<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
  <channel>
    <title>Cryptology ePrint Archive Forum</title>
    <link>http://eprint.iacr.org/forum/index.php</link>
    <description><![CDATA[]]></description>
    <language>EN</language>
    <pubDate>Wed, 16 May 2012 19:50:28 -0600</pubDate>
    <lastBuildDate>Wed, 16 May 2012 19:50:28 -0600</lastBuildDate>
    <category>Cryptology ePrint Archive Forum</category>
    <generator>Phorum 5.1.22</generator>
    <ttl>600</ttl>
    <item>
      <title>[2011 Reports] ahdown the history is total.</title>
      <link>http://eprint.iacr.org/forum/read.php?11,630,630#msg-630</link>
      <author>jewellery meng Sabo</author>
      <description><![CDATA[Li Bin Zhou for a while eyebrows, tightly held close a light rain.Originally this wench is to see leaf's sword kill people to just frighten this appearance, have to a soft-voiced consolation way:&quot;The light rain wasn't afraid, free, free, in a short while we go home.&quot;Did leaf's sword kill people?Kill of what person?Don't need Li Bin thomas sabo charms australia to inquire, leaf's sword has already opened mouth to answer this question:&quot;Killed a helicopter pilot to frighten your wife so, ha ha, let ahdown the history is total.
However perhaps want to make you disappoint, you the possibility will not also return to house forever hereafter.&quot;Li Bin chases light rain Lan at tightly stare at leaf's sword to say ownly thomas sabo jewellery and after death:&quot;Are you what mean?&quot;&quot;Ha ha, I what mean don't you understand?Since dare start lu à to my younger sister n eventually leave you and then should thought of this final outcome.&quot;Leaf's sword smiled.
Stretch hand an once dragged along a station the leaf by the side of Li Bin Shen Xin joss-stick.Heel in leaf's sword after death of Anne the virtuous strong Wei is strange have thomas sabo carriers already towarded Li Bin to lift m in hand of 16 gun muzzles, also take out a hideous smile that loves blood on the face.You boy isn't the time in Qingdao very overbearing?I see you can be also overbearing this time.Those are two connect to send Li Bin comes over of the mercenary soldiers also lifted the gun muzzles in the their hand to target Li Bin and light rain, money had been already come to hand, these two people are to living is dead has already had no value to them.
The leaf Xin joss-stick stares big eyes tightly stare at leaf's sword of in front, the body blocks very naturally  at Li Bin of before the body:&quot;Elder brother, you talk nonsense what, he, he when started lu à to me n to eventually leave.&quot;Leaf's sword sighed 1 and stretched hand m &amp;#333; m &amp;#333; leaf the Xin joss-stick draw tight to stretch tight of small face, the bitterness says with a smile:&quot;Kid sister, you need not deceived an elder brother again, the elder brothers all had been already known, and the elder brother makes you personally revenge today.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,630,630#msg-630</guid>
      <pubDate>Wed, 16 May 2012 19:50:28 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] sorcery clan achievement</title>
      <link>http://eprint.iacr.org/forum/read.php?11,629,629#msg-629</link>
      <author>jewellery meng Sabo</author>
      <description><![CDATA[Brilliant Gao Jue Dao:&quot;Want to say these three the boundaries are many babies, pour three places.The first woulds be that forehead the sun temple, the forehead the sun temple is a Hong Huang big absolute being, demon clan demon the emperor is handsome Tiffany Bracelet canada and east emperor too one bedchamber, before demon when the clan walked sideways Hong Huang accepted to pare off many babies of Hong Huang, all without exception hid a temple at the forehead the sun inside!However ever since that time demon the emperor is handsome and east emperor too the whole body is clay-cold, this forehead the sun temple then had no a trace and shadow!&quot;Forehead the sun temple this doesn't say to equal to don't say, at sorcery demon war after, then disappear to disappear.
There is hearsay in three boundaries say, the dish ancient big absolute being opens for a sky, the ax becomes of one of the four greatest inborns extremely valueds, tiffany necklace that east emperor too a mentally dense clock also in that forehead the sun temple.Have been that three boundaries are hidden by the whereabouts of forehead the sun temple, even those sages are also to could not reckon, it calls does how two monkeys search arrive?Brilliant Gao Jue again way:&quot;This second place woulds be the Zu sorcery that that north accompanies Lu continent sanctuary, the 12 greatest Zus sorcery got Hong Huang generally in those early years, in the each Zu sorcery hand all had a feel happy baby!Afterwards each Zu sorcery and then collect a baby everywhere in the Hong Huang, Be hidden to a Zu sorcery inside the sanctuary!Afraid is the Zu sorcery baby's quality and amount inside the sanctuary, as many as forehead the sun temple!&quot;Zu sorcery sanctuary's pouring is to seek so much and say again relationship with sorcery clan in the island is with the Xuan wood, want ascend so 12 babies is not a difficult matter either!Can be partial to living in those early years 12 Zu sorceries for prevent°froming baby's unauthorized biography, hence then descended all babies to forbid to curse.
