<?xml version="1.0" encoding="iso-8859-1" ?>
<rss version="2.0">
  <channel>
    <title>2008 Reports</title>
    <link>http://eprint.iacr.org/forum/list.php?8</link>
    <description><![CDATA[Discussion forum for Cryptology ePrint Archive reports posted in 2008.
Please put the report number in the subject.

]]></description>
    <language>EN</language>
    <pubDate>Wed, 16 Jun 2010 05:38:46 -0600</pubDate>
    <lastBuildDate>Wed, 16 Jun 2010 05:38:46 -0600</lastBuildDate>
    <category>2008 Reports</category>
    <generator>Phorum 5.1.22</generator>
    <ttl>600</ttl>
    <item>
      <title>Re: Happy New Year</title>
      <link>http://eprint.iacr.org/forum/read.php?8,68,260#msg-260</link>
      <author>sohail</author>
      <description><![CDATA[Hi friends, I am first time here and really found ti good by all means, Infact the topic is good to read and and sending this page to my other firends because they are always asking me for the good resources to read out]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,68,260#msg-260</guid>
      <pubDate>Wed, 16 Jun 2010 05:38:46 -0600</pubDate>
    </item>
    <item>
      <title>Question on Güneysu &amp; Paar's DSP based fast modular reduction unit</title>
      <link>http://eprint.iacr.org/forum/read.php?8,250,250#msg-250</link>
      <author>Artur</author>
      <description><![CDATA[This questions concerns the paper &quot;Ultra High Performance ECC over NIST Primes on Commercial FPGAs&quot; from CHES 2008.

Güneysu uses the reduction algorithm of Solinas for NIST (generalized Mersenne) primes P-224 and P-256 in his algorithm listings 1 and 2. In figure 5 he displays a digital circuit block diagram of the reduction chain implementing the fast modular reduction step. While Güneysu clearly implies that the diagram is meant only to show the &quot;general structure&quot; of a DSP based fast reduction circuit, it is not clear to me at all how to implement the circuit, say, for P-224.

Does anyone know the configuration of the DSPs? E.g., how do we determine when to reset and accumulate and also how do we know when and where to add in the various c_i's. (I.e., what are the mux select line configurations per cycle.) What about the carries from each 32-bit digit to the next?

Has anyone verified the results of this paper?

Best,
Artur]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,250,250#msg-250</guid>
      <pubDate>Thu, 06 May 2010 11:39:10 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,192#msg-192</link>
      <author>Vielhaber</author>
      <description><![CDATA[Visit my homepage 
http://www.hs-bremerhaven.de/Michael_Vielhaber.html
and check the paper 
http://www.hs-bremerhaven.de/Binaries/Binary10017/AIDA_Shamir.pdf
to verify the following points:
1. Mathematically, both attacks are the same.
(this *alone* makes the renaming of AIDA into &quot;cube&quot; a plagiarism)
2. Precisely, by the above mentioned citation, Dinur and Shamir reveal that they understood my attack. The &quot;special&quot; case of having &quot;some key bit or to the sum of two key bits&quot; applies in praxi as well to D./Sh.'s findings. My paper treats, of course, also the general case of many linear or even quadratic terms.
3. The main difference between the AIDA paper and the &quot;cube attack&quot; paper seem to be the faster linearity tests. These are implementation details, to be distinguished sharply from the actual attack itself.
Also, real attacks require *lots* of hypercubes to be searched. Here, the &quot;Wavefront Model&quot; and applying the Fast-Reed-Muller Transform are mandatory, BLR alone does not help. See my paper &quot;Speeding up AIDA, the Algebraic IV DIfferential Attack, by the Fast Reed-Muller Transform&quot; in Proc. ISKE 2009, p.504-513.

* * * * * * * 

He who steals a car, is a thief. 
He, who then repaints it, puts on bigger tyres, and more comfortable seats, does not become the owner.

The fact that such thief already had a Rolls-Royce (RSA) and a Mercedes (DCA) in his garage (both partly owned)  would not make the &quot;taking&quot; of the new car any more legal. 

