%& latex
\documentstyle{article}
\voffset = -1cm \hoffset = -2cm  \vsize = 22cm \textwidth 160mm \textheight 220mm
\font\BBb=msbm10

%
% generate the index, comment out if not required
%
\makeindex

%
% Mathematical functions and symbols
%
\def\deg{\mathop{\rm deg}\nolimits}
\def\min{\mathop{\rm min}\nolimits}
\def\max{\mathop{\rm max}\nolimits}
\def\mod{\mathop{\rm mod}\nolimits}
\def\Z{\mbox{\BBb Z}}
\def\N{\mbox{\BBb N}}
\def\R{\mbox{\BBb R}}
\def\F{\mbox{\BBb F}}
\def\st{:}
\def\BB{\mbox{$\bullet$}}

%
% Abstracting abbreviations
%
\newcounter{entry}
\def\T#1{\addtocounter{entry}{1}{\par\subsection*{#1}}}
\def\A#1{{{\em #1\index{#1}.\ }}}
\def\E#1{{{\em #1\index{#1} (ed.).\ }}}
\def\J#1{{\par\vspace {0.2cm}\noindent{#1}}}
\def\D#1{({#1})}
\def\X#1{{\par\vspace {0.2cm}\noindent #1}}

\title{Abstracts in Cryptology: 1980s\\ Volume~IX, Release 2}
\author{Sean A. Irvine\\ Electronic mail: {\tt sirvine@waikato.ac.nz}}
\date{\today}

\begin{document}
\small
\maketitle

\begin{abstract}
This volume of {\sl Abstracts in Cryptology\/} contains references and abstracts for the cryptologic literature for the years 1980 through 1989. Other volumes cover different decades. The purpose of the document is aid the location of relevant cryptologic literature.
\end{abstract}

\subsection*{Preface}

This is Volume~IX, Release 2, of the {\sl Abstracts in Cryptology.} This release contains approximately one thousand abstracts and references to books, papers, articles, technical reports, letters, and other literature pertaining to cryptology. The core references deal with secrecy, authentication, cryptanalysis, protocol, and so on. Other subjects having some coverage include random number generation, number theory (factoring and primality testing), zero-knowledge proofs, data compression, and complexity theory. I believe that all works referenced are publicly available.

Other volumes covering different decades are also available, but are not as complete as the current volume. Volume~I covers literature prior to 1900, Volume~II covers 1900--1919, Volume~III cover 1920--1929, Volume~IV covers 1930--1939, Volume~V covers 1940--1949, Volume~VI covers 1950--1959, Volume~VII covers 1960--1969, Volume~VIII covers 1970--1979, Volume~IX covers 1980--1989, Volume~X covers 1990--1994, and Volume~XI covers 1995--1999.

I regret that I am unable to supply copies of works referenced, nor can I specify where individual works may be obtained. Most of the books referenced should be available from a university or large public library. Most of the journal articles can be obtained by the interloan services of a library. The technical reports can usually obtained by directly contacting the author or institution concerned. Many of the technical reports from 1985 onwards are available on-line using the World-Wide-Web, gopher, and ftp systems.

Some journals are not covered very well in this release: notable omissions are {\em Cryptologia\/} and the {\em Journal of Cryptology.} If somebody with access to these journals can send me abstracts for the papers in them I will include them in the document for the next release.

If you know of any relevant document not listed here please send me the title, author, and journal or publisher, and if possible send an abstract. I am also happy to receive complete papers.

This document is designed to be printed using the \LaTeX\ typesetting system.

\vspace{1cm}

\noindent Sean Irvine.

\vspace{1cm}

{\obeylines Department of Mathematicss and Statistics
University of Waikato
Private Bag 3105
Hamilton
New Zealand.}

\subsection*{Abstracts}

\T {$2n$-Bit Hash-Functions Using $n$-Bit Symmetric Block Cipher Algorithms}
\A {Jean-Jacques Quisquater}
\A {Marc Girault}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We present a new hash-function, which provides $2n$-bit has-results, using any $n$-bit symmetric block cipher algorithm. This hash-function can be considered as a extension of an already known one, which only provided $n$-bit hash results. The difference is crucial, because a lot of symmetric block cipher algorithms use 64-bit blocks and recent works have shown that a 64-bit hash-result is greatly insufficient.}

\T {An Abstract Theory of Computer Viruses}
\A {Leonard M. Adleman}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {Abuses in Cryptography and How to Fight Them}
\A {Yvo Desmedt}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {The following seems quite familiar: ``Alice and Bob want to flip a coin by telephone. (They have just divorced, live in different {\em countries,} want to decide who will have the children during the next holiday.)...'' So they use a protocol. {\em However,} Alice and Bob's {\em divorce has been set up to cover up their spying activities.} When the use a protocol, they don't care if the ``coin-flip'' is random, but they want to {\em abuse the protocol\/} to send secret information to each other. The counter-espionage service, however, doesn't know that the divorce and the use of the protocol are just cover-ups. In this paper, we demonstrate how several modern crypto-systems can be abused. We generalize the subliminal channel and abuse of identification systems and demonstrate how one {\em can prevent abuses\/} of crypto-systems.}

\T {Access Control at the Netherlands Postal and Telecommunications Services}
\A {Willem Haemers}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {The Netherlands Postal and Telecommunications Services (PTT) have developed a system that controls the entrance to their buildings by use of magnetic stripe cards. In this note some cryptographic aspects of the system are explained.}

\T {Accuracy, Integrity and Security in Computerized Vote-Tallying}
\A {Roy G. Saltman}
\J {CACM {\bf 31,} 10}
\D {1988}
\X {Excerpts from an in-depth research report depict potential difficulties in the use of computerized vote-tallying. Recent legal cases point to claims of inaccuracies and fraud.}

\T {Addendum to ``Initializing Generalized Feedback Shift Register Pseudorandom
Number Generators}
\A {Bruce Jay Collings}
\A {G. Barry Hembree}
\J {J ACM {\bf 35,} 4}
\D {1988}

\T {Addition Chain Heuristics}
\A {Jurjen Bos}
\A {Matthijs Coster}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Addition to ``The Existence of Good Cryptosystems for Key Rates Greater Than the Message Redundancy''}
\A {Shyue-Ching Lu}
\J {IEEE Trans. on Info. Th. {\bf IT-26,} 1}
\D {1980}
\X {Three points related to a previous correspondence are reported here. Two new classes of cryptosystems are shown to share the property of additive-like instantaneous block (ALIB) ciphers; namely, good cryptosystems exist for key rates greater than the message redundancy. Furthermore, the optimality of the independence of the key and the message in a cryptosystem is established.}

\T {Alan Turing: The Enigma}
\A {Andrew Hodges}
\J {Burnett Books Ltd.}
\D {1983}

\T {Algebraical Structures of Cryptographic Transformations}
\A {J\'osef P. Pieprzyk}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {In the paper, application of idempotent elements to construction of cryptographic systems has been presented. The public key cryptosystem based on idempotent elements and the cryptographic transformation that preserves elementary arithmetic operations have been described.}

\T {Algebraic Coding Theory}
\A {E. R. Berlekamp}
\J {Aegean Park Press, Leguna Hills, CA}
\D {1984---previous edition 1968}

\T {Algorithmics: Theory and Practice}
\A {Gilles Brassard}
\A {Paul Bratley}
\J {Prentice-Hall International}
\D {1988}
\X {Algorithms, efficiency of algorithms, elementary operations, data structures, asymptotic notation, order notation, solving recurrences, greedy algorithms and heuristics, divide and conquer techniques, dynamic programming, exploring graphs, depth-first search, breadth-first search, preconditioning and precomputation, probabilistic algorithms, Monte Carlo algorithms, Sherwood algorithms, Las Vegas algorithms, complexity, discrete Fourier transform, NP-completeness.}

\T {Algorithms and Complexity}
\A {Herbert S. Wilf}
\J {Prentice-Hall}
\D {1986}
\X {Hard and easy problems, orders of magnitudes, positional number systems, series, recurrence relations, counting, graphs, recursive algorithms, quicksort, fast Fourier transform (FFT), network flow problem, Ford-Fulkerson algorithm, MPM algorithm, greatest common divisor, number theory, primality testing, pseudoprimality tests, factoring and cryptology, factoring large integers, NP-completeness, Cook's theorem, Turing machines, backtracking.}

\T {Algorithms for Adaptive Huffman Codes}
\A {G. V. Cormack}
\A {R. N. Horspool}
\J {Info. Proc. Letters {\bf 18,} 3}
\D {1984}

\T {Algorithms for Public Key Cryptosystems: Theory and Practice}
\A {S. Lakshmivarahan}
\J {Advances in Computers, {\bf 22}}
\D {1983}
\X {Cryptography: nature and scope, cryptanalysis, classical cryptosystems,
public key encryption systems, divisibility, congruences, primitive roots and
discrete logarithms, quadratic residues, prime factorization and primality
testing, finite fields, examples of public key cryptosystem, authentication,
digital signatures, read-only secure communications, conference key
distribution systems, data-base security.}

\T {An Algorithm for Uniform Vector Quantizer Design}
\A {Khalid Sayood}
\A {Jerry D. Gibson}
\A {Martin C. Rost}
\J {IEEE Trans. on Info. Th. {\bf IT-30,} 6}
\D {1984}
\X {A vector quantizer maps a $k$-dimensional vector into one of a finite set of output vectors or ``points''. Although certain lattices have been show to have desirable properties for vector quantization applications, there are as yet no algorithms available in the quantization literature for building quantizers based on these lattices. An algorithm for designing vecotr quantizers based on the root lattices $A_n,$ $D_n,$ and $E_n$ and their duals is presented. Also, a coding scheme that has general applicability to all vector quantizers is presented. A four-dimensional uniform vector quantizer is used to encode Laplacian and gamma-distributed sources at entropy rates of one and two bits / sample and is demonstrated to achieve performance that compares favourable with the rate distortion bound and other scalar and vector quantizers. Finally, an application using uniform four- and eight-dimensional vector quantizers for encoding the discrete cosine transform coefficeints of an image at 0.5 bit / pel is presented, which visibly illustrates the performance advantage of vector quantization over scalar quantization.}

\T {All-or-Nothing Disclosure of Secrets}
\A {Gilles Brassard}
\A {Claude Cr\'epeau}
\A {Jean-Marc Robert}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Almost All Primes Can be Quickly Certified}
\A {Shafi Goldwasser}
\A {Joe Kilian}
\J {Proc. of the 18th Annual ACM Symp. of Theory of Computing}
\D {1986}
\X {This paper presents a new probabilistic primality test. Upon termination the test outputs ``composite'' or ``prime'', along with a short proof of correctness, which can be verified in deterministic polynomial time. The test is different from the tests of Miller, Solovay-Strassen, and Rabin in that its assertions of primality are certain, rather than being correct with high probability or dependent on an unproven assumption. The test terminates in expected polynomial time on all but at most an exponentially vanishing fraction of the inputs of length $k,$ for every $k.$ This result implies: (1) There exist an infinite set of primes which can be recognized in expected polynomial time. (2) Large certified primes can be generated in expected polynomial time. Under a very plausible condition on the distribution of primes in ``small'' intervals, the proposed algorithm can be shown to run in expected polynomial time on {\bf every input.} This condition is implied by Cramer's conjecture. The methods employed are from the theory of elliptic curves over finite fields.}

\T {Alternating Step Generators Controlled By de Bruijn Sequences}
\A {C. G. G\"unther}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {The alternating step generator (ASG) is a new generator of pseudorandom sequences which is closely related to the stop-and-go generator. It shares all the good properties of this latter generator without possessing its weakness. The ASG consists of three subgenerators $K, M,$ and $\overline{M}.$ The main characteristic of its structure is that the output of one of the subgenerators, $K,$ controls the clock of the two others, $M$ and $\overline{M}.$ In the present contribution, we determine the period, the distribution of short patterns and a lower bound for the linear complexity of the sequences generated by an ASG. The proof of the lower bound is greatly simplified by assuming that $K$ generates a de Bruijn sequence. Under this and other not very restrictive assumptions the period and the linear complexity are found to be proportional to the period of the de Bruijn sequence. Furthermore the frequency of all short patterns as well as the autocorrelation turn out to be ideal. This means that the sequences generated by the ASG are provably secure against the standard attacks.}

\T {An Alternative to the Fiat-Shamir Protocol}
\A {Jacques Stern}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In 1986, Fiat and Shamir exhibited zero-knowledge based identification and digital signature schemes. In these schemes, as well as in subsequent variants, both the prover and the verifier have to perform modular multiplications. This paper is an attempt to build identification protocols that use only very basic operations such as multiplication by a fixed matrix over the two-element field. Such a matrix can be viewed as the parity-check matrix of a linear binary error-correcting code. The idea of using error-correcting codes in this area is due to Harari but the method that is described here is both simpler and more secure than his original design.}

