<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
  <channel>
    <title>2011 Reports</title>
    <link>http://eprint.iacr.org/forum/list.php?11</link>
    <description><![CDATA[Discussion forum for Cryptology ePrint Archive reports posted in 2011.
Please put the report number in the subject.]]></description>
    <language>EN</language>
    <pubDate>Sun, 05 Aug 2012 13:43:47 -0600</pubDate>
    <lastBuildDate>Sun, 05 Aug 2012 13:43:47 -0600</lastBuildDate>
    <category>2011 Reports</category>
    <generator>Phorum 5.1.22</generator>
    <ttl>600</ttl>
    <item>
      <title>Re: Paper 2011/631 has a fundamental flaw</title>
      <link>http://eprint.iacr.org/forum/read.php?11,586,722#msg-722</link>
      <author>Orr</author>
      <description><![CDATA[What you saw was a spam message that got deleted.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,586,722#msg-722</guid>
      <pubDate>Sun, 05 Aug 2012 13:43:47 -0600</pubDate>
    </item>
    <item>
      <title>Re: Paper 2011/631 has a fundamental flaw</title>
      <link>http://eprint.iacr.org/forum/read.php?11,586,721#msg-721</link>
      <author>alex337</author>
      <description><![CDATA[What the heck is this guy talking about? This is not English that he is speaking.Chan luu, Lin Jun it must be some kind of mistranslation from Chinese that got posted here by mistake. Just my 2 cents worth. Hello everyone.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,586,721#msg-721</guid>
      <pubDate>Sun, 05 Aug 2012 12:33:07 -0600</pubDate>
    </item>
    <item>
      <title>report 276/2011</title>
      <link>http://eprint.iacr.org/forum/read.php?11,610,610#msg-610</link>
      <author>AG</author>
      <description><![CDATA[Dear author, 

I have a specific question regarding this report. In the proof of theorem 1, in the Send(O,m) query, when U is a responder, how can B, the challenger obtain the secret generated value of the oracle who send the message m?

Thank you!]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,610,610#msg-610</guid>
      <pubDate>Fri, 16 Mar 2012 05:05:54 -0600</pubDate>
    </item>
    <item>
      <title>2011/694</title>
      <link>http://eprint.iacr.org/forum/read.php?11,596,596#msg-596</link>
      <author>eoswald</author>
      <description><![CDATA[Just to point towards report number 2011/380
which has appeared in CARDIS 2011.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,596,596#msg-596</guid>
      <pubDate>Fri, 13 Jan 2012 08:36:55 -0700</pubDate>
    </item>
    <item>
      <title>On Report 2011/361</title>
      <link>http://eprint.iacr.org/forum/read.php?11,595,595#msg-595</link>
      <author>jsbaek</author>
      <description><![CDATA[Dear Authors,

Thank you very much for pointing out the &quot;flaw&quot; in the proof of our stateful IBE scheme. Actually I do understand your point. 

But I would like to say something about this. 

As stated in our paper, the stateful IBE scheme was proposed as an extension of our stateful PKE
scheme (StPE) proposed in the same paper. In fact, we do not provide a complete proof for the proposed
stateful IBE scheme but leave it as a future work for the full version of the paper by stating 
&quot;The detailed proof will be provided in the full version of this paper.&quot; . (Unfortunately the full version is yet to be released.) So I'm wondering what
proof you are referring to in Section 3.2 of your paper. - We do not even state this as a theorem.


Rather than giving a full proof, we are providing a sketch of the proof. According to the end of Section 
4 of our paper,  the basic idea is to construct
a normal StPE (We call this &quot;StBDH&quot; for the sake of convenience) out of the proposed stateful IBE and proved 
that the CCA-security of the stateful IBE is reduced to the CCA-security of this StBDH. Then we claim that 

&quot;Using a similar technique used in the proof of stDH+ (Appendix A.2), it can be shown that the derived StPE 
scheme is IND-CCA secure assuming that the Bilinear Diffie 
-Hellman (BDH) [9] is hard (in the random oracle model).&quot;
  
We sincerely accept that this sentence is a mistake in a sense that it is not clear whether 'computational' or 'gap' DH assumption is sufficent for CCA-security of the stBDH scheme. But I really DO NOT think this is serious enough to be written as a paper and deserve the title &quot;On the Exact Security of Baek et al.’s Stateful IBE...&quot;. 