And, finally, applause for such action by by-standers blinded by the sheer beauty of the Rolls is less a sign for acquired legality but more for the perverted thinking going on in todays Crypto &quot;community&quot;.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,192#msg-192</guid>
      <pubDate>Wed, 16 Dec 2009 05:54:33 -0700</pubDate>
    </item>
    <item>
      <title>The EF-CMA case</title>
      <link>http://eprint.iacr.org/forum/read.php?8,170,170#msg-170</link>
      <author>jrf</author>
      <description><![CDATA[I was wondering whether the exclusion and penalty-style definitions of EF-CMA security for digital signature schemes are equivalent or not?]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,170,170#msg-170</guid>
      <pubDate>Thu, 08 Oct 2009 17:17:12 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,139#msg-139</link>
      <author>mike365</author>
      <description><![CDATA[Skeptic Wrote:
-------------------------------------------------------
&gt; I read your article before the introduction of the
&gt; cube attack by Shamir. It is very interesting, but
&gt; it lacks one thing.
&gt; 
&gt; The main difference is that your article doesn't
&gt; clearly state how to check the linearity of the
&gt; function obtained after applying the summing. 
&gt; 
&gt; At the other side,the &quot;momomial degree test&quot;
&gt; introduced by Khazaei, tests the linearity without
&gt; identifying the linear form.
&gt; 
&gt; Shamir made the synthesis.
&gt; 
&gt; After reading your article I was able to check
&gt; exhaustively by testing each key bit for a given
&gt; summing set if k_i= \sum_IV Cipher(X). The cube
&gt; attack is more effective, first find a linear
&gt; form, then identify it. Maybe was it trivial for
&gt; you, not for the reader.


I agree]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,139#msg-139</guid>
      <pubDate>Fri, 17 Jul 2009 11:22:44 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,86#msg-86</link>
      <author>Vielhaber</author>
      <description><![CDATA[@Skeptic:
Maybe, we should continue by eMail: vielhaber At gmail.com

First, the forms are *always* sparse, when linear
(see my forthcoming paper)

Anyway, you will identify ANY linear form in 81+ simulations:
You may use any random key and get the hypercube sum, 0 or 1. Repeat this 81+ times, and you get a system of 81 equations in 81 unknowns c_0,c_1..c_80 in {0,1}.

You pretend \sum_i=0..80 c_i k_i = hypercube sum (with &quot;k_0&quot;=1, the constant term), where the k_i of each simulation fill one row of the matrix (A), the result is the corresponding right hand side (b).

So, you can resolve Ac=b -&gt; c=A^(-1)b (Gauss) and obtain the c_i, hence the precise linear form (which you should certainly check against more keys),
else you get a contradiction, ergo not linear.

See you in Cologne?]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,86#msg-86</guid>
      <pubDate>Tue, 21 Apr 2009 09:34:47 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,85#msg-85</link>
      <author>Skeptic</author>
      <description><![CDATA[OK, for sparse equations but in a more general way, if a particular unique non sparse linear form exist for random coefficients,the AIDA dont find it.

For what I understood AIDA is:
-choose IV set
-make the summing
-test for K_i= 1 to 80 if Ki=form
While Cube attack is
-chooseIV set
-make the summing
-test the linearity
-if OK identify implied variables
-identify linear form


For example if there is a unique  linear form of 40 non null coefficients of the key, you have Binomial(80,40) linear forms to test exhaustively with AIDA, while with cube attack its only 40. This is not linear gain.

But in Trivium, Forms are sparse so AIDA~Cube in this case.

This is an example where AIDA fails, and Cube attack succeeds :

-take the original trivium specification
-replace the key/iv copy by a linear introduction with some LFSR  to mix the key terms a large number of times.

Now the forms in ANF are non sparse.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,85#msg-85</guid>
      <pubDate>Tue, 21 Apr 2009 03:22:08 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,84#msg-84</link>
      <author>Vielhaber</author>
      <description><![CDATA[@Skeptic:

You certainly may do linear algebra and get away with 80+\varepsilon, on average 81, simulations (given that Trivium has 80 key bits).

BLR, as described by D&amp;S, requires 4 simulations per 1 BLR test, and with 2 BLR tests on average, you need 8 simulations instead of 81.

This accelerates the SAME attack by a factor of 10.
This is nice, CPU-time-wise.

This does not constitute a novel attack though.

Had they called the paper &quot;Fast implementation of AIDA&quot;, my heartfelt congratulations. 
As it is, it is plagiarism.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,84#msg-84</guid>
      <pubDate>Mon, 20 Apr 2009 14:08:19 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,83#msg-83</link>
      <author>Skeptic</author>
      <description><![CDATA[I read your article before the introduction of the cube attack by Shamir. It is very interesting, but it lacks one thing.