\T {American National Standard for Data Encryption Algorithm (DEA)}
\A {ANSI X3.92}
\J {American National Standards Institute}
\D {1981}

\T {American National Standard for Financial Institution Key Management}
\A {ANSI X9.17 (Revised)}
\J {American Bankers Association}
\D {1985}

\T {American National Standard for Financial Institution Message Authentication (Wholesale)}
\A {ANSI X9.9 (Revised)}
\J {American Bankers Association}
\D {1986}

\T {American National Standard for Financial Institution Message Encryption}
\A {ANSI X9.23}
\J {American Bankers Association}
\D {1988}

\T {American National Standard for Information Systems---Data Link Encryption}
\A {ANSI X3.105}
\J {American National Standards Institute}
\D {1983}

\T {American National Standard for Information Systems---Data Encryption Algorithm---Modes of Operation}
\A {ANSI X3.106}
\J {American National Standards Institute}
\D {1983}

\T {American National Standard for Personal Information Number (PIN) Management and Security}
\A {ANSI X9.8}
\J {American Bankers Association}
\D {1982}

\T {American National Standard for Retail Message Authentication}
\A {ANSI X9.19}
\J {American Bankers Association}
\D {1985}

\T {Analog Scrambling by the General Fast Fourier Transform}
\A {Franz Pichler}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Analogue Speech Security Systems}
\A {H. J. Beker}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Analysis of a Nonlinear Feedforward Logic For Binary Sequence Generators}
\A {J. Bernasconi}
\A {C. G. G\"unther}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {A new type of nonlinear feedforward logic for binary sequence generators is proposed, i.e. a logic that combines the stages of a linear feedback shift register (LFSR) in a nonlinear way. The sequences generated are analyzed with respect to their transient and ultimately periodic behaviour. They are shown to have a balanced zero-one distribution, and a lower bound on their linear complexity is derived which grows exponentially with the length of their LFSR.}

\T {Analysis of a Public Key Approach Based on Polynomial Substitution}
\A {Harriet Fell}
\A {Whitfield Diffie}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Analysis of Certain Aspects of Output Feedback Mode}
\A {R. R. Jueneman}
\J {Advances in Cryptology---CRYPTO '82, Plenum Press, pp. 99-127}
\D {1983}

\T {Analysis of Multiple Access Channel Using Multiple Level FSK}
\A {L\'aszl\'o Gy\H{o}rfi}
\A {Istv\'an Kerekes}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {For multiple level FSK systems of multiple user communication a model is considered containing independent parallel noisy OR channels. The error probability is calculated if a random block code and a majority type decoding rule is applied.}

\T {Analysis of the Encryption Algorithm Used in the WordPerfect Word Processing Program}
\A {John Bennett}
\J {Cryptologia {\bf 11,} 4, pp. 206--210}
\D {1987}

\T {Analysis of the Security and New Algorithms for Modern Industrial Cryptography}
\A {Y. Desmedt}
\J {Ph.D. Thesis, Katholieke Universiteit Leuven, Belgium}
\D {1984}

\T {Analytical Characteristics of the DES}
\A {M. Davio}
\A {Y. Desmedt}
\A {M. Fosseprez}
\A {R. Govaerts}
\A {J. Hulsbosch}
\A {P. Neutjens}
\A {P. Piret}
\A {J.-J. Quisquater}
\A {J. Vandewalle}
\J {Advances in Cryptology---CRYPTO `83, Proceedings, Plenum Press, pp. 171-202}
\D {1984}

\T {Analyzing Encryption Protocols Using Formal Verification Techniques}
\A {Richard A. Kemmerer}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Anonymous and Verifiable Registration in Databases}
\A {J\o rgen Brandt}
\A {Ivan Bjerre Damg{\aa}rd}
\A {Peter Landrock}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Methods are given by which personal data about a large number of individuals can be registered in a large central database without having to trust this register not to give away information linked to a given individual. Personal information arriving from many different sources can be placed correctly in the register. The registration is done in a verifiable way: Each individual can be given access to the register to check that his information is correct, and can even, if he chooses to do so, prove to anyone that he is or is not identical to a given person in the register. This can all be done without compromising the anonymity of any other individual.}

\T {Another Birthday Attack}
\A {Don Coppersmith}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {We show that a meet-in-the-middle attack can successfully defraud the Davies-Price message authentication scheme. Their scheme used message blocks in an iterated encipherment of an initial block, and it went through the message block twice, in order to prevent just such a ``birthday'' attack.}

\T {Another Cryptanalytic Attack On ``A Cryptosystem for Multiple
Communication''}
\A {M. E. Hellman}
\J {Info. Proc. Letter {\bf 12,} 4}
\D {1981}

\T {Another Data Insecurity Package}
\A {Martin Kochanski}
\J {Cryptologia {\bf 12,} 3, pp. 165--177}
\D {1988}

\T {Another Public-Key Distribution-System Based on Matrix-Rings}
\A {R. Xiao}
\J {Elec. Letters {\bf 24,} 4, pp. 233--234}
\D {1988}

\T {Aperiodic Linear Complexities of de~Bruijn Sequences}
\A {Richard T. C. Kwok}
\A {Maurice Beale}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {An Application of a Fast Data Encryption Standard Implementation}
\A {Matt Bishop}
\J {Dartmouth College Computer Science Technical Report PCS-TR88-138}
\D {1988}
\X {The Data Encryption Standard is used as the basis for the UNIX password encryption scheme.  Some of the security of that scheme depends on the speed of the implementation.  This paper presents a mathematical formulation 
of a fast implementation of the DES in software, discusses how the mathematics can be translated into code, and then analyzes the UNIX password scheme to show how these results can be used to implement it.  Experimental results are 
provided for several computers to show that the given method speeds up the computation of a password by roughly 20 times (depending on the specific computer).}

\T {The Application of Claw Free Functions in Cryptography: Unconditional Protection in Cryptographic Protocols}
\A {I. B. Damg{\aa}rd}
\J {Ph.D. Thesis, Mathematical Institute, Aarhus University, Aarhus, Denmark}
\D {1988}

\T {The Application of Smart Cards for RSA Digital Signatures in a Network Comprising Both Interactive and Store-And-Forward Facilities}
\A {J. R. Sherwood}
\A {V. A. Gallo}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Smart card technology is relatively new but offers an economic and convenient solution to the problems of user-authentication. This paper discusses the requirements for user authentication and digital signature in complex networks and examines the problems of integrating a smart-card sub-system. It proposes some design approaches for providing a useful lifetime for a smart card and for handling the computations required for 512-bit RSA digital signatures.}

\T {Approaches to Handling ``Trojan Horse'' Threats}
\A {Yeheskel Lapid}
\A {Niv Ahituv}
\A {Seev Neumann}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {This paper examines the exposure of an information system to an attack by a ``Trojan Horse'' and trapdoors. It outlines some new encryption-based mechanisms that can reduce risks and losses caused by such attacks. It proposes models exhibit the direction and nature of the solutions for the threats.}

\T {Arbitration in Tamper Proof Systems}
\A {George I. Davida}
\A {Brian J. Matt}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Given that tamperfree devices exist it is possible to construct true signature schemes that have the advantages of arbitrated signature schemes, protection against disavowing or forging messages, and lacking certain short comings. Other cryptographic protocols can also be improved. The contents of tamperfree devices cannot be examined as well as not modified.}

\T {Architectures for Exponentiation in $GF(2^n)$}
\A {T. Beth}
\A {B. M. Cook}
\A {D. Gollmann}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {We investigate different data structures in $GF(2^n)$ and their correspondence to silicon architectures to examine possible hardware implementations of the Diffie-Hellman key exchange system.}

\T {Are All Injective Knapsacks Partly Solvable After Multiplication Modulo $Q?$}
\A {Ingemar Ingemarsson}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {Extended abstract of Crypto'81 presentation.}

\T {Are Big S-Boxes Best?}
\A {J. A. Gordon}
\A {H. Retkin}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {Various probabilities of accidental linearaties occurring in a random, reversible substitution lookup table (S-box) with $m$ address and $m$ contents bits are calculated. These probabilities decrease very dramatically with increasing $m.$ It is conjectured that good S-boxes may be built by choosing a random, reversible table of sufficient size.}

\T {Are There Interactive Protocols for co-NP Languages}
\A {L. Fortnow}
\A {M. Sipser}
\J {Info. Proc. Letters {\bf 28,} 5}
\D {1988}

\T {Arithmetic of Finite Fields}
\A {B.-Z. Chor}
\J {Info. Proc. Letters {\bf 14,} 1}
\D {1982}

\T {Artificial Intelligence and Security: An Overview}
\A {Alan C. Schultz}
\J {AFIPS Conference Proceedings {\bf 56,} National Computer Conference}
\D {1987}
\X {The junction of AI and computer security is an area of increasing cocern,
due to the imminent application of AI to fielded systems. Two new area of
research need are identified: artificial intelligence techniques in the
development of secure systems and in analyzing the security characteristic of
software; and verification of the security of artificial intelligence. Current
and proposed research in these areas by the Department of Defense will be
discussed.}

\T {The Art of Computer Programming (2nd ed.)}
\A {D. E. Knuth}
\J {Addison-Wesley}
\D {1981}

\T {Aspects and Importance of Secure Implementations of Identification Systems}
\A {S. Bengio}
\A {G. Brassard}
\A {Y. Desmedt}
\A {C. Goutier}
\A {J.-J. Quisquater}
\J {Manuscript M209, Phillips Research Lab., Bruxelles, Belgium}
\D {1987}

\T {The Assault on Data-Security Is Getting a Lot of Attention}
\A {T. Manuel}
\J {Electronics {\bf 61,} 17, p. 136}
\D {1988}

\T {Atkin's Test: News From the Front}
\A {Fran\c cois Morain}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We make an attempt to compare the speed of some primality testing algorithms certifying 100-digit prime numbers.}

\T {An Attack on a Signature Scheme Proposed by Okamoto and Shiraishi}
\A {Ernest F. Brickell}
\A {John M. DeLaurentis}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {Recently Okamoto and Shiraishi proposed a public key authentication system. The security of the scheme is based on the difficulty of solving quadratic inequalities. This new system is interesting since the amount of computing needed for the proposed scheme is significantly less than that need for an RSA encryption. This report is an investigation into the security of the proposed digital signature scheme. We demonstrate that if the system is used as it is presented, an opponent could sign messages without factoring the modulus. Further, we suggest a modification which may not have the same flaw as the proposed scheme.}

\T {Attack on the Koyama-Ohta Identity Based Key Distribution Scheme}
\A {Yacov Yacobi}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Koyama and Ohta proposed an identity based key distribution scheme. They considered three configurations: ring, complete graph, and star. The most practical configuration is the star which is used in teleconferencing. We show the Koyama-Ohta star scheme to be insecure. Specifically, we show that an active eavesdropper may cut one of the lines, and perform a bidirectional impersonation, thus establishing two separate keys. One with each side.}

\T {Attacks On Some RSA Signatures}
\A {Wiebren {de Jonge}}
\A {David Chaum}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {Two simple redundancy schemes are shown to be inadequate in securing RSA signatures against attacks based on multiplicative properties. The schemes generalize the requirement that each valid message starts or ends with a fixed number of zero bits. Even though only messages with proper redundancy are signed, forgers are able to construct signatures on messages of their choice.}

\T {Audit and Security Implications of Electronic Funds Transfer}
\A {A. Kinnon}
\A {R. H. Davis}
\X {The problems created by the facilities of Electronic Funds Transfer are considered in relation to the role of auditors seeking to ensure that correct and secure operations occur when a computer takes over major record processing activities within an organization.}

\T {Authentication: A Concise Survey}
\A {G. M. J. Pluimakers}
\A {J. van Leeuwen}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {This article considers the problem of authenticating messages in applications in which senders and receivers communicate over unprotected channels. New techniques, e.g. from the area of public-key cryptography, have been devised to determine that messages indeed originate at the claimed source and have not been tampered with on the way. Included is an estimate of current developments in the theory of design and analysis of these techniques.}