Your observation on the &quot;Exact Security&quot; is trivial and is well-known. We are definitely aware the &quot;inconsistency in answering decryption oracle queries&quot; that the proof for the CCA-security of the StBDH cannot be reduced to the normal computational BDH problem. You may think that I'm bluffing but if we did not know this, we would not be able to prove that the hardness of &quot;gap&quot; Diffie-Hellman problem to the CCA-security of our proposed scheme stDH+ in the same paper. 
 
So I would like you to change the title of your paper by removing &quot;Baek et al.'s stateful IBE&quot; and to focus more on your new constructions. Your criticism is somewhat groundless.

Joonsang Baek]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,595,595#msg-595</guid>
      <pubDate>Thu, 05 Jan 2012 14:31:57 -0700</pubDate>
    </item>
    <item>
      <title>Paper 2011/631 has a fundamental flaw</title>
      <link>http://eprint.iacr.org/forum/read.php?11,586,586#msg-586</link>
      <author>robdep</author>
      <description><![CDATA[This paper attacks the results of the De Prisco and De Santis paper (hereafter referred to as DD) using a model that is different from the model assumed in the DD paper. Hence this paper is meaningless.

In the original model of the DD paper the attack described in this paper is not possible. 

The authors of this paper can obviously point out that the scheme presented in th DD paper are not immune to cheating in the model they consider, but this point has been already noted in the DD paper.

Probably the mistake is due to the fact that the authors of this paper have not noticed that the DD paper uses a model that is slightly stronger then the usual one. The extra restriction assumed in the DD model were assumed just to avoid the kind of attack the the authors present in this paper. And the proofs and explanations in 
the DD paper make this point clear enough:

1. Definition 3.1 of the model, on page 3, second column;
2. Sentence on page 9, first column, lines 20-25;
3. Sentence on page 9, second column, lines 24-26;
4. Argumentation for the proof of Lemma 6.3
   (on page 10, second column, Case 4).

In particular the above cited argumentation explicitly says that it is possible for the cheaters to construct a fake share that superposed to the one of the honest participant will yield a number of black subpixels STRICTLY GREATER than the threshold h, but the honest participant CAN DETECT this situation because legitimate shares produce a reconstructed black pixel with EXACTLY h black subpixels, as required by the model used in the DD paper.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,586,586#msg-586</guid>
      <pubDate>Sat, 03 Dec 2011 09:17:05 -0700</pubDate>
    </item>
    <item>
      <title>2011/625 double submission to CTRSA2012 and ICISC 2011</title>
      <link>http://eprint.iacr.org/forum/read.php?11,584,584#msg-584</link>
      <author>ethz69</author>
      <description><![CDATA[As far as I know, this paper has been submitted simultaneously to CTRSA2012 and ICISC 2011.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,584,584#msg-584</guid>
      <pubDate>Mon, 21 Nov 2011 15:55:10 -0700</pubDate>
    </item>
    <item>
      <title>Re: 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,554#msg-554</link>
      <author>djb</author>
      <description><![CDATA[Hi Orr,

The problem is that you say things like &quot;The New Single-Key Even-Mansour Scheme&quot; and &quot;We develop our new variant of the Even-Mansour scheme&quot; when in fact exactly the same K+F(K+n) construction has been known for many years. There's a serious risk that readers will give you credit for &quot;SEM&quot; when in fact you deserve none of that credit.

Rivest proposed K2+DES(K1+n,K0) as a way to improve the security of DES(n,K0). Kilian and Rogaway analyzed the security of K2+F(K1+n,K0) for uniform random keyed permutations F. (I understand that you're reporting tighter security bounds.)

Kilian and Rogaway mentioned that Even and Mansour had proposed K2+F(K1+n), and that this was tantamount to the special case |K0|=0 of the K2+F(K1+n,K0) construction. They also proposed simplifying K2+F(K1+n,K0) by taking K2=K1, producing K1+F(K1+n,K0), and they claimed that this didn't lose security. (I understand that you're proving something along these lines.)

Your &quot;new&quot; proposal K+F(K+n) is a special case of the Kilian--Rogaway proposal K1+F(K1+n,K0), namely the special case |K0|=0. Compared to the original K2+F(K1+n,K0) construction, you're taking K1=K2 as proposed by Kilian and Rogaway, and you're taking |K0|=0 as proposed by Even and Mansour (and discussed by Kilian and Rogaway).

You say that _simultaneously_ taking K1=K2 and |K0|=0 is new. I find this more than a little bit absurd. Have you been spending too much time talking to patent lawyers?