Would be only the own a sorcery of clan one vein Jing the person of the blood probably practice moral teachings the person of the sorcery clan achievement method, so as to develop the baby's biggest power.12 Zu sorceries all without exception don't save Tiffany Co at present, the sorcery clan has been falling off again, so those babies Be afraid to want to be general along with the front door of Zu sorcery sanctuary, tightly close!The sovereign treasure pours to have self-knowledge very and knows that oneself has no that skill to break open 12 forbiding of Zu sorcerieses to curse.
Hence have to listen to brilliant Gao Jue's brothers speaking the third place with many baby!Brilliant Gao Jue Dao:&quot;This third place's pouring is our Xuan wood ground old neighbor in island and would be East China Sea of our foot.The Hong Huang arrives a sorcery demon in the world beginning two clans rise this stage and would be the world of that bird, animals and scales and shell three  clans, three clans from also the baby is numerous, afterwards bird, animals two clans decline!Can scales and shell one clan but occupied five lakes the whole world.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,629,629#msg-629</guid>
      <pubDate>Wed, 16 May 2012 19:47:34 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] mouth not from must hang</title>
      <link>http://eprint.iacr.org/forum/read.php?11,628,628#msg-628</link>
      <author>jewellery meng Sabo</author>
      <description><![CDATA[1:00 to the eccentric.The sky of the Qing knows if be inhaled a mouth inside by him, that is to don't think that to live again, so once the tiger Qu shake and flick a black Fan, the black Fan sees breeze then long, in a moment and then is already count Zhang long breadth, spread exhibition in the sky, dense one, recruit an exhibition aweather.Qing facial expression in the sky is very white, the forehead sees sweat and read [url=http://www.ukcharmclub.com/]Thomas Sabo Sale[/url] a phrase in, project in the eye together naked, the finger disease plays, the several is only and easily crush enemy resistance black wearing of sort deeply billowing storm, &quot;Xiu Xiu&quot; several lightly ring, then and silently have no submerging of voice interest black Fan.
The black Fan extends immediately and forward and binds Qing sky therein, outwardly fierceBian Huan &amp;#57628;&amp;#57548; Su Tiao &amp;#12503; Nuo &amp;#9487; Juan Shuo Ling &amp;#9489; Nai &amp;#1063;&amp;#12449;&amp;#65325; tooth window [url=http://www.ukcharmclub.com/bracelets]thomas sabo bracelet uk[/url] &amp;#9366; Zhong &amp;#57570; Yan Yang &amp;#57362; Mao Huang Fa strand Geng &amp;#57573; Zhi Qiong Jin &amp;#915;&amp;#57585; Cong the slow Po play &amp;#57581;&amp;#65330; the &amp;#65325;&amp;#58244; beat Zhi to play &amp;#57572; Mei tenon &amp;#57393; Cha joys &amp;#462; the &amp;#57579; make Xie the &amp;#58311; hug &amp;#65331; to lead long male thunder of &amp;#57579; to invite dry hot private Ken Jing Yun Shan Yuan Tuo &amp;#57378;&amp;#58324;&amp;#12499; Gua four forgive?   He is subjected to the life of elder and says that this direction appears the breathing of an oddness in times before, so then send them to come to find out for a while, don't bring about extra complications, behind they then met Long Tian Yu, that strange breathing woulds be he sends out undoubtedly, and several people very get along well.
But don't thought of will meet this several very star, this is really a destiny, let their life to lose here.If in the past, he can also single dozen only Dou, and the eccentric put together a more or less equal, but so several years, ownly fix in order to have been already deteriorated, how with these monster Dous?    [url=http://www.ukcharmclub.com/]thomas sabo charms sale[/url] Thought of here, he cans not help a burst of and stifling, but the obvious other party doesn't want to show leniency.
The eye sees the find withdraw own attack turn, eccentric where be willing to be kind give up, loudly on roaring, and then offended to come up, spirit wave of Tao sky the  windstorm is dashing but go to.Chapter 4	The dangerous spot escapes from danger    The sky of the Qing can not, only brandish black Fan, evade confrontation with in the storm edge, the on bed terms eccentric crosses swords face to face, momentary other party also what then not he, he also gets this slow machine and gradually quells the breathing of mess.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,628,628#msg-628</guid>
      <pubDate>Wed, 16 May 2012 19:43:21 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] report 276/2011</title>
      <link>http://eprint.iacr.org/forum/read.php?11,610,610#msg-610</link>
      <author>AG</author>
      <description><![CDATA[Dear author, 