\T {Authentication Codes with Multiple Arbiters}
\A {Ernest F. Brickell}
\A {Doug R. Stinson}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {An authentication system provides a means for a transmitter to send a message to a receiver so that the receiver is convinced that the message was sent by the transmitter and not by an opponent. Authentication codes provide a design for authentication systems which are unconditionally secure. Specifically, the codes provide a provable level of security which depends on the parameters of the code but which does not depend on any assumptions (for instance assumptions about the computational complexity of some problem). In 1987, Simmons introduced authentication codes that permit arbitration. These codes allow for an arbiter who can settle disputes between the transmitter and receiver. The disputes that an arbiter can resolve are that the receiver might claim to have received a certain message when in fact he didn't, or the transmitter might try to disavow a message that he actually sent. The arbiter cannot resolve a dispute in which the transmitter claims to have sent a message and the receiver claims that he did not receive a message. These systems are also unconditionally secure. One drawback to the system is that the transmitter and receiver must have complete trust in the arbiter, because an arbiter has the potential to cheat in many ways. In this paper, we show that by having multiple arbiters, the probability that a
ny individual arbiter can successfully cheat is greatly reduced.}

\T {Authentication of Signatures Using Public Key Encryption}
\A {Kellogg S. Booth}
\J {C ACM {\bf 24,} 11}
\D {1981}
\X {One of Needham and Schroeder's proposed signature authentication protocols
is shown to fail when there is a possibility of compromised keys: this
invalidates one of the applications of their technique. A more elaborate
mechanism is proposed which does not require a network clock, but does require
a third party to the transaction. The latter approach is shown to be reliable
in a fairly strong sense.}

\T {Authentication Procedures}
\A {M. Davio}
\A {J.-M. Goethals}
\A {J.-J. Quisquater}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {The purpose of this paper is to illustrate the use of one-way functions and public-key algorithms in some authentication procedures. Special emphasis is given to the problem of mutual authentication of a card and a point-of-sale terminal in an off-line situation.}

\T {Authentication Theory/Coding Theory}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {We consider a communications scenario in which a transmitter attempts to inform a remote receiver of the state of a source by sending messages through an imperfect communications channel. There are two fundamentally different ways in which the receiver can end up being misinformed. The channel may be noisy so that symbols in the transmitted message can be received in error, or the channel may be under the control of an opponent who can either deliberately modify legitimate messages or else introduce fraudulent ones to deceive the receiver, i.e., what Wyner has called an ``active wiretapper''. The device by which the receiver improves his chances of detecting error (deception) is the same in either case: the deliberate introduction of redundant information into the transmitted message. The way in which this redundant information is introduced and used, though, is diametrically opposite in the two cases.
For a statistically described noisy channel, coding theory is concerned with schemes (codes) that introduce redundancy in such a way that the most likely alterations to the encoded messages are in some sense close to the code they derive from. The receiver can then use a maximum likelihood detector to decide which (acceptable) message he should infer as having been transmitted from the (possibly altered) code that was received. In other words,the object in coding theory is to cluster the most likely alterations of an acceptable code as closely as possible (in an appropriate metric) to the code itself, and disjoint from the corresponding clusters about other acceptable codes. The present author showed that the problem of detecting either the deliberate modification of legitimate messages or the introduction of fraudulent messages; i.e.,
 of transmitter and digital message authentication, could be modeled in complete generality by replacing the classical noisy communications channel of coding theory with a game-theoretic noiseless channel in which an intelligent opponent, who knows the system can observe the channel, plays so as to optimize his chances of deceiving the receiver. To provide some degree of immunity to deception (of the receiver), the transmitter also introduces redundancy in this case, but does so in such a way that, for any message the transmitter may send, the altered messages that the opponent would introduce using his optimal strategy are spread randomly, i.e.m as uniformly as possible (again with respect to an appropriate metric) over the set of possible messages, $M.$ 
Authentication theory is concerned with devising and analyzing schemes (codes) to achieve this ``spreading.'' It is in this sense that coding theory and authentication theory are dual theories: one is concerned with clustering the most likely alterations so closely about the original code as possible and the other with spreading the optimal (to the opponent) alterations as uniformly as possible over $M.$ The probability that the receiver will be deceived by the opponent, $P_d$, can be bounded below by any of several expressions involving the entropy of the source $H(S),$ of the channel $H(M),$ of the encoding rules used by the transmitter to assign messages to states of the source $H(E),$ etc. For example: $$(1)\qquad\qquad\qquad\qquad\log P_d\ge H(MES) - H(E) - H(M)$$ The authentication system is said to be perfect if equality holds in (1), since in this case all of the information capacity of a transmitted message is used to either inform the receiver as to the state of the source or else to confound the opponent. In a sense, inequality (1) defines an authentication channel bound similar to the communication channel bounds of coding theory.
Constructions for perfect authentication systems are consequently of great interest since they fully realize the capacity of the authentication channel. In the paper given at Crypto 84 we analyzed several infinite families of perfect systems and also extended the channel bounds to include cases in which the opponent knew the state of the source. Here we have the more modest goal of rigorously deriving the channel bound (1) and then using this result to derive a family or related bounds.}

\T {Authorized Writing For ``Write-Once'' Memories}
\A {Philippe Godlewski}
\A {G\'erard D. Cohen}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {We describe a method for storing information on a ``write-once'' memory with the following feature: reading is easy, whereas writing is difficult, except for the designer.}

\T {Automated Cryptanalysis of Polyalphabetic Ciphers}
\A {John Carrol}
\A {Lynda Robbins}
\J {Cryptologia {\bf 11,} 4, pp. 193--205}
\D {1987}

\T {The Automated Cryptanalysis of Substitution Ciphers}
\A {John Carrol}
\A {Steve Martin}
\J {Cryptologia {\bf 10,} 4, pp. 193--209}
\D {1986}

\T {The Average Cycle Size of the Key Stream in Output Feedback Encipherment}
\A {D. W. Davies}
\A {G. I. P. Parkin}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\J {Advances in Cryptology: Proc. of CRYPTO~'82, Plenum Press, pp. 97--98}
\D {1983}

\T {A Basic Theory of Public and Private Cryptosystems}
\A {Charles Rackoff}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {A Basis for Secure Communication in Large Distributed Systems}
\A {David P. Anderson}
\A {P. Venkat Rangan}
\J {Technical Report: 328, University of California, Berkeley}
\D {1987}

\T {Batch RSA}
\A {Amos Fiat}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Number theoretic cryptographic algorithms are all based upon modular multiplication modulo some composite or prime. Some security parameter $n$ is set (the length of the composite or prime). Cryptographic functions such as digital signature or key exchange require $O(n)$ or $O(\sqrt{n})$ modular multiplications. This paper proposes a variant of the RSA scheme which requires only polylog$(n)$ $(O(\log^2 n))$ modular multiplications per RSA operation. Inherent to the scheme is the idea of batching, i.e, performing several encryption or signature operations simultaneously. In practice, the new variant effectively performs several modular exponentiations at the cost of a single modular exponentiation. This leads to a very fast RSA-like scheme whenever RSA is to be performed at some central site or when pure-RSA encryption ({\em vs.} hybrid encryption) is to be performed. An important feature of the new scheme is a practical scheme that isolates the private key from the system, irrespective of the size of the system, the number of sites, or the number of private operations that need be performed.}

\T {Bit Commitment Using Pseudo-Randomness}
\A {Moni Naor}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We show how a pseudo-random generator can provide a bit commitment protocol. We also analyze the number of bits communicated when parties commit to many bits simultaneously, and show that the assumption of the existence of pseudo-random generators suffices to assure amortized $O(1)$ bits of communication per bit commitment.}

\T {The Bit Extraction Problem or $t$-Resilient Functions}
\A {B.-Z. Chor}
\A {O. Goldreich}
\A {J. Hastad}
\A {J. Friedmann}
\A {S. Rudich}
\A {R. Smolensky}
\J {Proc. of the 26th IEEE Symp. on Foundations of Computer Sc., pp. 396--407}
\D {1985}

\T {The Bit Security of Modular Squaring Given Partial Factorization of the Modulos}
\A {Benny Chor}
\A {Oded Goldreich}
\A {Shafi Goldwasser}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {It is known that given a composite integer $N=p_1p_2$ (such that $p_1\equiv p_2\equiv3(\mod4)),$ and $q$ is a quadratic residue modulo $N,$ guessing the least significant bit of a square root of $q$ with any non-negligible advantage is as hard as factoring $N.$ In this paper we extend the above result to multi-prime numbers $N=p_1p_2\cdots p_l$ (such that $p_1\equiv p_2\equiv\cdots\equiv p_l\equiv3(\mod 4)).$ We show that given $N$ and $q,$ a quadratic residue mod $N,$ guessing the least significant bit of a square root of $q$ is as hard as completely factoring $N.$ Furthermore, the difficulty of guessing the least significant bit of the square root of $q$ remains unchanged even when all but two of the prime factors of $N,$ $p_3,\ldots,p_l,$ are known. The result is useful in designing multi-party cryptographic protocols.}

\T {Blinding for Unanticipated Signatures}
\A {David Chaum}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {Previously known blind signature systems require an amount of computation at least proportional to the number of signature types, and also the number of such types to be fixed in advance. These requirements are not practical in some applications. Here, a new blind signature technique is introduced that allows an unlimited number of signature types with only a (modest) constant amount of computation.}

\T {Bounds and Constructions for Authentication - Secrecy Codes with Splitting}
\A {Marijke {De Soete}}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {Bounds on Information Exchange for Byzantine Agreement}
\A {Danny Dolev}
\A {R\"udiger Reischuk}
\J {J ACM {\bf 32,} 1}
\D {1985}
\X {Byzantine Agreement has become increasingly important in establishing
distributed properties when errors may exist in the systems. Recent polynomial
algorithms for reaching Byzantine Agreement provide us with feasible solutions
for obtaining coordination and synchronization in distributed systems. In this
paper the amount of information exchange necessary to ensure Byzantine
Agreement is studied. This is measured by the total number of messages the
participating processor have to send in the worst case. In algorithms that use
a signature scheme, the number of signatures appended to messages are also
counted. It is first shown that $\Omega(nt)$ is a lower bound for the number of
signatures for any algorithm using authentication, where $n$ denotes the number
of processors and $t$ the upper bound on the number of faults the algorithm is
supposed to handle. For algorithms that reach Byzantine Agreement without using
authentication this is even a lower bound for the total number of messages. If
$n$ is large compared to $t,$ these bounds match the upper bounds from
previously known algorithms. For the number of messages in the authenticated
case we prove the lower bound $\Omega(n+t^2).$ Finally algorithms that achieve
this bound are presented.}

\T {Bounds on Message Equivocation for Simple Substitution Ciphers}
\A {James G. Dunham}
\J {IEEE Trans. on Info. Th. {\bf IT-26,} 5}
\D {1980}
\X {For simple substitution ciphers an exact expressin and bounds are derived for the message equivocation in terms of the key equivocation. It is established that the message equivocation approaches the key equivocation exponentially fast for discrete memoryless sources. It is observed that the exponential behaviour of the message equivocation is not determined by redundancy in the message source but by either the symbol probabilities which are closest in a certain sense or the sum of the two smallest symbol probabilities.}

\T {BPP and the Polynomial Hierarchy}
\A {C. Lautemann}
\J {Info. Proc. Letters {\bf 17,} 4}
\D {1983}
\X {BPP is the class of all sets that can be decided by a probabilistic Turing
machine with bounded error probability within a polynomial time bound. Sipser
showed that BPP is contained in the polynomial hierarchy of Meyer and
Stockmeyer. In this paper it is shown by pure counting arguments that BPP is
contained in $\Sigma_2^P,$ the second level of the hierarchy.}

\T {Breaking Iterated Knapsacks}
\A {Ernest F. Brickell}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {This paper presents an outline of an attack that we have used successfully to break iterated knapsacks. Although we do not provide a proof that the attack almost always works, we do provide some heuristic arguments. We also give a detailed description of the examples we have broken.}

\T {Breaking One Public-Key Distribution-System Based on Matrix Ring}
\A {X. Y. Yang}
\J {Elec. Letters {\bf 24,} 15, p. 961}
\D {1988}

\T {Breaking the Cade Cipher}
\A {N. S. James}
\A {R. Lidl}
\A {H. Niederreiter}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A cryptanalysis is given of a cryptosystem introduced by J.~J.~Cade, which is based on solving equations over finite fields.}

\T {Breaking the Enemy's Code}
\A {Glenn Zorpette}
\J {IEEE Spectrum, Sept.}
\D {1987}
\X {British intelligence and the Colossus computer.}

\T {Breaking the Ong-Schnorr-Shamir Signature Scheme for Quadratic Number Fields}
\A {Dennis Estes}
\A {Leonard M. Adleman}
\A {Kireeti Kompella}
\A {Kevin S. McCurley}
\A {Gary L. Miller}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Bull CP8 Smart Card in Cryptology}
\A {Yves Girardot}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {The CP8 smart card has memory and intelligence. These two characteristics joined to its technology, make of it an unfraudable and unduplicable portable strong box. Thus CP8 is a very secure and convenient device to transport, generate or transmit cryptologic keys or data.}