The main difference is that your article doesn't clearly state how to check the linearity of the function obtained after applying the summing. 

At the other side,the &quot;momomial degree test&quot; introduced by Khazaei, tests the linearity without identifying the linear form.

Shamir made the synthesis.

After reading your article I was able to check exhaustively by testing each key bit for a given summing set if k_i= \sum_IV Cipher(X). The cube attack is more effective, first find a linear form, then identify it. Maybe was it trivial for you, not for the reader.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,83#msg-83</guid>
      <pubDate>Thu, 16 Apr 2009 08:10:29 -0600</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack !!!!!!!!!!!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,75#msg-75</link>
      <author>Vielhaber</author>
      <description><![CDATA[Shamir's &quot;cube attack&quot;: A plagiarism of AIDA

has been submitted to (*this) (pr)eprint server and is available at 
http://www.hs-bremerhaven.de/Michael_Vielhaber.html



@Luo Lan: I agree.

@ ciphergoth: This is Orwellian Newspeak. By induction the first N papers on anything do not matter, just anticipating the N+1st, \forall N in N]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,75#msg-75</guid>
      <pubDate>Sat, 28 Feb 2009 13:08:43 -0700</pubDate>
    </item>
    <item>
      <title>Padding</title>
      <link>http://eprint.iacr.org/forum/read.php?8,71,71#msg-71</link>
      <author>jungk</author>
      <description><![CDATA[I found this interesting paper (http://eprint.iacr.org/2008/529.pdf), while trying to implement one of the SHA-3 candidates. In contrast to the presented implementation, my implementation will have the padding ability.

While I tried to figure out the workings of the described hardware interface, I came to the conclusion, that it's not possible to implement a working padding function.

Consider the following example:

- The world length is set to 32 bits
- The input to the hashing algorithm is of arbitrary length

There are two possibilites:

- The input is a multiple of 32 bits long
- The input is _not_ a multiple of 32 bits long

The padding function can work with input lengths, which are a multiple of 32 bits. If this is not the case, however, the padding function has no way of detecting the exact message length with the data provided by the proposed interface. Therefore the implementation is unable to pad the message.

Have I missed anything?]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,71,71#msg-71</guid>
      <pubDate>Wed, 21 Jan 2009 12:28:24 -0700</pubDate>
    </item>
    <item>
      <title>Re: Happy New Year</title>
      <link>http://eprint.iacr.org/forum/read.php?8,68,69#msg-69</link>
      <author>annisa</author>
      <description><![CDATA[hoppefully, this year will be better than last year...]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,68,69#msg-69</guid>
      <pubDate>Thu, 15 Jan 2009 02:21:51 -0700</pubDate>
    </item>
    <item>
      <title>Happy New Year</title>
      <link>http://eprint.iacr.org/forum/read.php?8,68,68#msg-68</link>
      <author>luolan</author>
      <description><![CDATA[Happy New Year.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,68,68#msg-68</guid>
      <pubDate>Thu, 01 Jan 2009 05:50:51 -0700</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! (?)</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,67#msg-67</link>
      <author>luolan</author>
      <description><![CDATA[It's hot. In Chinese ºÃÈÈÄÖ¡£]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,67#msg-67</guid>
      <pubDate>Sat, 06 Dec 2008 01:56:39 -0700</pubDate>
    </item>
    <item>
      <title>Re: Shamir's Cube attack == My AIDA attack ! (?)</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,66#msg-66</link>
      <author>ciphergoth</author>
      <description><![CDATA[The Cube attack authors acknowlege your anticipation of the attack in the linked paper:

&quot;Vielhaber [27] recovered 47 key bits of Trivium with 576 initialization rounds in negligible time. The  key bits were recovered after some small IV special subsets were found, each one with the following property: The result of summing on some keystream bit produced by assigning a special subset all possible IV values, while keeping the other IV bits fixed, is equal to some key bit or to the sum of two key bits. Note that this is a very special case of our cube attack, and it is not clear why the author imposed this unnecessary restriction.&quot;