Two minutes on Google lead me to a 2002 eprint paper by Kurosawa, with the first paragraph discussing &quot;F(x+S)+S&quot; where &quot;S is a secret mask&quot; and &quot;F is publicly accessible.&quot; You might correctly point out that Kurosawa's credits in the same paragraph are bogus, but you can't deny that he's talking about exactly your &quot;minimal&quot; block cipher.

As for further simplifications: I find it obvious that having _two_ cipher oracles, one for encryption F(n+S)+S and one for its inverse, is not as simple as having just the first oracle. Being unable to decrypt blocks puts a constraint on the mode of operation, but we can further simplify by choosing one mode of operation, namely counter mode, which of course doesn't need to decrypt blocks.

You seem to be complaining that the resulting stream cipher (e.g., Salsa20) isn't as simple as a one-time pad. Does it also bother you that your favorite block ciphers aren't as simple as a randomly generated codebook? The whole point here is to be able to simulate the large random objects using a _small_ key.

---D. J. Bernstein
Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,554#msg-554</guid>
      <pubDate>Sat, 08 Oct 2011 09:41:19 -0600</pubDate>
    </item>
    <item>
      <title>Re: 2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,553#msg-553</link>
      <author>Orr</author>
      <description><![CDATA[Dear Dan,

Thank you very much for bringing to our attention the Kilian-Rogaway [KR] paper, which we somehow missed. We will be happy to add this reference to the next revision of our paper.

Our paper contains many results such as the introduction of the new *slidex* attack and a description of its many applications to various cryptographic schemes. We understand that your only objection is related to the novelty of the single-key variant of the EM scheme, which is one of these results.

Rivest's original DESX scheme contained three independent keys. You correctly point out that the [KR] paper briefly mentions the idea of using the same pre/post whitening keys in DESX. In a similar way, the [EM] paper suggests the idea of eliminating the middle encryption key in the DESX construction. However, neither one of these papers explicitly talks about a scheme which performs BOTH changes simultaneously. Since we were interested in getting a minimal construction, we pointed out that such a combination is simpler than any one of the previous proposals. If you object to our proposal since it is a special case of the previous constructions, you should also object to the [EM] and [KR] proposals since they are also special cases of the previously discovered DESX construction.

A deeper problem with your argument is that you cannot deduce that the single and double key versions of EM have equivalent security from the fact that the two schemes have the same lower bound and the same upper bound proven on their security. This is true only if these bounds are TIGHT, which is exactly what we prove as the main technical result of our paper. Without this new result, one scheme could have a security matching the lower bound and the other scheme could have a security matching the upper bound, which would contradict your argument that the schemes are equivalent since the [KR] lower bound applies to both of them.

Finally, we would like to point out that the counter mode of operation you mention is used as a STREAM CIPHER, and in this category a one time pad is conceptually simpler. Our goal was to analyze the simplest possible BLOCK CIPHER, which is defined as a keyed collection of permutations over blocks of b bits, with no memorized state.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,553#msg-553</guid>
      <pubDate>Fri, 07 Oct 2011 07:43:04 -0600</pubDate>
    </item>
    <item>
      <title>2011/541 proposal is not new</title>
      <link>http://eprint.iacr.org/forum/read.php?11,551,551#msg-551</link>
      <author>djb</author>
      <description><![CDATA[The 2011 Dunkelman--Keller--Shamir &quot;New Single-Key Even-Mansour Scheme&quot; was actually published at least ten years earlier. See, e.g., the 2001 Kilian--Rogaway J. Cryptology paper, specifically the &quot;Setting k1=k2&quot; subsection.

It's of course even more minimal to use the k1=k2 construction with only an encryption oracle in counter mode, without a decryption oracle. The cryptanalyst is limited by the inability to see the inverse, and also by the structure of the counters: if blocks are large then many input bits are constant. This usually reduces the number of rounds needed to protect against differential attacks.

I used the same K+F(K+n) structure in Salsa20 several years ago, with a 128-bit counter n, a 256-bit secret key K, and a 512-bit output block.

---D. J. Bernstein
   Research Professor, Computer Science, University of Illinois at Chicago]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,551,551#msg-551</guid>
      <pubDate>Mon, 03 Oct 2011 13:53:23 -0600</pubDate>
    </item>
    <item>
      <title>Error in Report 2011/516: Protecting AES with Shamir's Secret Sharing Scheme by Louis Goubin and Ange Martinelli</title>
      <link>http://eprint.iacr.org/forum/read.php?11,549,549#msg-549</link>
      <author>JPulkus</author>
      <description><![CDATA[At the end of section 3.1 the authors claim that affine component A of the AES S-box (which is the composition of inversion in GF(256) with an GF(2)-affine map that is NOT affine over GF(256)) can be simply implemented by applying the affine map A on the shares $y_i$ (ignoring the constant term of the affine map making it linear for simplicity's sake).