\T {Can Software Do Encryption Job?}
\A {D. Williams}
\A {H. J. Hindin}
\J {Electronics, July~3, pp. 102--103}
\D {1980}

\T {Cartesian Authentication Schemes}
\A {M. {De Soete}}
\A {K. Vedder}
\A {M. Walker}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper gives a characterisation of perfect Cartesian authentication schemes. It is shown that their existence is equivalent to the existence of nets. Furthermore the paper presents constructions of new authentication schemes derived from generalised $n$-gons which take on the lowest combinatorial bound for the impersonation attack. They include, as special cases, those based on projective planes and generalised quadrangles. It investigates the properties of the encoding rules and contains a brief discussion of questions in connection with key management.}

\T {A Certified Digital Signature}
\A {Ralph C. Merkle}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A practical digital signature system based on a conventional encryption function which is as secure as the conventional encryption function is described. Since certified conventional systems are available it can be implemented quickly without the several years delay required for certification of an untested system.}

\T {Cheating At Mental Poker}
\A {Don Coppersmith}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {We review the ``mental poker'' scheme described by Shamir, Rivest and Adleman. We present two possible means of cheating, depending on careless implementation of the SRA scheme. One will work if the prime $p$ is such that $p-1$ has a small prime divisor. In the other scheme, the names of the cards ``TWO OF CLUBS'' have been extended by random-looking bits, chosen by the cheater.}

\T {The Chipcard---An Identification Card With Cryptographic Protection}
\A {Thomas Krivachy}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {A Chosen-Plaintext Attack on the Microsoft BASIC Protection}
\A {R. {van den Assem}}
\A {W. J. {van Elk}}
\J {Computers \& Security, {\bf 5,} 1}
\D {1986}
\X {The Microsoft BASIC (MBASIC) interpreter provides a command which protects the program currently in memory by saving it, on disk, in an encrypted format. A user can RUN such a protected program, but cannot access the source program. A chosen-plaintext attack was used to break the encoding; the encryption method could be derived easily from the enciphering of carefully chosen plaintext programs. As a result a pair of MBASIC programs able to decrypt a protected program for any interpreter was developed. Further, it is shown that a secure system can never be realized, whichever encryption method is used.}

\T {Chosen Signature Cryptanalysis of the RSA (MIT) Public Key Cryptosystem}
\A {G. Davida}
\J {Technical Report TR-CS-82-2, Dept. of EECS, University of Wisconsin, Milwaukee, WI}
\D {1982}

\T {A Chosen Text Attack on the Modified Cryptographic Checksum Algorithm of Cohen and Huang}
\A {Bart Preneel}
\A {Antoon Bosselaers}
\A {Ren\'e Govaerts}
\A {Joos Vandewalle}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A critical analysis of the modified cryptographic checksum algorithm of Cohen and Huang points out some weaknesses in the scheme. We show how to exploit these weaknesses with a chosen text attack to derive the first bits of the key. This information suffices to manipulate blocks with a negligible chance of detection.}

\T {Chosen Text Attack on the RSA Cryptosystem and Some Discrete Logarithm Schemes}
\A {Y. Desmedt}
\A {A. M. Odlyzko}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {A new attack on the RSA cryptosystem is presented. This attack assumes less than previous chosen ciphertext attacks, since the cryptanalyst has to obtain the plaintext versions of some carefully chosen ciphertexts only once, and can then proceed to decrypt further ciphertexts without further recourse to the authorized user's decrypting facility. This attack is considerably more efficient than the best algorithm that are known for factoring the public modulus. The same idea can also be used to develop an attack on the three-pass system of transmitting information using exponentiation in a finite field.}

\T {Cipher Systems, The Protection of Communications}
\A {Henry Beker}
\A {Fred Piper}
\J {John Wiley \& Sons}
\D {1982}
\X {Monoalphabetic ciphers, polyalphabetic ciphers, M-209, theoretical
cryptography, practical security, perfect secrecy, random ciphers, Shannon,
randomness, linear shift registers, NP-completeness, block ciphers, speech
security, public key cryptography, authentication, RSA, electronic funds
transfer.}

\T {Codes and Cryptography}
\A {D. Welsh}
\J {Claredon Press}
\D {1988}

\T {Codes from Symmetry Groups, and a [32, 17, 8] Code}
\A {Ying Cheng}
\A {N. J. A. Sloane}
\J {SIAM J on Discrete Math. {\bf 2,} 1}
\D {1989}
\X {Let $G$ be the automorphism group of the four-dimensional cube, a group of
order $2^4\cdot4!=384.$ The binary codes associated with the 32-dimensional
permutation representation of $G$ on the edges of the cube are investigated.
There are about 400 such codes, one of which is a [32, 17, 8] code, having
twice as many codewords as the [32, 16, 8] extended quadratic residue code.}

\T {Codes: Unequal Probabilities, Unequal Letter Costs}
\A {Doris Altenkamp}
\A {Kurt Mehlhorn}
\J {J ACM {\bf 27,} 3, pp. 412--427}
\D {1980}
\X {The construction of alphabetic prefix codes with unequal letter costs and
unequal proabilities is considered. A variant of the noiseless coding theorem
is proved giving closely matching lower and upper bounds for the cost of the
optimal code. An algorithm is described which constructs a nearly optimal code
in linear time.}

\T {Coin Flipping by Telephone}
\A {Justin M. Reyneri}
\A {Ehud D. Karnin}
\J {IEEE Trans. on Info. Th. {\bf IT-30,} 5}
\D {1984}
\X {Two parties, who do not trust each other, wish to agree on the result of a coin toss while they are conversing by telephone. A new protocol which solves this problem is proposed and compared with previous protocols.}

\T {Coin Flipping by Telephone: A Protocol For Solving Impossible Problems}
\A {Manuel Blum}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {Alice and Bob want to flip a coin by telephone (They have just divorced, live in different cities, want to decide who gets the car.) Bob would not like to tell Alice HEADS and hear Alice (at the other end of the line) say ``Here goes... I'm flipping the coin.... You lost!'' Coin-flipping in the SPECIAL way done here has a serious purpose. Indeed, it should prove an INDISPENSABLE TOOL of the protocol designer. Whenever a protocol requires one of two adversaries, say Alice, to pick a sequence of bits at random, and whenever it serves Alice's interests best NOT to pick her sequence of bits at random, then coin-flipping (Bob flipping coins to Alice) as defined here achieves the desired goal: 1. If GUARANTEES to Bob that Alice will pick her sequence of bits at random. Her bit is 1 if Bob flips heads to her, 0 otherwise. 2. It GUARANTEES to Alice that Bob will not know WHAT sequence of bits he flipped to her. Coin-flipping has already proved useful in solving a number of problems once thought impossible: mental poker, certified mail, and exchange of secrets. It will certainly prove a useful tool in solving other problems as well.}

\T {Collective Coin Flipping, Robust Voting Schemes and Minima of Banzhaf Values}
\A {M. Ben-Or}
\A {N. Linial}
\J {Proc. of the 26th IEEE Symp. on Foundations of Comp. Sc.}
\D {1988}

\T {Collision Free Hash Functions and Public Key Signature Schemes}
\A {Ivan Bjerre Damg{\aa}rd}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {In this paper, we present a construction of hash functions. These functions are collision free in the sense that under some cryptographic assumption, it is provably hard for an enemy to find collisions. Assumptions that would be sufficient are the hardness of factoring, of discrete log, or the (possibly) more general assumption about the existence of claw free sets of permutations. The ability of a hash function to improve security and speed of a signature scheme is discussed: for example, we can combine the RSA-system with a collision free hash function based on factoring to get a scheme which is more efficient and much more secure. Also, the effect of combining the Goldwasser-Micali-Rivest signature scheme with one of our functions is studied. In the factoring based implementations of the scheme using a $k$-bit modulus, the signing process can be speeded up by a factor roughly equal to $kO(\log_2(k)),$ while the signature checking process will be faster by a factor of $O(\log_2(k)).$}

\T {The COLOSSUS}
\A {B. Randell}
\J {A History of Computing in the Twentieth Century, N.~Metropolis, J.~Howlett, and G.-C.~Rota (eds.), Academic Press, NY, pp. 47--92}
\D {1980}

\T {A Combinatorial Approach to Threshold Schemes}
\A {D. R. Stinson}
\A {S. A. Vanstone}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {We investigate the combinatorial properties of threshold schemes. Informally, a $(t,w)$-threshold scheme is a way of distributing partial information (shadows) to $w$ participants, so that any $t$ of them can easily calculate a key, but no subset of fewer than $t$ participants can determine the key. Our interest is in {\em perfect\/} threshold schemes: no subset of fewer than $t$ participants can determine any partial information regarding the key. We give a combinatorial characterization of a certain type of perfect threshold scheme. We also investigate the maximum number of keys which a perfect $(t,w)$-threshold scheme can incorporate, as a function of $t,$ $w,$ and the total number of possible shadows, $v.$ This maximum can be attained when there is a Steiner system $S(t,w,v)$ which can be partitioned into Steiner systems $S(t-1,w,v).$ Using known constructions for such Steiner systems, we present two new classes of perfect thresholds schemes, and discuss their implementation.}

\T {Combinatorics, Complexity, and Randomness}
\A {Richard M. Karp}
\J {C ACM {\bf 29,} 2}
\D {1986}
\X {Combing through his 25 years of research in the field of combinatorics and
computational complexity, Karp pinpoints the conceptual milestones of his work
and credits the colleagues who have both inspired and influenced him.}

\T {A Comment on Niederreiter's Public Key Cryptosystem}
\A {Bernard Smeets}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {In this comment we show that a recently proposed public key cryptosystem is not safe for most of the practical cases. Furthermore, it is shown that the security of this system is closely connected with the problem of computing logarithms over a finite field.}

\T {A Comment on the `Basic Security Theorem' of Bell and LaPadula}
\A {J. McLean}
\J {Info. Proc. Letters {\bf 20,} 2}
\D {1985}
\X {many claim that the security model developed by Bell and LaPadula and used
as a basis for numerous prototype military computer systems is superior to
others partly because its authors prove a `Basic Security Theorem' that applies
to it. This paper shows that the theorem does not support such claims since it
can be proven for security models that are obviously not secure. Further, the
theorem provides little help to those who design and implement secure systems.}

\T {Communication Security in Remote Controlled Computer Systems}
\A {M. R. Oberman}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {Nowadays remote controlled computer systems are in widespread use. Several systems use the communication facilities offered by the public switched telephone network. In view of the public aspects of the network it is necessary that dial-up systems should have sufficient access security and communication security. In this paper it is proposed that this security be provided by use of cryptography.}

\T {Communication with Secrecy Constraints}
\A {Alon Orlitsky}
\A {Abbas El Gamal}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {Let $x,y,z$ be finite sets, $X,Y$ random variables uniformly distributed over $x\times y,$ $f$ a function from $x\times y$ to $z$ and $0\le\epsilon\le1.$ A person $P_X$ knows $X$ and a person $P_Y$ knows $Y$ and they want to exchange $X$ and $Y.$ An eavesdropper who knows their protocol listens to their communication in order to obtain information about $f(X,Y).$ $P_X$ and $P_Y$ want to ensure that for every value $(x,y)$ of $(X,Y)$ the eavesdropper's a priori and a posteriori probabilities of $\{f(X,Y)=j\}$ are $\epsilon$-close for all $j.$ Therefore, they encrypt some of the transmitted bits. The problem is to find a protocol that minimizes the numbers of bits encrypted in the worst case. Two kinds of protocols are considered: {\em deterministic\/} and {\em randomized.} For deterministic protocols it is shown that for all $x,y,$ Boolean $f(|z|=2)$ and $\epsilon>0,$ there exists a protocol that requires no more than $2\log(1/\epsilon)+16$ bits. An example where $\log(1/\epsilon)-1$ bits must be encrypted is given. For $K$ valued functions $(|z|=K)$ it is shown that at most $C_K(\epsilon)$ bits must be encrypted (independent of $x,y$ and $f$). The results are extended to $N$ persons communicating over a broadcast channel. The proof rely on results concerning partitions of $K$ valued matrices. For randomized Protocols it is shown that for all $x,y$ Boolean $f,$ and all possible joint distributions of $X,Y$ (not only uniform), {\em total secrecy\/} ($\epsilon=0$) can be achieved using only two secret bits.}

\T {Compact Knapsacks Are Polynomial Solvable}
\A {Hamid R. Amirazizi}
\A {Ehud D. Karnin}
\A {Justion M. Reyneri}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {Extended abstract of Crypto'81 presentation.}