Could you clarify more on what remains unsolved?  The linked paper describes a variety of &quot;black-box&quot; techniques for finding those linear parts in section 4.2.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,66#msg-66</guid>
      <pubDate>Thu, 04 Dec 2008 08:08:37 -0700</pubDate>
    </item>
    <item>
      <title>2008/443 &quot;how to break TRIVIUM&quot;: does this attack work?</title>
      <link>http://eprint.iacr.org/forum/read.php?8,65,65#msg-65</link>
      <author>ciphergoth</author>
      <description><![CDATA[I've had a quick flick through this paper but I can't quite grasp the attack.  In particular I can't see whether the attack is asserted to work no matter how many initialization rounds Trivium uses or whether it is shown to use too few.  Can anyone shed any light?  Cheers!]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,65,65#msg-65</guid>
      <pubDate>Fri, 28 Nov 2008 04:29:11 -0700</pubDate>
    </item>
    <item>
      <title>intelligent block ciphers</title>
      <link>http://eprint.iacr.org/forum/read.php?8,64,64#msg-64</link>
      <author>luolan</author>
      <description><![CDATA[Block ciphers can be used as stream ciphers and hash functions. So there should have more standards and patents for block ciphers in different environments.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,64,64#msg-64</guid>
      <pubDate>Sat, 08 Nov 2008 04:48:41 -0700</pubDate>
    </item>
    <item>
      <title>Thanks for your paper 2008/405</title>
      <link>http://eprint.iacr.org/forum/read.php?8,63,63#msg-63</link>
      <author>luolan</author>
      <description><![CDATA[Beautiful paper and powerful result. And I think B. Preneel should have known such kind attack because I read his only 2 pages collision attack paper before. Maybe slide attack is better than slid attack:)]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,63,63#msg-63</guid>
      <pubDate>Thu, 23 Oct 2008 07:03:26 -0600</pubDate>
    </item>
    <item>
      <title>Re: 2008/409 (fast secret sharing): Am I missing something?</title>
      <link>http://eprint.iacr.org/forum/read.php?8,61,62#msg-62</link>
      <author>luolan</author>
      <description><![CDATA[What is about Financial Cryptography and Data Security 2008? As if this conference is not belong to IACR. IACR should include financial cryptography. And there are a lot of companies such as Boeing and Trusted Computing Group need cryptography research. So why don't you  cooperate with them ? -------I often read your online papers by free and there are seldom their papers.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,61,62#msg-62</guid>
      <pubDate>Sun, 19 Oct 2008 00:58:54 -0600</pubDate>
    </item>
    <item>
      <title>2008/409 (fast secret sharing): Am I missing something?</title>
      <link>http://eprint.iacr.org/forum/read.php?8,61,61#msg-61</link>
      <author>mdw</author>
      <description><![CDATA[I didn't read this paper very closely, but something seems catastrophically wrong, particularly with the authors' claimed speed for Shamir sharing.

The authors claimed that they tested the sharing systems on secrets of 4.5MB in length; their graph shows Shamir's scheme as taking about a hundred seconds for each individual operation.

I've just thrown together a script in Python, using my own (quite old) implementation of Shamir's scheme.  The program generates a 4.5MB random string, and shares and reconstructs it once for each set of parameters they tested.  The whole program, random number generation (I used RC4), splitting, joining, and all, for all six parameter sets, finishes in 20s on my aging 2.6GHz Pentium 4 machine.

I can now add (quick and dirty) timing to my program, calling the clock(3) function to count CPU seconds.  (This is Linux; it counts in centiseconds.)  Secret recombination is always too fast to measure; I'll round everything up.  Splitting takes up to 6cs -- a bit over a twentieth of a second (this happens when creating 109 shares; their program takes a second to do this).  The whole thing, not counting random number generation, takes 28cs.

Admittedly, I'm not using SSSS, and I'm not using 128 byte chunks.  But why would I?  Doing bignum maths here is crazy.  Each individual byte is shared separately and independently, using Shamir in GF(2^8).  I use discrete log() and exp() tables, and XOR.  This is still just as secure (unless you have enough shares, each secret byte is uniform and independent of your view).

This wasn't my idea.  I got it from shsecret.c, written by David Madore, and placed by him into the public domain: .  Others have come up with the same idea elsewhere, I believe independently.

The implementation is my own, though, and I used a standard polynomial basis for GF(2^8) rather than the Conway multiplication that David used (not that it matters when you're just doing table lookups).