I have a specific question regarding this report. In the proof of theorem 1, in the Send(O,m) query, when U is a responder, how can B, the challenger obtain the secret generated value of the oracle who send the message m?

Thank you!]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,610,610#msg-610</guid>
      <pubDate>Fri, 16 Mar 2012 05:05:54 -0600</pubDate>
    </item>
    <item>
      <title>[2012 Reports] The weaknesses presented in 2012/115 are already known and fixed.</title>
      <link>http://eprint.iacr.org/forum/read.php?12,608,608#msg-608</link>
      <author>cwang</author>
      <description><![CDATA[Dear Authors,

This is the author of [11] referenced in your recent ePrint article 2012/115. Thanks for your interest in our work.

In our presentation back in INFOCOM 2010,
we have already emphasized the issues
and presented a secure version.

Please see the full version of our paper at 2009/579
http://eprint.iacr.org/2009/579.pdf,

and the journal version to appear at IEEE Trans. on Computers
which can be found at

http://ieeexplore.ieee.org/search/srchabstract.jsp?tp=&amp;arnumber=6109245&amp;openedRefinements%3D*%26filter%3DAND%28NOT%284283010803%29%29%26searchField%3DSearch+All%26queryText%3Dprivacy-preserving+storage+auditng


Cong Wang]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,608,608#msg-608</guid>
      <pubDate>Sun, 04 Mar 2012 22:00:09 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] Re: 2012/097: useless factorization algorithm</title>
      <link>http://eprint.iacr.org/forum/read.php?12,606,607#msg-607</link>
      <author>dyp</author>
      <description><![CDATA[I can not agree with Professor Bernstein's comments on our paper 2012/097. First,  the title of Bernstein's comments &quot;useless factorization algorithm&quot; is a useless title. Before Bernstein say so, please Bernstein prove rigorously mathematically that our algorithm is useless.

The practical effect of our Algorithm A is not good on a single PC, it is worse than many known algorithms. I know this point. I have pointed it in the section &quot;Introduction&quot; of our paper. Anymore, if an algorithm is not good in practice, maybe it can be proven to be the best one in theory. For example, Miller, AKS for primality testing.

Bernstein said &quot;All of the numerical evidence collected in the paper is consistent with the idea that each of these integers has about 1/p chance of finding p, for a total cost of essentially p to find p. This isn't even as fast as trial division.&quot; This is almost true for small n, and I know this point. But not for all n, e.g. as shown in our Proposition 4.7. So, I also please Bernstein prove it rigorously mathematically for any n before Bernstein give his conclusion.

These coefficients in Definition 2.2 have special structure, and not random. They are some kind of combinational sums( Definition 2.5), and are well-known objects in combinatorial number theory. So, Bernstein said that they are random, please him prove it before giving his conclusion.

Bernstein said&quot;One might as well generate the x values as AES outputs.&quot; Please Bernstein prove it rigorously mathematically !!!

Yingpu Deng]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,606,607#msg-607</guid>
      <pubDate>Fri, 02 Mar 2012 04:27:35 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] 2012/097: useless factorization algorithm</title>
      <link>http://eprint.iacr.org/forum/read.php?12,606,606#msg-606</link>
      <author>djb</author>
      <description><![CDATA[2012/097 finds a divisor p of n by computing gcd{n,x1}, gcd{n,x2}, ... for a particular pattern of random-looking integers x1,x2,...

All of the numerical evidence collected in the paper is consistent with the idea that each of these integers has about 1/p chance of finding p, for a total cost of essentially p to find p. This isn't even as fast as trial division. It's a giant step backwards from the rho method, ECM, etc., which take far fewer than p operations to find p once p is moderately large.

The paper provides no reason to believe that its method is of any use. The paper claims that its &quot;FAC(n,1)&quot; is surprisingly small compared to p, but the number of operations in the algorithm is essentially quadratic in FAC(n,1). The &quot;FAC(n,a)&quot; algorithm is non-uniform, and again the paper provides no reason to think it is better than random guessing. One might as well generate the x values as AES outputs.

---D. J. Bernstein
   Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,606,606#msg-606</guid>
      <pubDate>Wed, 29 Feb 2012 05:31:29 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] 2012/074 There is no flaw</title>
      <link>http://eprint.iacr.org/forum/read.php?12,604,604#msg-604</link>
      <author>lindell</author>
      <description><![CDATA[There is no flaw whatsoever in the HMAC proof. The so-called flaw pointed out by Koblitz and Menezes is a standard proof in the non-uniform model (where adversaries are modeled as families of polynomial-size circuits, or equivalently as polynomial-time Turing machines with advice). This type of proof is known to anyone who has taken a basic theory of cryptography (or complexity) course, and the security guaranteed is based on the assumption that the underlying compression function is &quot;secure&quot; (as defined in the paper) for non-uniform adversaries.

It is a shame that some people do not have enough humility to first approach the authors and ask if there is or is not a mistake. I would also hope that other people in the community take this type of behavior as an example of what NOT to do. If you find a flaw in someone's proof (something that is not the case here), then send them a nice email. You will get a nice acknowledgement, you will be known as a gracious person, and you will have done something for science. This is much better than writing an entire paper about it and getting a line on your CV that isn't worth too much. You're better off spending your time doing new and productive research.]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,604,604#msg-604</guid>
      <pubDate>Mon, 27 Feb 2012 23:42:36 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] Re: Ron was wrong, Whit was right paper 2012-064</title>
      <link>http://eprint.iacr.org/forum/read.php?12,598,603#msg-603</link>
      <author>fgrieu</author>
      <description><![CDATA[These links give some information on the kind of devices that are vulnerable.

https://www.eff.org/deeplinks/2012/02/researchers-ssl-observatory-cryptographic-vulnerabilities

https://freedom-to-tinker.com/blog/nadiah/new-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,598,603#msg-603</guid>
      <pubDate>Wed, 22 Feb 2012 05:03:31 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] Re: Ron was wrong, Whit was right paper 2012-064</title>
      <link>http://eprint.iacr.org/forum/read.php?12,598,599#msg-599</link>
      <author>jjq</author>
      <description><![CDATA[The paper by Don is here:

http://www.comms.engg.susx.ac.uk/fft/crypto/ECCFut.pdf

Best,

Jean-Jacques,]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,598,599#msg-599</guid>
      <pubDate>Sun, 19 Feb 2012 12:45:06 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] Ron was wrong, Whit was right paper 2012-064</title>
      <link>http://eprint.iacr.org/forum/read.php?12,598,598#msg-598</link>
      <author>Don Johnson</author>
      <description><![CDATA[I presented on these ideas at Certicom's Public Key Solutions 1999 conference on a paper &quot;ECC, Future Resiliency and High Security Systems&quot;.  This may help explain the &quot;folklore&quot; comment in the paper.