\T {A Compact Linear Prime Number Sieve (Among Others)}
\A {P. Pritchard}
\J {Technical Report: TR81--473, Cornell University}
\D {1981}

\T {Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computing}
\A {Michael Ben-Or}
\A {Shafi Goldwasser}
\A {Avi Wigderson}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Every function of $n$ inputs can be efficiently computed by a complete network of $n$ processors in such a way that: 1. If no fault occurs, no set of size $t<n/2$ of players gets any additional information (other than the function value), 2. Even if Byzantine faults are allowed, no set of size $t<n/3$ can either disrupt the computation or get additional information. Furthermore, the above bounds on $t$ are tight!}

\T {Complexity Measure for Public-Key Cryptosystems}
\A {Joachim Grollmann}
\A {Alan L. Selman}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {A general theory of public-key cryptography is developed that is based on the mathematical framework of complexity theory. Two related approaches are taken to the development of this theory, and these approaches correspond to different but equivalent formulations of the problem of cracking a public-key cryptosystem (PKCS). The first approach is to model the cracking problem as a partial decision problem called a ``promise problem.'' Every $NP$-hard promise is shown to be uniformly $NP$-hard, and a number of results and a conjecture about promise problems are shown to be equivalent to separability assertions for sets in $NP$ that are the natural analogues of well-known results in classical recursion theory. The conjecture, if it is true, implies nonexistence of PKCS having $NP$-hard cracking problems. The second approach represents the cracking problem of a PKCS as a partial computational problem directly. Using this approach, it is shown that one-way functions exists if and only if $P\ne UP$ and that one-way functions with greater cryptographic significance exist if and only if $NP$ contains disjoint $P$-inseparable sets. The paper concludes with a discussion of almost-everywhere security measures for PKCS.}

\T {Complexity Measures for Public-Key Cryptosystems}
\A {J. Grollmann}
\A {A. L. Selman}
\J {Proc. of the 25th IEEE Symp. on Foundations of Comp. Sc., pp. 495-503}
\D {1984}

\T {Complexity of Parallel $QR$ Factorization}
\A {M. Cosnard}
\A {Y. Robert}
\J {J ACM {\bf 33,} 4}
\D {1986}
\X {An optimal algorithm to perform the parallel QR decomposition of a dense
matrix of size $N$ is proposed. It is deduced that the complexity of such a
decomposition is asymptotically $2N,$ when an unlimited number of processors is
available.}

\T {The Complexity of Perfect Zero-Knowledge}
\A {Lance Fortnow}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {A {\em Perfect Zero-Knowledge\/} interactive proof system convinces a verifier that a string is in a language without revealing any additional knowledge in an information-theoretic sense. We show that for any language that has a perfect zero-knowledge proof system, its complement has a short interactive protocol. This result implies that there are not any perfect zero-knowledge protocols for NP-complete languages unless the polynomial time hierarchy collapses. This paper demonstrates that knowledge complexity can be used to show that a language is easy to prove.}

\T {Complexity of Solving Algebraic Equations}
\A {Aviezri S. Fraenkel}
\A {Yacov Yesha}
\J {Information Processing Letters {\bf 10,} 4--5, pp. 178--179}
\D {1980}

\T {A Complexity Theoretic Approach to Randomness}
\A {Michael Sipser}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {We study a time bounded variant of Kolmogorov complexity. This notion, together with universal hashing, can be used to show that problems solvable probabilistically in polynomial time are all within the second level of the polynomial time hierarchy. We also discuss applications to the theory of probabilistic constructions.}

\T {Components and Cycles of a Random Function}
\A {J. M. DeLaurentis}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {This investigation examines the average distribution of the components and cycles of a random function. Here we refer to the mappings from a finite set of, say, $n$ elements into itself; denoted by $\Gamma_n.$ Suppose the elements of $\Gamma_n$ are assigned equal probability, i.e. $P(\gamma)=n^{-n},$ $\gamma\in\Gamma_n.$ The directed graph that is naturally associated with $\gamma$ consists of several components, each with a unique cycle. Define $X_n(s,t)(\gamma)$ as the number of components in $\gamma$ containing at least the fraction $s$ of the total number of nodes, with the size of each component's cycle not exceeding $tn^{1/2}.$ We show that the required expected value of $X_n(s,t)$ can be approximated by the double integral $$EX_n(s,t) = \int_t^1\int_0^s {1\over\sqrt{2\pi}}{e^{-y^2/(2x)}\over\sqrt{x^3(1-x)}}{\rm d}y{\rm d}x.$$ The average number of components of a given size with cycles of a specified length approximately equals the volume under the graph of the integrand. This expression can be used to estimate the probability that a function has a component which contains a significant percentage of the total number of nodes and yet its cycle is relatively small.}

\T {Compression and Ranking}
\A {Andrew V. Goldberg}
\A {Michael Sipser}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}
\X {A complexity-theoretic approach to the classical data compression problem is to define a notion of language compression by a machine in a certain complexity class, and to study language classes compressible under the above definition. Languages that can be compressed efficiently (e.g. by a probabilistic polynomial time machine) are of special interest. We define the notion of language compressibility, and show that sufficiently sparse ``easy'' languages (e.g. polynomial time) can be compressed efficiently. We also define a notion of ranking (which is an optimal compression) and show that some ``very easy'' languages (e.g. unambiguous context-free languages) can be ranked efficiently. We exhibit languages which cannot be compressed or ranked efficiently. The notion of compressibility is closely related to Kolmogorov complexity and randomness. We discuss this relationship and the complexity-theoretic implications of our results.}

\T {The Computational Complexity of Simultaneous Diophantine Approximation Problems}
\A {J. C. Lagarias}
\J {SIAM J. Comput. {\bf 14,} 1}
\D {1985}
\X {Simultaneous Diophantine approximation in $d$ dimensions deals with the approximation of a vector $\vec{\alpha}=(\alpha_1,\ldots,\alpha_d)$ of $d$ real numbers by vectors of rational numbers all having the same denominator. This paper considers the computational complexity of algorithms to find good simultaneous approximations to a given vector $\vec{\alpha}$ of $d$ rational numbers. We measure the goodness of an approximation using the sup norm. We show that a result of H. W. Lenstra, Jr. produces a polynomial-time algorithms to sind sup norm best approximations to a given vector $\vec{\alpha}$ when the dimension $d$ is fixed. We show that a recent algorithm of A. K. Lenstra, H. W. Lenstra, Jr. and L. Lovasz to find short vectors in an integral lattice can be used to find a good approximation to a given vector $\vec{\alpha}$ in $d$ deminesions with a denominator $Q^*$ satisfying $1\le Q^*\le 2^{d/2}N$ which is within a factor $\sqrt{5d}2^{(d+1_/2}$ of the best approximation with denominator $Q$ with $1\le Q\le N.$ This algorithm runs in time polynomial in the input size, independent of the dimension $d.$ We also prove complementary results showing that certain simultaneous Diophantine approximation problems are NP-hard. We show that the problem of deciding whether a given vector $\vec{\alpha}$ of rational numbers has a simultaneous approximation of specified accuracy with respect to the sup norm with denominator $Q$ in a given interval $1\le Q\le N$ is NP-complete. (Here the dimension $d$ is allowed to vary.) We prove two other complexity results, which suggest that the problem of locating best (sup norm) simultaneous approximations is harder than this NP-complete problem.}

\T {Computation of Approximate L-th Roots Modulo $n$ and Application to Cryptography}
\A {Marc Girault}
\A {Philippe Toffin}
\A {Brigitte Vall\'ee}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {The goal of this paper is to give a unified view of various known results (apparently unrelated) about numbers arising in crypto schemes as RSA, by considering them as variants of the computation of approximate L-th roots modulo $n.$ Here one may be interested in a number whose L-th power is ``close'' to a given number, or in finding a number that is ``close'' to its exact L-th root. The paper collects numerous algorithms which solve problems of this type.}

\T {Computer Crime}
\A {Donn B. Parker}
\A {Susan H. Nycum}
\J {C ACM {\bf 27,} 4}
\D {1984}
\X {Industry experts provide a perspective on present and future dimensions of
the computer security and privacy issue.}

\T {Computer, Crime and Privacy---A National Dilemma, Congressional Testimony
from the Industry}
\J {C ACM {\bf 27,} 4}
\D {1984}
\X {Consists of: Computer Crime by Donn B. Parker and Susan H. Nycum, and
Information System Security and Privacy by Willis H. Ware}

\T {Computer Recreations, A Progress Report on the Fine Art of Turning Literature into Drivel}
\A {Brian Hayes}
\J {Scientific American, {\bf 249,} 5}
\D {1983}

\T {Computer Recreations, How to Handle Numbers with Thousands of Digits, and Why One Might Want To}
\A {Fred Gruenberger}
\J {Scientific American, {\bf 250,} 5}
\D {1984}

\T {Computer Recreations, On Making and Breaking Codes: Part 1}
\A {A. K. Dewdney}
\J {Scientific American, {\bf 259,} 4, pp. 120--123}
\D {1988}
\X {Is it true that one machine can decode what another machine can encode.}

\T {Computer Recreations, On Making and Breaking Codes: Part 2}
\A {A. K. Dewdney}
\J {Scientific American, {\bf 259,} 5, pp. 104--107}
\D {1988}
\X {Computers encode messages by embedding a private key in a public problem.}

\T {Computer Security: A Comprehensive Controls Checklist}
\A {Charles Cresson Wood}
\A {William W. Banks}
\A {Sergio B. Guarro}
\A {Abel A. Garcia}
\A {Viktor E. Hampel}
\A {Henry P. Sartorio}
\J {John Wiley \& Sons}
\D {1987}
\X {Security, checklists, personnel policies, systems development,
training/awareness, organizational structure, physical access, data and program
access, input/output, processing operations, database and systems software,
telecommunications, visual display terminals human factors, environment, backup
and recovery, legal aspects of computer security.}

\T {Computer Security: A Handbook for Management}
\A {Leonard H. Fine}
\J {Heinemann, London}
\D {1983}
\X {A new approach to computer security: the total security concept, defining a
computer security policy, organization and division of responsibility, physical
and fire security, personnel practices, insurance, systems security,
application security, systems programming and operating standards, the role of
internal and external auditors, disaster recovery planning and testing,
implementing effective computer security.}

\T {Computer Security Conference---A Report on the 10th National Computer Security Conference, Baltimore, MD, September 21--24, 1987}
\A {I.E. Isaac}
\J {J of Research of the National Bureau of Standards {\bf 93,} 1, pp. 71--75}
\D {1988}

\T {Computer Virus Boosts Network Security Efforts}
\A {S. Borman}
\J {Chemical \& Engineering News {\bf 66,} 46, p.~8}
\D {1988}

\T {Computing Logarithms in Finite Fields of Characteristic Two}
\A {I. F. Blake}
\A {R. Fuji-Hara}
\A {R. C. Mullins}
\A {S. A. Vanstone}
\J {SIAM J. on Algebraic Discrete Methods, {\bf 5}}
\D {1984}

\T {Computing Logarithms in $GF(2^n)$}
\A {I. F. Blake}
\A {R. C. Mullin}
\A {S. A. Vanstone}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {A Conference Key Distribution System}
\A {Ingemar Ingemarsson}
\A {Donald T. Tang}
\A {C. K. Wong}
\J {IEEE Trans. on Info. Th. {\bf IT-28,} 5}
\D {1982}
\X {Encryption is used in a communication system to safeguard information in the transmitted messages from anyone other than the intended receiver(s). To perform the encryption and decryption the transmitter and receiver(s) ought to have matching encryption and decryption keys. A clever way to generate these keys is to use the public key distribution system invented by Diffie and Hellman. That system, however, admits only one pair of communication stations to share a particular pair of encryption and decryption keys. The public key distribution system is generalized to a conference key distribution system (CKDS) which admits any group of stations to share the same encryption and decryption keys. The analysis reveals two important aspects of any conference key distribution system. One is the multitap resistance, which is a measure of the information security in the communication system. The other is the separation of the problem into two parts: the choice of a suitable symmetric function of the private keys and the choice of a suitable symmetric function of the private keys and the choice of a suitable one-way mapping thereof. We have also shown how to use CKDS in connection with public key ciphers and an authorization scheme.}

\T {Conjugate Coding}
\A {Stephen Wiesner}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {This paper treats a class of codes made possible by restrictions on measurement related to the uncertainty principal. Two concrete examples and some general results are given.}