So: my old implementation (written in 2000, according to my revision control system, with a few cosmetic changes since) of Shamir's sharing system seems to knock the pants of Kurihara et al's shiny new one.

What's going on here?  Where did the idea come from that Shamir is slow?]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,61,61#msg-61</guid>
      <pubDate>Thu, 02 Oct 2008 12:56:51 -0600</pubDate>
    </item>
    <item>
      <title>2008/391:  Could The 1-MSB Input Difference Be The Fastest Collision Attack For MD5 ?</title>
      <link>http://eprint.iacr.org/forum/read.php?8,60,60#msg-60</link>
      <author>jiri.vabek</author>
      <description><![CDATA[Hello,

we have some comments on the paper:

- the complexities are computed incorrectly - on the p. 14, the factor 47/64 should be placed in this way: (2^{29})x(47/64), the same mistake on p. 15. It changes the complexity values dramatically - you have 29 conditions with prob. 1/2, so you have to make about (2^{29})x(number of steps)

- the collision search with aproximatelly same speed (within few second) was already implemented for original Wang path - see Mark Stevens master thesis on his webpage. 
 
- also the description of automated differential path construction algorithm was published in Mark Stevens master thesis or even in his paper from Eurocrypt 2007, which is in the references

- previous two point gives also insight to the problematics of the conditions on IV for the second block 

- possibility of other 3-bit input differences were already published in &quot;Jun Yajima, Takeshi Shimoyama, Yu Sasaki, Yusuke Naito, Noboru Kunihiro, Kazuo Ohta - How to construct a differential path of MD5 for collision search, SCIS 2006, 2006.&quot;

- we suggest to use the notation of BSDR, then it wouldn'n be necessary to prove the facts from section 2

- also the collision search algorithm with divide and conquer technique is basically the same algorithm using tunneling (e.g. steps 9 and 10 are exactly the tunnels T(Q_4,m_4) and T(Q_9,m_9) - in Stevens notation)

- you can further improve the step 11 in algorithm for the first block using &quot;early stop&quot; technique.

- we have constructed 2-block collision with one of the 3-bit input differences (m_2,m_9,m_12), the paper was recently accepted to Indocrypt 2008


Jiri Vabek and Daniel Joscak]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,60,60#msg-60</guid>
      <pubDate>Mon, 29 Sep 2008 10:42:07 -0600</pubDate>
    </item>
    <item>
      <title>Shamir's Cube attack == My AIDA attack ! !!!</title>
      <link>http://eprint.iacr.org/forum/read.php?8,59,59#msg-59</link>
      <author>Vielhaber</author>
      <description><![CDATA[The so-called &quot;Cube attack&quot; 

http://eprint.iacr.org/2008/385

is precisely the AIDA attack presented by myself in 2007 at

http://eprint.iacr.org/2007/413

([27] in Dinur/Shamir)

Maybe, this paper is a bit of help to understand the AIDA/Cube attack. Please note that the ENF I &quot;introduced&quot; there is just the ANF.

What remains unsolved, and also by Dinur/Shamir, is how to find some linear (in the key vars) parts of the full ANF (algebraic normal form) in some poly-bounded time.
This is what I call Phase A, and which takes &quot;several weeks&quot; also with D/S, (Sect. 7.3, l. 3).

Lexicon:

AIDA == Cube
t: on p.2, l.2 == C_I, with I={i_1,..,i_n}
Prop. 3  == Thm. 1
Prop. 3  == Thm. 2 (equivalent to Thm 1 with C_I replaced by C_I union {x_j})
Table p.5 (for t &gt;= 625),  last l. of Sect 7. (for t=640)  == Tables 1,2 (for t &gt;= 672, 770, resp.)

Although I am proud and happy to have anticipated Adi Shamir by almost a year, this is just a plagiarism, and the attack should be called Algebraic IV Differential Attack, or AIDA for short, like the opera.

Comments, please!]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,59,59#msg-59</guid>
      <pubDate>Thu, 18 Sep 2008 04:08:27 -0600</pubDate>
    </item>
    <item>
      <title>about  2008/296</title>
      <link>http://eprint.iacr.org/forum/read.php?8,58,58#msg-58</link>
      <author>zhaoyaodong</author>
      <description><![CDATA[The authors studied the small private-key attacks of LSBS-RSA in the paper. They suspected there are some errors in the Zhao-Qi attack reported in [25]. 