This is wrong.

As proof the authors claim that A(P) is a polynomial of degree d. A(P) can be interpreted as such a polynomial, but NOT as a polynomial of one variable over GF(256), ONLY as a polynomial in 8 variables over GF(2) when choosing a basis of GF(256) over GF(2). It is not clear at all, how to convert such a polynomial back to the form the authors need.

An easy way to see that replacing $y_i$ by $A(y_i)$ does NOT correspond to applying the affine map A to the secret value is by taking equation (1) of section 2.2:

The secret $a_0$ can be reconstructed given the shares $y_i$ by evaluating the sum $\sum_0^d y_i \cdot \beta_i$. Applying the affine map A on both sides (for simplicity, we assume again A to be linear over GF(2)) one gets $A(a_0) = A(\sum_0^d y_i \cdot \beta_i) = \sum_0^d A(y_i \cdot \beta_i)$.

As $A$ is NOT affine/linear over GF(256), in general $A(y_i \cdot \beta_i)$ does NOT equal $A(y_i) \cdot \beta_i$ and having $A(a_0)$ equal to $\sum_0^d A(y_i) \cdot \beta_i$ would be pure coincidence.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,549,549#msg-549</guid>
      <pubDate>Mon, 26 Sep 2011 03:53:27 -0600</pubDate>
    </item>
    <item>
      <title>two questions about paper 2011/258</title>
      <link>http://eprint.iacr.org/forum/read.php?11,547,547#msg-547</link>
      <author>Edition2</author>
      <description><![CDATA[Hi, 
     I noticed that the estimation error correction in Algorithm 3 is not fairly specified. Since the base sets selection is not satisfied with 2^(r-1)]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,547,547#msg-547</guid>
      <pubDate>Sat, 17 Sep 2011 08:28:10 -0600</pubDate>
    </item>
    <item>
      <title>Re: [2011/063] Does anyone feel the notations in this paper are very difficult to follow?</title>
      <link>http://eprint.iacr.org/forum/read.php?11,363,526#msg-526</link>
      <author>michel2tiffin</author>
      <description><![CDATA[Hi,
Thanks for sharing this information.  I think you’re very interested  about codes for the wiretap channel.


Subramanian, A.;   Suresh, A.T.;   Raj, S.;   Thangaraj, A.;   Bloch, M.;   McLaughlin, S.;  
Sch. of Electr. &amp; Comput. Eng., Georgia Inst. of Technol., Atlanta, GA, USA 

This paper appears in: Turbo Codes and Iterative Information Processing (ISTC), 2010 6th International Symposium on
Issue Date: 6-10 Sept. 2010
On page(s): 30 - 34
Location: Brest
E-ISBN: 978-1-4244-6745-7
Print ISBN: 978-1-4244-6744-0
References Cited: 14
INSPEC Accession Number: 11616887
Digital Object Identifier: 10.1109/ISTC.2010.5613867 
Date of Current Version: 28 October 2010


Abstract:

In the wiretap channel model, symbols transmitted through a main channel to a legitimate receiver are observed by an eavesdropper across a wiretapper's channel. The goal of coding for wiretap channels is to facilitate error-free decoding across the main channel, while ensuring zero information transfer across the wiretapper's channel. Strong secrecy requires the total information transfer to the eavesdropper to tend to zero, while weak secrecy requires the per-symbol information transfer to go to zero. In this paper, we will consider coding methods for binary wiretap channels with a noiseless main channel and a BEC or a BSC wiretapper's channel. We will provide conditions and codes that achieve strong and weak secrecy for the BEC case. For the BSC case, we will discuss some existing coding methods and develop additional criteria for secrecy.