\T {A Constraint Satisfaction Algorithm for the Automated Decryption of Simple Substitution Ciphers}
\A {Michael Lucks}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {This paper describes a systematic procedure for decrypting simple substitution ciphers with word divisions. The algorithm employs an exhaustive search in a large on-line dictionary for words that satisfy constraints on word length, letter position and letter multiplicity. The method does not rely on statistical or semantical properties of English, nor does it use any language-specific heuristics. The system is, in fact, language independent in the sense that it would work equally well over any language for which a sufficiently large dictionary exists on-line. To reduce the potentially high cost of locating all words that contain specified patterns, the dictionary is complied into a database from which groups of words that satisfy simple constraints may be accessed simultaneously. The algorithm (using a relatively small dictionary of 19,000 entries) has been implemented in Franz~Lisp on a Vaz~11/780 computer running 4.3~BSD~Unix. The system is frequently successful in a completely automated mode -- preliminary testing indicates about a 60\% success rate, usually in less than three minutes of CPU time. If it fails, there exist interactive facilities, permitting the user to guide the search manually, that perform very well with minor human intervention.}

\T {A Construction for Authentication / Secrecy Codes from Certain Combinatorial Designs}
\A {D. R. Stinson}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {If we agree to use one of $v$ possible messages to communicate one of $k$ possible states, then an opponent can successfully impersonate a transmitter with probability at least $k/v,$ and can successfully substitute a message with a fraudulent one with probability at least $(k-1)/(v-1).$ We wish to limit an opponent to these bounds. In addition, we desire that the observation of any two messages in the communication channel will give an opponent no clue as to the two source states. We describe a construction for a code which achieves these goals, and which does so with the minimum possible number of encoding rules (namely, $v(v-1)/2$). The construction uses a structure from combinatorial design theory known as a perpendicular array.}

\T {The Contribution of E. B. Fleissner and A.~Figl for Today's Cryptography}
\A {Otto J. Horak}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Controlled Gradual Disclosure Schemes for Random Bits and Their Applications}
\A {Richard Cleve}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We construct a protocol that enables a secret bit to be revealed gradually in a very controlled manner. In particular, if Alice possesses a bit $S$ that was generated randomly according to the uniform distribution and ${1\over2}<p_1<\cdots<p_m=1$ then, using our protocol with Bob, Alice can achieve the following. The protocol consists of $m$ stages, and after the $i$th stage, Bob's best prediction of $S,$ based on all his interactions with Alice, is correct with probability exactly $p_i$ (and a reasonable condition is satisfied in the case where $S$ is not initially uniform). Furthermore, under an intractability assumption, our protocol can be made ``oblivious'' to Alice and ``secure'' against an Alice or Bob that might try to cheat in various ways. Previously proposed gradual disclosure schemes for single bits release information in a less controlled manner: the probabilities that represent Bob's confidence of his knowledge of $S$ follow a random walk that eventually drifts towards 1, rather than a predetermined sequence of values. Using controlled gradual disclosure schemes, we show how to construct an improved version of the protocol proposed by Luby, Micali and Rackoff for two-party secret bit exchanging that is secure against additional kinds of attacks that the previous protocol is not secure against. Also, out protocol is more efficient in the number of rounds that it requires to attain a given level of security, and is proven to be asymptotically optimal in this respect. We also show how to use controlled gradual disclosure schemes to improve existing protocols for other cryptographic problems, such as multi-party function evaluation.}

\T {The Cornell Commission: On Morris and the Worm}
\A {Ted Eisenberg}
\A {David Gries}
\A {Juris Hartmanis}
\A {Don Holcomb}
\A {M. Stuart Lynn}
\A {Thomas Santoro}
\J {Communications of the ACM, {\bf 32,} 6, pp. 678++}
\D {1989}
\X {After careful examination of the evidence, the Cornell commission publishes its findings in a detailed report that sheds new light and dispels some myths about Robert~T.~Morris and the Internet worm.}

\T {Correcting Faults in Write-Once Memory}
\A {Danny Dolev}
\A {David Maier}
\A {Harry Mairson}
\A {Jeffrey Ullman}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {We consider codes for write-once memory in the presence of stuck-at-0 and stuck-at-1 faults. Such fault-tolerant codes generally require less redundancy than error-correcting codes, as faults detected during the writing process can affect subsequent behavior of that process. We present {\em pointer\/} codes, which use part of a codeword to point to faults in other parts of the codeword. A pointer code can encode $n$-bit messages in the presence of $f$ faults with only $f(\log_2 n +o(1))$ redundancy. We derive a lower bound on the redundancy of such a fault-tolerant code of slightly less than $f\log n.$ We also examine some models where all stuck-at informations is known in advance, and analyze the expected redundancy of pointer codes.}

\T {Correlation Immunity and the Summation Generator}
\A {Rainer A. Rueppel}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {It is known that for a memoryless mapping from $GF(2)^N$ into $GF(2)$ the nonlinear order of the mapping and its correlation-immunity form a linear tradeoff. In this paper it is shown that the same tradeoff does no longer hold when the function is allowed to have memory. Moreover, it is shown that integer addition, when viewed over $GF(2),$ defines an inherently nonlinear function with memory whose correlation-immunity is maximum. The summation generator which sums $N$ binary sequences over the integers is shown as an application of integer addition in random sequence generation.}

\T {Correlation-Immunity of Nonlinear Combining Functions for Cryptographic Applications}
\A {T. Siegenthaler}
\J {IEEE Transactions on Information Theory, {\bf 30,} pp. 776--780}
\D {1984}
\X {Pseudonoise generators for cryptographic applications consisting of several linear feedback shift registers with a nonlinear combining function have been proposed as running key generators in stream ciphers. These running key generators can sometimes be broken by (ciphertext-only) correlation attacks on individual subsequences. A new class of combining functions is presented, which provides better security against such attacks. The security is quantified by the smallest number $m+1$ of subsequences that must be simultaneously considered in a correlation attack. A necessay condition for such $m$oth-order correlation-immunity is proved. A recursive construction is given that permits the construction of an $m$th-order immune combining function for $n$ subsequences for any $m$ and $n$ with $1\le m<n.$ Finally, the trade-off between the length of the linear equivalent of the nonlinear generator and the order $m$ of its immunity against correlation attacks is considered.}

\T {Counting Functions Satisfying a Higher Order Strict Avalanche Criterion}
\A {Sheelagh Lloyd}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {A Course in Number Theory and Cryptography}
\A {N. Koblitz}
\J {Springer-Verlag}
\D {1987}

\T {Covert Distributed Processing with Computer Viruses}
\A {Steve R. White}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Computer viruses can be used by their authors to harness the resources of infected machines for the author's computation. By doing so without the permission or knowledge of the machine owners, viruses can be used to perform covert distributed processing. We outline the class of problems for which covert distributed processing can be used. A brute-force attack on cryptosystems is one such problem, and we give estimates of the time required to complete such an attack covertly.}

\T {A Critical Analysis of the Security of Knapsack Public Key Algorithms}
\A {Y. Desmedt}
\A {J. Vandewalle}
\A {R. Govaerts}
\J {Abstracts of Papers from IEEE Int. Symp. on Info. Theory, Les Arcs, France, pp. 115--116}
\D {1982}
\J {IEEE Trans. on Info. Theory {\bf IT-30,} pp. 601--611}
\D {1984}
\X {The authors claim that the security of the Merkle-Hellman algorithm is greatly exaggerated. First, any enciphering key that is obtained from a superincreasing sequence had infinitely many superincreasing deciphering keys that can decipher all messages. This follows from the fact that the conditions on the transformation $*w\mod m$ require $w/m$ to lie in a restricted set of intervals. Second, it is claimed that iterative transformations $*w\mod m$ may not increase the security. In the example that Merkle and Hellman used for ``proving'' the benfits of the iterative transformation, the security is completely ruined. Third, techniques are presented to track one bit of the plaintext. These techniques apply to sets of enciphering keys introduced in this text, which contain all the Merkle-Hellman enciphering keys. Such bit-by-bit techniques also allow the construction of new enciphering keys. Fourth, some knapsacks that allow a one-to-one deciphering cannot be obtained from easy deciphering keys, e.g., superincreasing keys, even with infinitely many transformations $*w\mod m!$ If the worst cases of nondetermistic polynomial complete knapsack problems are always of this kind, the foundation of the security of the Merkle-Hellman algorithm are nonexistent. The cryptanalysis can be reduced to a problem of simultaneous diophantine approximations. A link is made with other recent results.}

\T {Cross Parity Check Convolutional Codes}
\A {Tom Fuja}
\A {Chris Heegard}
\A {Mario Blaum}
\J {IEEE Trans. on Info. Th. {\bf 35,} 6}
\D {1989}
\X {A class of convolutional codes called cross parity check (CPC) codes, useful for the protection of data stored on magnetic tape, is described and analyzed. CPC codes are first explained geometrically; their construction is desribed in terms of constraining data written onto a tape in such a way that, when lines of varying slope are drawn across the tape, the bits falling on those lines sum to zero modulo two. This geometric interpretation is then formalized by the construction of canonical pairty check matrices and systematic generator matrices for CPC codes and by computing their constraint lengths. The distance properties of CPC codes are analyzed, and it is shown that these codes are maximum distance separable (MDS) convolutional codes. In addition, examples are given of both error and erasure decoding algorithms that take advantage of the geometric regularity of cross parity check codes. Finally, the technique of parity check matrix reduction---useful for reducing the inherent decoding delay of CPC codes---is described. This technique consists of dividing each terms of the parity check matrix by some polynomial and retaining only the remainder. A class of polynomials which are particularly attractive for this purpose is identified.}

\T {Cryptanalysis: A Survey of Recent Results}
\A {Ernest F. Brickell}
\A {Andrew M. Odlyzko}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {In spite of the progress in computational complexity, it is still true that cryptosystems are tested by subjecting them to cryptanalytic attacks by experts. Most of the cryptosystems that have been publicly proposed in the last decade have been broken. This paper outlines a selection of the attacks that have been used and explains some of the basic tools available to the cryptanalyst. Attacks on knapsack cryptosystems, congruential generators, and a variety of two key secrecy and signature schemes are discussed. There is also a brief discussion of the status of the security of cryptosystems for which there is no known feasible attack, such as the RSA, discrete exponentiation, and DES cryptosystems.}

\T {Cryptanalysis of ADFGVX Encipherment Systems}
\A {Alan G. Konheim}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Cryptanalysis of a Kryha Machine}
\A {Alan G. Konheim}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Cryptanalysis of a Modified Rotor Machine}
\A {Peter Wichmann}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Cryptanalysis of Certain Variants of Rabin's Signature Scheme}
\A {A. Shamir}
\A {C. P. Schnorr}
\J {Info. Proc. Letters {\bf 19,} 3}
\D {1984}
\X {Rabin's signature scheme is known to be susceptible to chosen cleartext
attacks, and thus it is essential to perturb each message before it is signed.
In this paper we show that certain natural perturbation techniques (including
the addition of random prefixes or suffixes to the message) do not fully
protect the scheme against a new type of chosen cleartext attack.}

\T {Cryptanalysis of DES with a Reduced Number of Rounds: Sequences of Linear Factors in Block Ciphers}
\A {David Chaum}
\A {Jan-Hendrik Evertse}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Cryptanalysis of F.E.A.L.}
\A {Bert Den Boer}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {At Eurocrypt 87 the blockcipher F.E.A.L. was presented. Earlier algorithms called F.E.A.L-1 and F.E.A.L-2 had been submitted to standardization organizations but this was presumably the final version. It is a Feistel cipher, but in contrast to D.E.S., a software implementation does not require a table look-up. The intentions was a fast software implementation and also an avoidance of discussions about random tables. As Walter~Fumy indicated at Cryto~87 a certain transformation on 32 bits used by the cipher was not complete in constrast to a remark made during the presentation of F.E.A.L. at Eurocrypt~87. I am informed that after my informal expose at Crypto~87 about certain vulnerabilities of F.E.A.L., its designers have created F.E.A.L.-8 with twice as many rounds. Later on again versions were renamed. The (definite?) version in the abstracts without a serial number got version 1.00 and F.E.A.L.-8 got version number 2.00 in the proceedings of Eurocrypt~'87. In this paper we shall show that F.E.A.L. as presented at Eurocrypt~87 is vulnerable for a chosen plaintext attack which requires at most ten thousand plaintexts.}

\T {The Cryptanalysis of Knapsack Cryptosystems}
\A {E.F. Brickell}
\J {Proc. of the 3rd SIAM Discrete Mathematics Conf.}
\D {\BB}

\T {A Cryptanalysis of Step$_{k,m}$-Cascades}
\A {Dieter Gollmann}
\A {William G. Chambers}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We examine cascades of clock-controlled shift registers where registers are clocked by more general schemes than simply ``stop-and-go''. In particular, we consider the relation between the stepping function and the number of keys of such a cascade.}