But the error they pointed in the paper does not exist in the Zhao-Qi attack. In fact, in the Zhao-Qi attack, that they ignored the factor &quot;a&quot; will not lead to error.

Because in [25], they assumed that the publice key e was an odd number, so a^{-1} existed. Let u_{i} be a positive number that satisfied a^{-i}*a-u_{i}*e^m=1. They use the coeffient vectors of the ploynomial a^(-i)f(xX,yY,zZ)-u_{i}*e^m*I/(a^t) to build the lattice in order to eliminate the factor &quot;a&quot; in the terms in the diagonal of the matrix, where I is the term in the diagonal of the matrix of the polynomial f(xX, yY, zZ). It is obvious that a^(-i)f(x_0,y_0,z_0)-u_{i}*e^m*I/(a^t) mod e^m =0, where (x_0, y_0, z_0) is the small root they want to get. So using LLL-algorithm to the Zhao-Qi's lattice, the polynomials they get h1(x, y, z), h2(x, y, z) will still satisfy h1(x_0, y_0, z_0)= h2(x_0, y_0, z_0)=0 mod e^m. This technique decreases the det(L) which leads to a larger bound of the attack. I think this technique is very simple, so it is ignored in Zhao's work.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,58,58#msg-58</guid>
      <pubDate>Wed, 30 Jul 2008 18:08:48 -0600</pubDate>
    </item>
    <item>
      <title>Birthday attack of DES: clearity of step 2 of 4</title>
      <link>http://eprint.iacr.org/forum/read.php?8,57,57#msg-57</link>
      <author>prasanth.thandra</author>
      <description><![CDATA[.. I hope you can help me in understanding your paper.

 

in the description of attack, in step 2 (of 4) computing the candidate for each K16[j],

 

 

S[j](EL16[j]XORa)=?S[j](EL'16[j]XORa) ---------(1)
                                                        has to be checked out forall j belongd to the set{1,2,3,4,5,6,7,8} and where &quot;a&quot; belongs to the set{0,1,2,3....63}

also, clearly EL16[ j ] NOT = EL'16[ j ]:

dose the above statement means

by changing the values of &quot;a&quot; for each S-box we have to check whether LHS of (1) are equal to RHS or not 

If LHS=RHS that particular choice of K16[j] is correct;

If such equality of LHS and RHS are not found with any possibility of &quot;a&quot;, then that choice of Ciphertext pairs has to be neglected and 

new pair of Cipher texts has to be chosen to implement.


is the above explenation to step2 of 4 is correct or not ???????????????

Thanking you.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,57,57#msg-57</guid>
      <pubDate>Fri, 18 Jul 2008 01:45:32 -0600</pubDate>
    </item>
    <item>
      <title>a request</title>
      <link>http://eprint.iacr.org/forum/read.php?8,56,56#msg-56</link>
      <author>fatima</author>
      <description><![CDATA[I have a secure index that I want to prove its security. May some one help me and introduce me some good reference to read?