Don Johnson]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,598,598#msg-598</guid>
      <pubDate>Thu, 16 Feb 2012 18:42:46 -0700</pubDate>
    </item>
    <item>
      <title>[2012 Reports] plagiarism or ignorance</title>
      <link>http://eprint.iacr.org/forum/read.php?12,597,597#msg-597</link>
      <author>ncourtois</author>
      <description><![CDATA[Qichun Wang and Thomas Johansson
Higher Order Algebraic Attacks on Stream Ciphers
http://eprint.iacr.org/2012/013.pdf

Plagiarism or ignorance of (very ample) literature on this topic??? 
The authors write: 
&quot;In this paper we introduce a new type of algebraic attacks, called higher order algebraic
attacks, with applications towards cryptanalysis of stream ciphers.&quot; 
The authors claim that their attack is new while it is entirely old. 
There is no new attack in this paper and it is just applying already known attacks to some new special cases. 
There are tens of papers which already explain and use countless variants of this type of attack. 

In Section 4 we read:
&quot;If we add the 1st equation and the ith equation...&quot; 
&quot;Remark 1: The classical algebraic attack is the special case r =1&quot; 
No, the case with several shifted versions of one single Boolean function was already covered as early in 2003. 
What the authors call here a &quot;new attack&quot; is actually described in Section 7.1. page 15 of 
the extended version of the Courtois-Meier original paper from 2003 
under the name of scenario S5 in 
see http://www.nicolascourtois.me.uk/toyolili.pdf

S5 and variants are also covered in countless other papers. 
I recommend also to read these slides from 2002-2007 which contain many important remarks not found in papers: 
http://www.nicolascourtois.com/papers/toyolili_slides.pdf
A very general formulation of an algebraic attack on a stream cipher appears also here: 
Nicolas Courtois: General Principles of Algebraic Attacks and New Design Criteria for Components of Symmetric Ciphers, Invited talk, AES 4 Conference, LNCS 3373, Springer.
and here 
Nicolas Courtois: Algebraic Attacks on Combiners with Memory and Several Outputs, In ICISC 2004, LNCS, Springer. The extended and recently updated version of this paper is available at eprint.iacr.org/2003/125/.
however in these definitions the states of the cipher used are assume to be consecutive 
(mostly because it used used to prove many worst-case attacks whcih are proven to exist always for components of certain size). 
The fact that the outputs used do NOT have to be consecutive or regularly spaced is widely known since the initial Eurocrypt 2003 attack on LILI-128. 

BTW. 
S5 is also actually a basis of all the &quot;fast&quot; algebraic attacks on stream ciphers [Crypto 2003], 
so it is really very strange to claim that this type of attack has any novelty while the authors 
amply cite work on fast algebraic attacks and on Ronjom-Helleseth attack 
which is also a special case of a fast algebraic attack from Crypto 2004 and thus also a sub-class of S5 attacks 
with a specific kind of final step. 

Further comments: 
&quot;To measure the resistance against algebraic attacks, the notion of algebraic immunity 
has been proposed by Courtois and Meier: 
for a given Boolean function f, any Boolean function g =0 
such that f*g =0 or (f +1)*g =0 should have high algebraic degree.&quot;

Indeed but the exact name of &quot;algebraic immunity&quot; was only used 1 year later 
at Eurocrypt 2004: C.Carlet, W. Meier, E. Pasalic &quot;Algebraic attacks and decomposition  of Boolean functions&quot;, 
Again the authors show that they do NOT know the (very ample) literature on this topic. 

Remark: even the annihiliators are already there 
see sub-scenario S3_0 and S3_1 in Table 5 on page 19 in http://www.nicolascourtois.me.uk/toyolili.pdf.
which sets cover exactly the sets of annihilators for f and f+1 
BUT again the exact name of annihilator was only used 1 year later at Eurocrypt 2004 C.Carlet, W. Meier, E. Pasalic
see slide 133 in http://www.nicolascourtois.com/papers/toyolili_slides.pdf]]></description>
      <category>2012 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?12,597,597#msg-597</guid>
      <pubDate>Sat, 04 Feb 2012 11:44:21 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] 2011/694</title>
      <link>http://eprint.iacr.org/forum/read.php?11,596,596#msg-596</link>
      <author>eoswald</author>
      <description><![CDATA[Just to point towards report number 2011/380
which has appeared in CARDIS 2011.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,596,596#msg-596</guid>
      <pubDate>Fri, 13 Jan 2012 08:36:55 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] On Report 2011/361</title>
      <link>http://eprint.iacr.org/forum/read.php?11,595,595#msg-595</link>
      <author>jsbaek</author>
      <description><![CDATA[Dear Authors,

Thank you very much for pointing out the &quot;flaw&quot; in the proof of our stateful IBE scheme. Actually I do understand your point. 

But I would like to say something about this. 