\T {Cryptanalysis of the Data Encryption Standard by the Method of Formal Coding}
\A {Ingrid Schaum\"uller-Bichl}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {The ``Method of Formal Coding'' consists in representing each bit of a DES ciphertext block as an XOR-sum-of-products of the plaintext bits and the key bits. Subsequent introduction of the ``MFC-complexity measure'' yields interesting results on the security of the DES and the influence of various parameters.}

\T {Cryptanalysis of the Dickson-scheme}
\A {Winfred B. M\"uller}
\A {Rupert N\"obauer}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Cryptanalysis of Video Encryption Based On Space-Filling Curves}
\A {Michael Bertilsson}
\A {Ernest F. Brickell}
\A {Ingemar Ingemarsson}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper we cryptanalyze a method for enciphering images constructed by Adi~Shamir and Yossi~Matias. The enciphering is done using space-filling curves. We present an algorithm doing the cryptanalysis. We also present results achieved using the algorithm on a part of an image.}

\T {Cryptanalysts Representation of Nonlinearly Filtered ML-Sequences}
\A {T. Siegenthaler}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {A running key generator consisting of a maximum-length (ML) linear feedback shift register (LFSR) and some nonlinear feedforward state filter function is investigated. It is shown how a cryptanalyst can find an equivalent system in a ciphertext-only attack. The analysis uses a Walsh orthogonal expansion of the state filter function and its relation to the crosscorrelation function (CCF) between the ML-sequences and the produced running key sequence.}

\T {Cryptanalytic Attack on the Multiplicative Knapsack Cryptosystem and on Shamir's Fast Signature Scheme}
\A {Andrew M. Odlyzko}
\J {IEEE Trans. on Info. Th. {\bf IT-30,} 4}
\D {1984}
\X {The basic Merkle-Hellman additive trapdoor knapsack public-key cryptosystem was recently shown to be insecure, and attacks have also been developed on stronger variants of it, such as the Graham-Shamir system and the iterated knapsack cryptosystem. It is shown that some simple variants of another Merkle-Hellman system, the multiplicative knapsack cryptosystem, are insecure. It is also shown that the Shamir fast signature scheme can be broken quickly. Similar attacks can also be used to break the Sch\"obi-Massey authentication scheme. These attacks have not been rigorously proved to succeed, but heuristic arguments and empirical evidence indicate that they work on systems of practical size.}

\T {A Cryptanalytic Time-Memory Trade Off}
\A {M. E. Hellman}
\J {IEEE Trans. on Information Theory, {\bf IT-26,} pp. 401--406}
\D {1980}
\X {A probabilistic method is presented which cryptanalyzes any $N$ key cryptosystem in $N^{2/3}$ operations with $N^{2/3}$ words of memory (integer values) after a precomputation which requires $N$ operations. If the precomputation can be performed in a reasonable time period (e.g., several years), the additional computation required to recover each key compares very favourably with the $N$ operations required by an exhaustive search and the $N$ words of memory required by table lookup. When applied to the Data Encryption Standard (DES) used in block mode, it indicates that solutions should cose between \$1 and \$100 each. The method used is a chosen plaintext attack and, if cipher block chaining is not used, may also be used in a ciphertext-only attack.}

\T {Cryptel - The Practical Protection of an Existing Electronic Mail System}
\A {Hedwig Cnudde}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper describes the practical protection of an existing Electronic Mail System using the RSA-algorithm.}

\T {Crypt-Equivalent Algebraic Specifications}
\A {F. L. Bauer}
\A {M. Wirsing}
\J {Acta Informatica {\bf 25,} 2, pp. 111--153}
\D {1988}

\T {Cryptocomplexity and NP-Completeness}
\A {S. Even}
\A {Y. Yacobi}
\J {Automata, Languages and Programming, 7th Colloquium, Noordwijkerhout, Lecture Notes in Computer Science (85), Springer-Verlag}
\D {1980}
\X {In view of the known difficulty in solving NP-hard problems, a natural question is whether there exist cryptosystems which are NP-hard to crack. In Section~1 we display two such systems which are based on the knapsack problem. However, the first one, which is highly ``linear'' had been shown by Lempel to be almost always easy to crack. This shows that NP-hardness of a cryptosystem is not enough. Also, it provides the only natural problem we know of, which is NP-hard and yet almost always easy to solve. The second system is a form of a ``double knapsack'' and so far has resisted the cryptanalysis efforts. In Section~2 a  Public-Key Crypto-System (PKCS) is defined, and evidence is given that no such system can be NP-hard to break. This relates to the work of Brassard, et al., but the definition of PKCS leads us to a different cracking problem, to which Brassard's technique still applies, after proper modification.}

\T {A Crypto-Engine}
\A {George I. Davida}
\A {Frank B. Dancs}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {In this paper we present a design for a crypto-engine. We shall discuss the design and show the instruction set of this coprocessor and then show how this could be used to implement most of the known encryption algorithms. We will discuss why a coprocessor approach may be a better solution than adoption of specific encryption algorithms which can be broken or decertified.}

\T {Cryptographers Gather to Discuss Research}
\A {G. B. Kolata}
\J {Science Magazine {\bf 214,} pp. 646--647}
\D {1981}

\T {Cryptographically Secure Pseudorandom Sequence Generator Based on Reciprocal Number Cryptosystem}
\A {K. Kurosawa}
\A {K. Matsu}
\J {Elec. Letters {\bf 24,} 1, pp. 16--17}
\D {1988}

\T {Cryptographic Capsules: A Disjunctive Primitive for Interactive Protocols}
\A {Josh Cohen Benaloh}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Cryptographic Computation: Secure Fault-Tolerant Protocols and the Public-Key Model}
\A {Zvi Galil}
\A {Stuart Haber}
\A {Moti Yung}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {We give a general procedure for designing correct, secure, and fault-tolerant cryptographic protocols for many parties, thus enlarging the domain of tasks that can be performed efficiently by cryptographic means. We model the most general sort of feasible adversarial behaviour, and describe fault-recovery procedures that can tolerate it. Our constructions minimize the use of cryptographic resources. By applying the complexity-theoretic approach to knowledge, we are able to measure and control the computational knowledge released to the various users, as well as its temporal availability.}

\T {Cryptographic Limitations on Learning Boolean Formulae and Finite Automata}
\A {Michael Kearns}
\A {Leslie G. Valiant}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}

\T {Cryptographic Sealing for Information Secrecy and Authentication}
\A {David K. Gifford}
\J {C ACM {\bf25,} 4}
\D {1982}
\X {A new protection mechanism is described that provides general primitives
for protection and authentication. The mechanism is based on the idea of
sealing an object with a key. Sealed objects are self-authenticating, and in
the absence of an appropriate set of keys, only provide information about the
size of their contents. New keys can be freely created at any time, and keys
can also be derived from existing keys with operators that include {\em
Key-And\/} and {\em Key-Or\/.} This flexibility allows the protection mechanism
to implement common protection mechanisms such as capabilities, access control
lists, and information flow control. The mechanism is enforced with a synthesis
of conventional cryptography, public-key cryptography, and a threshold scheme.}

\T {The Cryptographic Security of the Sum of Bits}
\A {Richard Berger}
\A {Howard J. Karloff}
\A {David Shmoys}
\J {Technical Report: 190, University of California, Berkeley}
\D {1984}

\T {The Cryptographic Security of Truncated Linearly Related Variables}
\A {Johan Hastad}
\A {Adi Shamir}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}
\X {In this paper we describe a polynomial time algorithm for computing the values of variables $x_1,\ldots,x_k$ when some of their bits and some linear relationships between them are known. The algorithm is essentially optimal in its use of information in the sense that it can be applied as soon as the values of the $x_i$ become uniquely determined by the constraints. Its cryptanalytic significance is demonstrated by two applications: breaking linear congruential generators whose outputs are truncated, and breaking Blum's protocol for exchanging secrets.}

\T {Cryptography}
\A {D. Coppersmith}
\J {IBM J. of Research and Development {\bf 31,} pp. 244--248}
\D {1987}

\T {Cryptography and Data Security}
\A {Dorothy Elizabeth Robling Denning}
\J {Addison-Wesley Publishing Company}
\D {1982}
\X {1. Introduction, introduces the basic concepts of cryptography, data security, information theory, complexity theory, and number theory. 2. Encryption Algorithms, describes both classical and modern encryption algorithms, including the Data Encryption Standard (DES) and public-key algorithms. 3. Cryptographic Techniques, studies various techniques related to integrating cryptographic controls into computer systems, including key management. 4. Access Controls, describes the basic principles of mechanisms that control access by subjects (e.g., users or programs) to objects *e.g., files and records). These mechanisms regulate direct access to objects, but not what happens to the information contained in these objects. 5. Information Flow Controls, describes controls that regulate the dissemination of information. These controls are needed to prevent programs from leaking confidential data, or from disseminating classified date to users with lower security clearances. 6. Inference Controls, describes controls that protect confidential data released as statistics about subgroups of individuals.}

\T {Cryptography: A New Dimension in Computer Data Security}
\A {C. H. Meyer}
\A {S. M. Matyas}
\J {John Wiley \& Sons, New York, NY}
\D {1982}

\T {Cryptography: A Primer}
\A {A. G. Konheim}
\J {John Wiley \& Sones, New York, NY}
\D {1981}

\T {Cryptography in the Private Sector}
\A {D. B. {Newman Jr.}}
\A {R. L. Pickholtz}
\J {IEEE Communications Magazine {\bf 24,} pp. 7--10}
\D {1986}

\T {Cryptography with Cellular Automata}
\A {Stephen Wolfram}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Cryptology}
\A {G. Brassard}
\J {Encyclopaedia of Mathematics, {\bf 2,} D.~Reidel Publishing Company}
\D {1988}

\T {Cryptology and Complexity Theories}
\A {G. Ruggiu}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Complexity Theories have recently been proposed as a basis for evaluation of crypto machine performance. They are compared to Shannon's model. They shed a new highlight on randomness notion. But it is stressed that the statistical point of view remains the more secure.}

\T {Cryptology In Academia: A Ten Year Perspective}
\A {G. Brassard}
\J {Proc. of the 29th IEEE Computer Conference (CompCon), pp. 222--226}
\D {1987}

\T {Cryptology In Transistion}
\A {A. Lempel}
\J {ACM Computing Surveys {\bf 11,} pp. 285--303}
\D {1979}

\T {Cryptology --- Methods and Maxims}
\A {Friedrich L. Bauer}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {This paper gives a survey of classical cryptographic methods and of the maxims to their proper use in order to resist illegitimate decryption, as a basis for an understanding of modern commercial, computer-based cryptographic systems and for a critical analysis of those.}

\T {Cryptoprotocols: Subscription to a Public Key, the Secret Blocking and the Multi-Player Mental-Poker Game}
\A {Mordechai Yung}
\J {Technical Report: CUCS-137-84, University of Columbia}
\D {1984}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {Investigating the capabilities of public key and related cryptographic techniques has recently become an important area of cryptographic research. In this paper we present some new algorithms and cryptographic protocols ({\em Cryptoprotocols\/}) which enlarge the range of applications of public key systems and enable us to perform certain transactions in communication networks. The basic cryptographic tools used are Rabin's {\em Oblivious Transfer Protocol\/} and an algorithm we developed for {\em Number Embedding\/} which is provably hard to invert. We introduce the protocol {\em Subscription to a Public Key,} which gives a way to transfer keys over insecure communication channels and has useful applications to cryptosystems. We develop the {\em Secret Blocking Protocol,} specified as follows: `A transfers a secret to B, B can block the message. If B does not block it, there is a probability $P$ that he might get it. ($1/2\le P<1,$ where we can control the size of $P$). A does not know if the message was blocked (but he can find out later)'. The classic cryptotransaction is the {\bf Mental Poker Game.} A cryptographically secure solution to the {\bf Multi Player\/} Mental Poker Game is given. The approach used in constructing the solution provides a general methodology of provable and modular {\bf Protocol Composition.}}

\T {Crypto-Secure Operating System}
\A {George I. Davida}
\A {Brian J. Matt}
\J {AFIPS Conference Proc., {\bf 54,} National Computer Centre}
\D {1985}
\X {Enforcement of security policies in most computer systems is carried out by
a centralized mechanism, usually the operating system kernel. Such mechanisms
strip users of having complete control over access to their property. This
paper describes a system that allows the user to determine the security policy
to be enforced by independent, secure processes called Guardians. The system
provides more flexible security environments for users. In addition,
penetration of part of the system does not jeopardize the security of the whole
because resources are not owned entirely by one ``super user.'' The mechanisms
rely heavily on encryption which mediates access to objects in the system. The
role of the system is reduced to that of a messenger, and although it is
possible to deny service, the security of the system is not compromised.}