Thanks in advance]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,56,56#msg-56</guid>
      <pubDate>Sat, 05 Jul 2008 00:16:56 -0600</pubDate>
    </item>
    <item>
      <title>a question about &quot;secure index paper&quot; bye GOH</title>
      <link>http://eprint.iacr.org/forum/read.php?8,55,55#msg-55</link>
      <author>fatima</author>
      <description><![CDATA[I want a question about its security proof. What does &quot;q&quot; mean when we want to prove a method is (t,e,q)-secure.
and in the theorem 3.2 in this paper GOH has PROVE that if f is a (t, e, q)-psedo-random function, then z-idx is a (t, e, q/2)-IND_CKA index. How can we calculate q/2 ?
why is it q/2 ? Why is not is q ?]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,55,55#msg-55</guid>
      <pubDate>Sat, 05 Jul 2008 00:13:56 -0600</pubDate>
    </item>
    <item>
      <title>Re: 2008/128:  A Chosen IV Attack Using Phase Shifting Equivalent Keys against DECIM v2</title>
      <link>http://eprint.iacr.org/forum/read.php?8,48,53#msg-53</link>
      <author>Tib</author>
      <description><![CDATA[The note http://eprint.iacr.org/2008/169 has been updated to reflect the changes in Report 2008/128.
Namely:
- after taking into account the behavior of the ABSG in the right manner, the authors claim 2^79.90 time complexity,
- the same problems remain in essence:
* the complexity of the algorithm is at least 2^79.90 multiplied by (768 rounds + some keystream generation + more keystream generation in the case of phase-shifted keys),
* despite the comments above, the revised version of Report 2008/128 does not detail the algorithm more than the previous version; this prevents computing the real complexity of the algorithm to verify the claim precisely,
- all the comments and conclusions from the previous version of the note on phase-shifting-based attacks remain valid; the update encompasses only the description of Report 2008/128, which has been modified to take the revision into account.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,48,53#msg-53</guid>
      <pubDate>Thu, 17 Apr 2008 02:01:05 -0600</pubDate>
    </item>
    <item>
      <title>Re: 2008/128:  A Chosen IV Attack Using Phase Shifting Equivalent Keys against DECIM v2</title>
      <link>http://eprint.iacr.org/forum/read.php?8,48,52#msg-52</link>
      <author>Tib</author>
      <description><![CDATA[The note is available here: http://eprint.iacr.org/2008/169.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,48,52#msg-52</guid>
      <pubDate>Tue, 15 Apr 2008 14:58:43 -0600</pubDate>
    </item>
    <item>
      <title>Re: 2008/128:  A Chosen IV Attack Using Phase Shifting Equivalent Keys against DECIM v2</title>
      <link>http://eprint.iacr.org/forum/read.php?8,48,51#msg-51</link>
      <author>Merlin.7</author>
      <description><![CDATA[Regarding the alleged attack in the paper &quot;A Chosen IV Attack Using Phase Shifting Equivalent Keys against DECIM v2&quot;, we have just submitted a note called &quot;Understanding Phase Shifting Equivalent Keys and Exhaustive Search&quot; to the eprint archive.

The note shows that this type of attack, from a general perspective, always has a time complexity at least $2^n$ updates of the cipher state, with $n$ being the length of the key. The erroneous result in the paper above stems from the fact that the authors forgot to include the initialization time in their computation, so one should read that their attack has complexity $O(2^{79.56})$, not $2^{79.56}$.

In a nutshell, what we prove in our note is that, considering a single operation to be one update of the cipher state, the constant in the $O(2^{m})$ attack complexity is always at least $2^{n-m}$. This type of attack can be used to speed up exhaustive search by &quot;parallelizing&quot; partly the search for multiple keys at once. However, there is an overhead for each parallelized key, which is always at least the computational cost of one additional update of the internal state, hence the result that such &quot;attacks&quot; always require at least the computation of $2^n$ updates of the internal state.

Please note that our result also invalidates the claims made by the authors in the introduction about the fact that another eSTREAM algorithm, Grain, fails under a similar attack better of complexity $2^{78.4}$ or $2^{78.7}$. Here again, the authors did not include the computational cost per tested key.

As a result, these attacks against both Decim v2 and Grain have a complexity that remains well over $2^80$, as these complexities shall be multiplied by a bit more than the complexity of one initialization of the cipher. Even in the case of a cipher with 80-bits keys to which these attacks would apply ideally (e.g. where the initialization and keystream generation steps are the same), these attacks could not reach less than $2^{80}$.

At last, please note that the authors of the paper &quot;A Chosen IV Attack Using Phase Shifting Equivalent Keys against DECIM v2&quot; are currently reconsidering their attack and the evaluation of the time complexity of their attack after the authors of this note pointed out (in the post above) a misunderstanding of the Decim v2 scheme. We thus expect a revised version to take into account this note and the comments above.]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,48,51#msg-51</guid>
      <pubDate>Tue, 15 Apr 2008 10:13:54 -0600</pubDate>
    </item>
    <item>
      <title>Re: A general suggestion</title>
      <link>http://eprint.iacr.org/forum/read.php?8,47,49#msg-49</link>
      <author>eprint-forum-admin</author>
      <description><![CDATA[We are aware of this, but have not taken any steps
to further integration because the forum and the
archive run on different database systems.

Thank you for the suggestion.

  Christian Cachin]]></description>
      <category>2008 Reports</category>
      <guid isPermaLink="true">http://eprint.iacr.org/forum/read.php?8,47,49#msg-49</guid>
      <pubDate>Sun, 13 Apr 2008 02:04:08 -0600</pubDate>
    </item>
  </channel>
</rss>