As stated in our paper, the stateful IBE scheme was proposed as an extension of our stateful PKE
scheme (StPE) proposed in the same paper. In fact, we do not provide a complete proof for the proposed
stateful IBE scheme but leave it as a future work for the full version of the paper by stating 
&quot;The detailed proof will be provided in the full version of this paper.&quot; . (Unfortunately the full version is yet to be released.) So I'm wondering what
proof you are referring to in Section 3.2 of your paper. - We do not even state this as a theorem.


Rather than giving a full proof, we are providing a sketch of the proof. According to the end of Section 
4 of our paper,  the basic idea is to construct
a normal StPE (We call this &quot;StBDH&quot; for the sake of convenience) out of the proposed stateful IBE and proved 
that the CCA-security of the stateful IBE is reduced to the CCA-security of this StBDH. Then we claim that 

&quot;Using a similar technique used in the proof of stDH+ (Appendix A.2), it can be shown that the derived StPE 
scheme is IND-CCA secure assuming that the Bilinear Diffie 
-Hellman (BDH) [9] is hard (in the random oracle model).&quot;
  
We sincerely accept that this sentence is a mistake in a sense that it is not clear whether 'computational' or 'gap' DH assumption is sufficent for CCA-security of the stBDH scheme. But I really DO NOT think this is serious enough to be written as a paper and deserve the title &quot;On the Exact Security of Baek et al.’s Stateful IBE...&quot;. 

Your observation on the &quot;Exact Security&quot; is trivial and is well-known. We are definitely aware the &quot;inconsistency in answering decryption oracle queries&quot; that the proof for the CCA-security of the StBDH cannot be reduced to the normal computational BDH problem. You may think that I'm bluffing but if we did not know this, we would not be able to prove that the hardness of &quot;gap&quot; Diffie-Hellman problem to the CCA-security of our proposed scheme stDH+ in the same paper. 
 
So I would like you to change the title of your paper by removing &quot;Baek et al.'s stateful IBE&quot; and to focus more on your new constructions. Your criticism is somewhat groundless.

Joonsang Baek]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,595,595#msg-595</guid>
      <pubDate>Thu, 05 Jan 2012 14:31:57 -0700</pubDate>
    </item>
    <item>
      <title>[2004 Reports] Re: md5 collision example</title>
      <link>http://eprint.iacr.org/forum/read.php?4,590,591#msg-591</link>
      <author>russg</author>
      <description><![CDATA[The MD5 collision example is in the wikipedia entry
for MD5, not in 2004/199.

d131dd02c5e6eec4693d9a0698aff95c 2fcab58712467eab4004583eb8fb7f89
55ad340609f4b30283e488832571415a 085125e8f7cdc99fd91dbdf280373c5b
d8823e3156348f5bae6dacd436c919c6 dd53e2b487da03fd02396306d248cda0
e99f33420f577ee8ce54b67080a80d1e c69821bcb6a8839396f9652b6ff72a70

d131dd02c5e6eec4693d9a0698aff95c 2fcab50712467eab4004583eb8fb7f89
55ad340609f4b30283e4888325f1415a 085125e8f7cdc99fd91dbd7280373c5b
d8823e3156348f5bae6dacd436c919c6 dd53e23487da03fd02396306d248cda0
e99f33420f577ee8ce54b67080280d1e c69821bcb6a8839396f965ab6ff72a70]]></description>
      <category>2004 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?4,590,591#msg-591</guid>
      <pubDate>Sun, 18 Dec 2011 17:24:30 -0700</pubDate>
    </item>
    <item>
      <title>[2004 Reports] md5 collision example</title>
      <link>http://eprint.iacr.org/forum/read.php?4,590,590#msg-590</link>
      <author>russg</author>
      <description><![CDATA[report 2004/199 has example of MD5 collision.

It also says column 1 is 'offset'.  I tried to verify
the collision with the following hex translated to
ASCII 128 byte files.  I don't understand what the
'offset' is about.  Here's the hex of the two
collisions I translated to 128 byte .bin files.

131dd02c5e6eec4693d9a0698aff95c2fcab50712467eab4004583eb8fb7f8955ad340609f4b30283e4888325f1415a085125e8f7cdc99fd91dbd7280373c5bd8823e3156348f5bae6dacd436c919c6dd53e23487da03fd02396306d248cda0e99f33420f577ee8ce54b67080280d1ec69821bcb6a8839396f965ab6ff72a70

d131dd02c5e6eec4693d9a0698aff95c2fcab58712467eab4004583eb8fb7f8955ad340609f4b30283e488832571415a085125e8f7cdc99fd91dbdf280373c5bd8823e3156348f5bae6dacd436c919c6dd53e2b487da03fd02396306d248cda0e99f33420f577ee8ce54b67080a80d1ec69821bcb6a8839396f9652b6ff72a70

I checked the .bin files and they have the bytes as in the ASCII string.

What am I doing wrong?]]></description>
      <category>2004 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?4,590,590#msg-590</guid>
      <pubDate>Sat, 17 Dec 2011 16:39:42 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Paper 2011/631 has a fundamental flaw</title>
      <link>http://eprint.iacr.org/forum/read.php?11,586,586#msg-586</link>
      <author>robdep</author>
      <description><![CDATA[This paper attacks the results of the De Prisco and De Santis paper (hereafter referred to as DD) using a model that is different from the model assumed in the DD paper. Hence this paper is meaningless.

In the original model of the DD paper the attack described in this paper is not possible. 

The authors of this paper can obviously point out that the scheme presented in th DD paper are not immune to cheating in the model they consider, but this point has been already noted in the DD paper.