Thanks again,
Michel]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,363,526#msg-526</guid>
      <pubDate>Fri, 09 Sep 2011 20:14:30 -0600</pubDate>
    </item>
    <item>
      <title>Eprint report 2011/312</title>
      <link>http://eprint.iacr.org/forum/read.php?11,496,496#msg-496</link>
      <author>Orr</author>
      <description><![CDATA[Despite the claims on page 4 (the version of the 18th of June):

&quot;by the top cryptography experts active in the area of block cipher cryptanalysis such as Schneier, Biham, Biryukov, Dunkelman, Wagner, various Australian, Japanese, German and Russian scientists, ISO cryptography experts, and all researchers always seemed to agree that it could be or should be secure.&quot;

I never claimed that GOST is a secure block cipher, following its related-key distinguisher (2 CPs, 2 keys, time of two encryptions).]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,496,496#msg-496</guid>
      <pubDate>Mon, 27 Jun 2011 12:41:03 -0600</pubDate>
    </item>
    <item>
      <title>Re: Self-Proving Mix net</title>
      <link>http://eprint.iacr.org/forum/read.php?11,474,475#msg-475</link>
      <author>jivanyan</author>
      <description><![CDATA[[2011/325] Please tell your opinion about this paper.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,474,475#msg-475</guid>
      <pubDate>Fri, 24 Jun 2011 06:39:26 -0600</pubDate>
    </item>
    <item>
      <title>Self-Proving Mix net</title>
      <link>http://eprint.iacr.org/forum/read.php?11,474,474#msg-474</link>
      <author>jivanyan</author>
      <description><![CDATA[Please tell your opinion about this construction 
2011/325]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,474,474#msg-474</guid>
      <pubDate>Fri, 24 Jun 2011 06:38:31 -0600</pubDate>
    </item>
    <item>
      <title>[211/2011] Been referred articles of V. Shorin and others have some mistakes.</title>
      <link>http://eprint.iacr.org/forum/read.php?11,384,384#msg-384</link>
      <author>bzdtn</author>
      <description><![CDATA[In the article 211 some proofs of results about GOST security against differential and linear cryptanalysis obtained by V. Shorin and others are discussed in detail (see [19, 20] in 211). But it should be remarked that these works contain some rough mistakes and their results could not be considered as scientifically grounded. In particular authors have analysed an effectiveness of linear approximation of addition modulo 2^32 in [19] under faulty assumption (p.6) that “the best approximation of the i-th bit of result is the sum mod 2 of the i-th bit of the values”. In general, the arguments in [19, 20] are mostly heuristic and don’t satisfy modern criteria for mathematical ground for security proof of block ciphers.
It seems that the detailed analysis of the GOST security against linear and differential cryptanalysis needs a great amount of further investigations.]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,384,384#msg-384</guid>
      <pubDate>Fri, 13 May 2011 03:35:22 -0600</pubDate>
    </item>
    <item>
      <title>Re: [2011/063] Does anyone feel the notations in this paper are very difficult to follow?</title>
      <link>http://eprint.iacr.org/forum/read.php?11,363,364#msg-364</link>
      <author>hadimc</author>
      <description><![CDATA[Hi

I am one of the authors of the paper. I assume you are clear about the problem(s) that the paper tries to tackle. I agree that the proof details are written technically and may seek for information-theoretic security background; however, the main body is supposed to be clean and intuitive. You may want to specify which parts of paper you have concerns about, so I can help with better understanding of them.

Regards,
Hadi Ahmadi]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,363,364#msg-364</guid>
      <pubDate>Sun, 06 Mar 2011 19:05:57 -0700</pubDate>
    </item>
    <item>
      <title>[2011/063] Does anyone feel the notations in this paper are very difficult to follow?</title>
      <link>http://eprint.iacr.org/forum/read.php?11,363,363#msg-363</link>
      <author>raullen</author>
      <description><![CDATA[I guess the idea is using codes for the wiretap channel iteratively. But I cannot follow the paper as the notations are not intuitive at all. Does any one have the same feeling?
Could someone explain this work more precisely?]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,363,363#msg-363</guid>
      <pubDate>Thu, 03 Mar 2011 11:58:11 -0700</pubDate>
    </item>
    <item>
      <title>[2011/044] Another reference</title>
      <link>http://eprint.iacr.org/forum/read.php?11,357,357#msg-357</link>
      <author>cohen082</author>
      <description><![CDATA[Might be worthwhile to compare your method with the one presented below.

A. E. Cohen and K. K. Parhi, &quot;Faster Elliptic Curve Point Multiplication Based on a Novel Greedy Base-2,3 Method,&quot; in Proceedings of the IEEE International Symposium on Circuits and Systems (ISCAS), Page(s):3374-3377, May 21-24, 2006]]></description>
      <category>2011 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?11,357,357#msg-357</guid>
      <pubDate>Wed, 02 Mar 2011 13:57:24 -0700</pubDate>
    </item>
  </channel>
</rss>
