>Sun, 27 Mar 2011 00:32:07 -0600</pubDate>
    </item>
  </channel>
</rss>