Probably the mistake is due to the fact that the authors of this paper have not noticed that the DD paper uses a model that is slightly stronger then the usual one. The extra restriction assumed in the DD model were assumed just to avoid the kind of attack the the authors present in this paper. And the proofs and explanations in 
the DD paper make this point clear enough:

1. Definition 3.1 of the model, on page 3, second column;
2. Sentence on page 9, first column, lines 20-25;
3. Sentence on page 9, second column, lines 24-26;
4. Argumentation for the proof of Lemma 6.3
   (on page 10, second column, Case 4).

In particular the above cited argumentation explicitly says that it is possible for the cheaters to construct a fake share that superposed to the one of the honest participant will yield a number of black subpixels STRICTLY GREATER than the threshold h, but the honest participant CAN DETECT this situation because legitimate shares produce a reconstructed black pixel with EXACTLY h black subpixels, as required by the model used in the DD paper.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,586,586#msg-586</guid>
      <pubDate>Sat, 03 Dec 2011 09:17:05 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] 2011/625 double submission to CTRSA2012 and ICISC 2011</title>
      <link>http://eprint.iacr.org/forum/read.php?11,584,584#msg-584</link>
      <author>ethz69</author>
      <description><![CDATA[As far as I know, this paper has been submitted simultaneously to CTRSA2012 and ICISC 2011.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,584,584#msg-584</guid>
      <pubDate>Mon, 21 Nov 2011 15:55:10 -0700</pubDate>
    </item>
    <item>
      <title>[General] Re: Welcome to the discussion forum</title>
      <link>http://eprint.iacr.org/forum/read.php?2,2,583#msg-583</link>
      <author>jmclaugh</author>
      <description><![CDATA[Thanks!

I've had a look, but can't find any more posts with hidden spam links.

That said, sherardson's post above looks like it was made by a spambot, mainly because it seems so utterly out of context compared to the rest of the posts in this thread. I think the idea there might have been to make an innocent post and then edit it later on to add a spam link - don't know why this hasn't happened.

So... could you take a look at it and decide if it should be deleted?]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,2,583#msg-583</guid>
      <pubDate>Sat, 19 Nov 2011 14:18:12 -0700</pubDate>
    </item>
    <item>
      <title>[General] Re: Welcome to the discussion forum</title>
      <link>http://eprint.iacr.org/forum/read.php?2,2,582#msg-582</link>
      <author>Orr</author>
      <description><![CDATA[jmclaugh hi,

Thanks for the heads up. The problem of the two users you have mentioned have been fixed.

In case you have other posts which should be handled, please let me know. Thanks!]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,2,582#msg-582</guid>
      <pubDate>Tue, 15 Nov 2011 07:12:58 -0700</pubDate>
    </item>
    <item>
      <title>[General] Subforums for the Online Proceedings?</title>
      <link>http://eprint.iacr.org/forum/read.php?2,581,581#msg-581</link>
      <author>jmclaugh</author>
      <description><![CDATA[Given that, as well as the eprint archive, this site contains the &quot;IACR Online Proceedings&quot;, does anyone else think it might be a good idea to extend the remit of the forum to include discussion of these? sci.crypt is too full of spammers and trolls, and sci.crypt.research is extremely low activity, so there really doesn't seem to be anywhere to discuss recently published research.]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,581,581#msg-581</guid>
      <pubDate>Mon, 14 Nov 2011 13:57:51 -0700</pubDate>
    </item>
    <item>
      <title>[General] Re: Welcome to the discussion forum</title>
      <link>http://eprint.iacr.org/forum/read.php?2,2,580#msg-580</link>
      <author>jmclaugh</author>
      <description><![CDATA[Orr, when you're doing the next round of spam deletions, could you include ashantycapre's various posts in these? Not only does the visible text appear to have originated from some sort of automatic fake forum posting generator, but if you highlight the text a spam link using white text becomes visible (as if designed to be found via a Google search, or to increase the pagerank for the site it links to, but concealed from forum moderators)

(&quot;ashantycapre&quot; has been pulling this stuntt on unity3d.com as well.)

The post above by &quot;orangewine6&quot; is another example of this.]]></description>
      <category>General</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?2,2,580#msg-580</guid>
      <pubDate>Mon, 14 Nov 2011 11:47:34 -0700</pubDate>
    </item>
    <item>
      <title>[2010 Reports] 2010/625: Reason for revision 5</title>
      <link>http://eprint.iacr.org/forum/read.php?10,576,576#msg-576</link>
      <author>Ben.Smyth</author>
      <description><![CDATA[Version 20111110:012334 (posted 10-Nov-2011 01:23:34 UTC) contains a more detailed description of our results and includes complete proofs.]]></description>
      <category>2010 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?10,576,576#msg-576</guid>
      <pubDate>Wed, 09 Nov 2011 18:29:27 -0700</pubDate>
    </item>
    <item>
      <title>[2004 Reports] 2004/057 - entries of the variance-covariance matrix</title>
      <link>http://eprint.iacr.org/forum/read.php?4,575,575#msg-575</link>
      <author>jmclaugh</author>
      <description><![CDATA[Near to the bottom of page 5, this paper states that the vector (\hat{c}_1, ..., \hat{c}_m) will be &quot;distributed around&quot; the vector

((-1)^{z_{1}^{*}}c_1, ..., (-1)^{z_{m}^{*}}c_m)

according to a distribution with a variance-covariance matrix M in which:

* All entries not on the top-left - bottom-right diagonal are zero. (This clearly follows from the assumed independence of the linear approximations)

* All entries M_{ii} on this diagonal are equal to 1/sqrt(N).

Now, the paper has already relied on each t_j having variance \approx N/4. Since

(2t_{j}/N) - 1 = \hat{c}_j

we expect \hat{c}_j to have variance

(2/N)^{2} * (N/4) = 1/N.

Given this, I can't understand why the entries on the diagonal are 1/sqrt(N) and not 1/N. Can someone explain?]]></description>
      <category>2004 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?4,575,575#msg-575</guid>
      <pubDate>Sun, 06 Nov 2011 12:20:26 -0700</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,554#msg-554</link>
      <author>djb</author>
      <description><![CDATA[Hi Orr,

The problem is that you say things like &quot;The New Single-Key Even-Mansour Scheme&quot; and &quot;We develop our new variant of the Even-Mansour scheme&quot; when in fact exactly the same K+F(K+n) construction has been known for many years. There's a serious risk that readers will give you credit for &quot;SEM&quot; when in fact you deserve none of that credit.

Rivest proposed K2+DES(K1+n,K0) as a way to improve the security of DES(n,K0). Kilian and Rogaway analyzed the security of K2+F(K1+n,K0) for uniform random keyed permutations F. (I understand that you're reporting tighter security bounds.)

Kilian and Rogaway mentioned that Even and Mansour had proposed K2+F(K1+n), and that this was tantamount to the special case |K0|=0 of the K2+F(K1+n,K0) construction. They also proposed simplifying K2+F(K1+n,K0) by taking K2=K1, producing K1+F(K1+n,K0), and they claimed that this didn't lose security. (I understand that you're proving something along these lines.)

Your &quot;new&quot; proposal K+F(K+n) is a special case of the Kilian--Rogaway proposal K1+F(K1+n,K0), namely the special case |K0|=0. Compared to the original K2+F(K1+n,K0) construction, you're taking K1=K2 as proposed by Kilian and Rogaway, and you're taking |K0|=0 as proposed by Even and Mansour (and discussed by Kilian and Rogaway).

You say that _simultaneously_ taking K1=K2 and |K0|=0 is new. I find this more than a little bit absurd. Have you been spending too much time talking to patent lawyers?

Two minutes on Google lead me to a 2002 eprint paper by Kurosawa, with the first paragraph discussing &quot;F(x+S)+S&quot; where &quot;S is a secret mask&quot; and &quot;F is publicly accessible.&quot; You might correctly point out that Kurosawa's credits in the same paragraph are bogus, but you can't deny that he's talking about exactly your &quot;minimal&quot; block cipher.

As for further simplifications: I find it obvious that having _two_ cipher oracles, one for encryption F(n+S)+S and one for its inverse, is not as simple as having just the first oracle. Being unable to decrypt blocks puts a constraint on the mode of operation, but we can further simplify by choosing one mode of operation, namely counter mode, which of course doesn't need to decrypt blocks.

You seem to be complaining that the resulting stream cipher (e.g., Salsa20) isn't as simple as a one-time pad. Does it also bother you that your favorite block ciphers aren't as simple as a randomly generated codebook? The whole point here is to be able to simulate the large random objects using a _small_ key.

---D. J. Bernstein
Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,554#msg-554</guid>
      <pubDate>Sat, 08 Oct 2011 09:41:19 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,553#msg-553</link>
      <author>Orr</author>
      <description><![CDATA[Dear Dan,

Thank you very much for bringing to our attention the Kilian-Rogaway [KR] paper, which we somehow missed. We will be happy to add this reference to the next revision of our paper.

Our paper contains many results such as the introduction of the new *slidex* attack and a description of its many applications to various cryptographic schemes. We understand that your only objection is related to the novelty of the single-key variant of the EM scheme, which is one of these results.

Rivest's original DESX scheme contained three independent keys. You correctly point out that the [KR] paper briefly mentions the idea of using the same pre/post whitening keys in DESX. In a similar way, the [EM] paper suggests the idea of eliminating the middle encryption key in the DESX construction. However, neither one of these papers explicitly talks about a scheme which performs BOTH changes simultaneously. Since we were interested in getting a minimal construction, we pointed out that such a combination is simpler than any one of the previous proposals. If you object to our proposal since it is a special case of the previous constructions, you should also object to the [EM] and [KR] proposals since they are also special cases of the previously discovered DESX construction.

A deeper problem with your argument is that you cannot deduce that the single and double key versions of EM have equivalent security from the fact that the two schemes have the same lower bound and the same upper bound proven on their security. This is true only if these bounds are TIGHT, which is exactly what we prove as the main technical result of our paper. Without this new result, one scheme could have a security matching the lower bound and the other scheme could have a security matching the upper bound, which would contradict your argument that the schemes are equivalent since the [KR] lower bound applies to both of them.

Finally, we would like to point out that the counter mode of operation you mention is used as a STREAM CIPHER, and in this category a one time pad is conceptually simpler. Our goal was to analyze the simplest possible BLOCK CIPHER, which is defined as a keyed collection of permutations over blocks of b bits, with no memorized state.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,553#msg-553</guid>
      <pubDate>Fri, 07 Oct 2011 07:43:04 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,551#msg-551</link>
      <author>djb</author>
      <description><![CDATA[The 2011 Dunkelman--Keller--Shamir &quot;New Single-Key Even-Mansour Scheme&quot; was actually published at least ten years earlier. See, e.g., the 2001 Kilian--Rogaway J. Cryptology paper, specifically the &quot;Setting k1=k2&quot; subsection.

It's of course even more minimal to use the k1=k2 construction with only an encryption oracle in counter mode, without a decryption oracle. The cryptanalyst is limited by the inability to see the inverse, and also by the structure of the counters: if blocks are large then many input bits are constant. This usually reduces the number of rounds needed to protect against differential attacks.

I used the same K+F(K+n) structure in Salsa20 several years ago, with a 128-bit counter n, a 256-bit secret key K, and a 512-bit output block.

---D. J. Bernstein
   Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,551#msg-551</guid>
      <pubDate>Mon, 03 Oct 2011 13:53:23 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Error in Report 2011/516: Protecting AES with Shamir's Secret Sharing Scheme by Louis Goubin and Ange Martinelli</title>
      <link>http://eprint.iacr.org/forum/read.php?11,549,549#msg-549</link>
      <author>JPulkus</author>
      <description><![CDATA[At the end of section 3.1 the authors claim that affine component A of the AES S-box (which is the composition of inversion in GF(256) with an GF(2)-affine map that is NOT affine over GF(256)) can be simply implemented by applying the affine map A on the shares $y_i$ (ignoring the constant term of the affine map making it linear for simplicity's sake).

This is wrong.

As proof the authors claim that A(P) is a polynomial of degree d. A(P) can be interpreted as such a polynomial, but NOT as a polynomial of one variable over GF(256), ONLY as a polynomial in 8 variables over GF(2) when choosing a basis of GF(256) over GF(2). It is not clear at all, how to convert such a polynomial back to the form the authors need.

An easy way to see that replacing $y_i$ by $A(y_i)$ does NOT correspond to applying the affine map A to the secret value is by taking equation (1) of section 2.2:

The secret $a_0$ can be reconstructed given the shares $y_i$ by evaluating the sum $\sum_0^d y_i \cdot \beta_i$. Applying the affine map A on both sides (for simplicity, we assume again A to be linear over GF(2)) one gets $A(a_0) = A(\sum_0^d y_i \cdot \beta_i) = \sum_0^d A(y_i \cdot \beta_i)$.

As $A$ is NOT affine/linear over GF(256), in general $A(y_i \cdot \beta_i)$ does NOT equal $A(y_i) \cdot \beta_i$ and having $A(a_0)$ equal to $\sum_0^d A(y_i) \cdot \beta_i$ would be pure coincidence.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,549,549#msg-549</guid>
      <pubDate>Mon, 26 Sep 2011 03:53:27 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] two questions about paper 2011/258</title>
      <link>http://eprint.iacr.org/forum/read.php?11,547,547#msg-547</link>
      <author>Edition2</author>
      <description><![CDATA[Hi, 
     I noticed that the estimation error correction in Algorithm 3 is not fairly specified. Since the base sets selection is not satisfied with 2^(r-1)]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,547,547#msg-547</guid>
      <pubDate>Sat, 17 Sep 2011 08:28:10 -0600</pubDate>
    </item>
    <item>
      <title>[2011 Reports] Re: [2011/063] Does anyone feel the notations in this paper are very difficult to follow?</title>
      <link>http://eprint.iacr.org/forum/read.php?11,363,526#msg-526</link>
      <author>michel2tiffin</author>
      <description><![CDATA[Hi,
Thanks for sharing this information.  I think you’re very interested  about codes for the wiretap channel.


Subramanian, A.;   Suresh, A.T.;   Raj, S.;   Thangaraj, A.;   Bloch, M.;   McLaughlin, S.;  
Sch. of Electr. &amp; Comput. Eng., Georgia Inst. of Technol., Atlanta, GA, USA 

This paper appears in: Turbo Codes and Iterative Information Processing (ISTC), 2010 6th International Symposium on
Issue Date: 6-10 Sept. 2010
On page(s): 30 - 34
Location: Brest
E-ISBN: 978-1-4244-6745-7
Print ISBN: 978-1-4244-6744-0
References Cited: 14
INSPEC Accession Number: 11616887
Digital Object Identifier: 10.1109/ISTC.2010.5613867 
Date of Current Version: 28 October 2010


Abstract:

In the wiretap channel model, symbols transmitted through a main channel to a legitimate receiver are observed by an eavesdropper across a wiretapper's channel. The goal of coding for wiretap channels is to facilitate error-free decoding across the main channel, while ensuring zero information transfer across the wiretapper's channel. Strong secrecy requires the total information transfer to the eavesdropper to tend to zero, while weak secrecy requires the per-symbol information transfer to go to zero. In this paper, we will consider coding methods for binary wiretap channels with a noiseless main channel and a BEC or a BSC wiretapper's channel. We will provide conditions and codes that achieve strong and weak secrecy for the BEC case. For the BSC case, we will discuss some existing coding methods and develop additional criteria for secrecy.


Thanks again,
Michel]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,363,526#msg-526</guid>
      <pubDate>Fri, 09 Sep 2011 20:14:30 -0600</pubDate>
    </item>
  </channel>
</rss>