\T {Cryptosystem Based On an Analog of Heat Flow}
\A {G. R. Blakley}
\A {William Rundell}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {A Cryptosystem for Multiple Communication}
\A {F. Luccio}
\A {S. Mazzone}
\J {Information Processing Letters {\bf 10,} 4--5}
\D {1980}

\T {The Cuckoo's Egg: Tracing a Spy Through the Maze of Computer Espionage}
\A {Cliff Stoll}
\J {Doubleday}
\D {1989}

\T {Cycle Structure of the DES with Weak and Semi-Weak Keys}
\A {Judy H. Moore}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {A D0L-T0L Public Key Cryptosystem}
\A {K. G. Subramanian}
\A {Rani Siromoney}
\A {P. Jeyanthi Abisha}
\J {Info. Proc. Letters {\bf 26,} 2}
\D {1987}

\T {A Database Encryption Scheme Which Allows the Computation of Statistics Using Encrypted Data}
\A {G. R. Blakley}
\A {C. Meadows}
\J {Proc. of IEEE Symp. on Comp. Security and Privacy}
\D {1985}

\T {Database-Security}
\A {D. E. Denning}
\J {Annual Review of Comp. Sc. {\bf 3,} pp. 1--22}
\D {1988}

\T {Database Security and Integrity}
\A {E. B. Fernandez}
\A {R. C. Summers}
\A {C. Wood}
\J {The Systems Programming Series, Addison-Wesley}
\D {1981}
\X {This book is concerned with the security and integrity of information that is maintained in databases. Topics that are central to this concern are treated in depth, and important related topics are introduced. The book is aimed at a reader with some technical background in the computing field and with a serious interest in database security.}

\T {Data Compression}
\A {Debra A. Lelewer}
\A {Daniel S. Hirschberg}
\J {ACM Computing Surveys {\bf 19,} 3}
\D {1987}
\X {This paper surveys a variety of data compression methods spanning almost 40
years of research, from the wrok of Shannon, Fano, and Huffman in the late
1940s to a technqiue developed in 1986. The aim of data compression is to
reduce redundancy in stored or communicated data, thus increasing effective
data density. Data compression has important application in the areas of file
storage and distributed systems. Concepts from information theory as they
relate to the goals and evaluation of data compression methods are discussed
briefly. A framework for evaluation and comparison of methods is constructed
and applied to the algorithms presented. Comparisons of both theoretical and
empirical natures are reported, and possibilities for ruture research are
suggested.}

\T {Data Compression and Gray-code Sorting}
\A {D. Richards}
\J {Info. Proc. Letters {\bf 22,} 4}
\D {1986}

\T {Data Compression Using Dynamic Markov Modelling}
\A {G. V. Cormack}
\A {R. N. S. Horspool}
\J {The Computer Journal, {\bf 30,} 6}
\D {1987}
\X {A method of dynamically constructing Markov chain models that describe the characteristics of binary messages is developed. Such models can be used to predict future message characters and can therefore be used as a basis for data compression. To this end, the Markov modelling technique is combined with Guazzo's arithmetic coding scheme to produce a powerful method of data compression. The method has the advantage of being adaptive: messages may be encoded or decoded with just a single pass through the data. Experimental results reported here indicate that the Markov modelling approach generally achieves much better data compression than that observed with competing methods on typical computer data.}

\T {The Data Encryption Standard: Past and Future}
\A {Miles E. Smid}
\A {Dennis K. Branstad}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {The Data Encryption Standard (DES) is the first, and to the present date, only, publicly available cryptographic algorithm that has been endorsed by the U.S. Government. This paper deals with the past and future of the DES. It discusses the forces leading to the development of the standard during the early 1970s, the controversy regarding the proposed standard during the mid-1970s, the growing acceptance and use of the standard in the 1980s, and some recent developments that could affect the future of the standard.}

\T {The Dawn of a New Era for Quantum Cryptography: The Experimental Prototype is Working!}
\A {C. H. Bennett}
\A {G. Brassard}
\J {SIGACT News, {\bf 20,} 4, pp. 78--82}
\D {1989}

\T {Deciphering a Linear Congruential Encryption}
\A {Donald E. Knuth}
\J {IEEE Trans. on Info. Th. {\bf IT-31,} 1}
\D {1985}
\X {It is shown that the multiplier, the increment, and the seed value of a linear congruential random number generator on a binary computer can be deduced from the leading bits of the ``random'' numbers that are generated.}

\T {Deciphering Bronze Age Scripts of Crete: The Case of Linear A}
\A {Yves Duhoux}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Decrypting a Class of Stream Ciphers Using Ciphertext Only}
\A {T. Siegenthaler}
\J {IEEE Trans. on Computers, {\bf 34,} pp. 81--84}
\D {1985}

\T {Deliberate Noise in a Modern Cryptographic System}
\A {Michael Willett}
\J {IEEE Trans. on Info. Th. {\bf IT-26,} 1}
\D {1980}
\X {Methods for incorporating deliberate noise into classical or public key cryptosystems are discussed.}

\T {Demonstrating Possession of a Discrete Logarithm Without Revealing It}
\A {David Chaum}
\A {Jan-Hendrik Evertse}
\A {Jeroen {van de Graaf}}
\A {Ren\'e Peralta}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Techniques are presented that allow $A$ to convince $B$ that she knows a solution to the Discrete Log Problem---i.e. that she knows an $x$ such that $\alpha^x\equiv\beta(\mod N)$ holds---without revealing anything about $x$ to $B.$ Protocols are given both for $N$ prime and for $N$ composite. We prove these protocols secure under a formal model which is of interest in its own right. We also show how $A$ can convince $B$ that two elements $\alpha$ and $\beta$ generate the same subgroup in $Z_N^*,$ without revealing how to express either as a power of the other.}

\T {Demonstrating that a Public Predicate can be Satisfied Without Revealing Any Information About How}
\A {David Chaum}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Department of Defense ({DoD}) Password Management Guidelines}
\A {{Department of Defense}}
\J {Department of Defense, CSC-STD-002-85}
\D {1985}

\T {Design and Analysis of Stream Ciphers}
\A {R. Rueppel}
\J {Springer-Verlag}
\D {1986}

\T {Design of Combiners to Prevent Divide and Conquer Attacks}
\A {T. Siegenthaler}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {A finite state machine driven by $n$ independent sources each generating a $q$-ary sequence is investigated. The $q$-ary output sequence of that device is considered as the running-key sequence in a stream cipher. Possible definitions for Correlation-Immunity are discussed and a simple condition is given which ensures that divide-and-conquer attacks on such generators are prevented.}

\T {DES-Like Functions Can Generate the Alternating Group}
\A {Shimon Even}
\A {Oded Goldreich}
\J {IEEE Trans. on Info. Th. {\bf IT-29,} 6}
\D {1983}
\X {A set of transformations on binary vectors of length $n$ is defined. These transformations are similar to those of the data encryption standard (DES) and therefore are called DES-like functions. It is proved that the group of permutations generated by the DES-like functions is exactly the alternating group of the set of binary $n$ vectors.}

\T {Dependence of Output on Input in DES: Small Avalanche Characteristics}
\A {Yvo Desmedt}
\A {Jean-Jacques Quisquater}
\A {Marc Davio}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {New general properties in the $S$-boxes were found. Techniques and theorems are presented which allow to evaluate the non-substitution effect in $f$ and the key clustering in DES. Examples are given. Its importance related to the security of DES is discussed.}

\T {A Description of a Single-Chip Implementation of the RSA Cipher}
\A {R. L. Rivest}
\J {LAMBDA Magazine {\bf 1,} pp. 14--18}
\D {1980}

\T {DES Has No Per Round Linear Factors}
\A {J. A. Reeds}
\A {J. L. Manferdelli}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {Interest in the cryptanalysis of the National Bureau of Standards' Data Encryption Standard (DES) has been strong since its announcement. Here we describe an attack on a class of ciphers like DES based on linear factors. If DES had any non trivial factors, these factors would provide an easier attack than one based on complete enumeration. Basically, a factor of order $n$ reduces the cost of a solution from $2^{56}$ to $2^n+2^{56-n}.$ At worst ($n=1$ or 55), this reduces the cost of a Diffie-Hellman search machine from 20 million dollars to 10 million dollars: a 10 million dollar savings. At best ($n=28$), even without iteration, the method could reduce the cost from $2^{56}$ to $2^{28}+2^{28}:$ a computation well within the reach of a personal computer. Alas, DES has no such linear factors.}

\T {A Design Principle for Hash Functions}
\A {Ivan Bjerre Damg{\aa}rd}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We show that if there exists a computationally collision free function $f$ from $m$ bits to $t$ bits where $m>t,$ then there exists a computationally collision free function $h$ mapping messages of {\em arbitrary\/} polynomial lengths to $t$-bit strings. Len $n$ be the length of the message. $h$ can be constructed wither such that it can be evaluated in time linear in $n$ using 1 processor, or such that it takes time $O(\log(n))$ using $O(n)$ processors, counting evaluations of $f$ as one step. Finally, for any constant $k$ and large $n,$ a speedup by a factor of $k$ over the first construction is available using $k$ processors. Apart from suggesting a generally sound design principle for hash functions, our results give a unified view of several apparently unrelated constructions of hash functions proposed earlier. It also suggests changes to other proposed constructions to make a proof of security potentially easier. We give three concrete examples of constructions, based on modular squaring, on Wolfram's pseudorandom bit generator, and on the knapsack problem.}

\T {Designing a Mainframe Security Module}
\A {Ross J. Anderson}
\J {Proc Infosec 89 pp. 75--87}
\D {1990}
\X {The most extensive use made of cryptography in the financial sector is in 
the management of personal identification numbers (PINs) for automatic teller
machines. Ensuring that PINs are known only to the customer means using tamper
proof devices known as security modules. The design and construction of such a
device is described, including hardware, software and performance.}

\T {DES-Like Functions Can Generate the Alternating Group}
\A {S. Even}
\A {O. Goldreich}
\J {IEEE Trans. on Info. Th. {\bf IT-29,} 6, pp. 863--865}
\D {1983}

\T {DES Modes of Operation}
\A {NBS}
\J {Federal Information Processing Standard, U.S. Dept. of Commerce, FIPS PUB 81, Washington DC}
\D {1980}

\T {DES Will Be Totally Insecure Within Ten Years}
\A {Martin E. Hellman}
\J {IEEE Spectrum, July}
\D {1979}

\T {The Detection of Cheaters in Threshold Schemes}
\A {E. F. Brickell}
\A {D. R. Stinson}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Informally, a $(t,w)$-{\em threshold scheme\/} is a way of distributing partial information ({\em shadows\/}) to $w$ participants, so that any $t$ of them can easily calculate a {\em key\/} (or {\em secret\/}), but no subset of fewer than $t$ participants can determine the key. In this paper, we present an unconditionally secure threshold scheme in which any cheating participant can be detected and identified with high probability by any honest participant, even if the cheater is in coalition with other participants. We also give a construction that will detect with high probability a dealer who distributes inconsistent shadows (shares) to the honest participants. Our scheme is not perfect; a set of $t-1$ participants can rule out at most $\displaystyle 1+{w-t+1\choose t-1}$ possible keys, given the information they have. In our scheme, the key will be an element of $GF(q)$ for some prime power $q.$ Hence, $q$ can be chosen large enough so that the amount of information obtained by any $t-1$ participants is negligible.}

\T {Detection of Disrupters in the DC Protocol}
\A {Jurjen Bos}
\A {Bert den Boer}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Developing an RSA Chip}
\A {Martin Kochanski}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Developing Ethernet Enhanced-Security Systems}
\A {B. J. Herbison}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {The Ethernet Enhanced-Security System (EESS) provides encryption of Ethernet frames using the DES algorithms with pairwise keys, and a centralized key distribution center (KDC) using a variation of the Needham and Schroeder key distribution protocol. This paper is a discussion of some practical problems that arose during the development of this system. Section 1 contains an overview of the system and section 2 provides more detail on the system architecture. The remaining sections discuss various problem that were considered during the development and how they were resolved.}

\T {Diffie-Hellman is as Strong as Discrete Log for Certain Primes}
\A {Bert den Boer}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Diffie and Hellman proposed a key exchange scheme in 1976, which got their name in the literature afterwards. In the same epoch-making paper, they conjectured that breaking their scheme would be as hard as taking discrete logarithms. This problem has remained open for the multiplicative group modulo a prime $P$ that they originally proposed. Here it is proven that both problems are (probabilistically) polynomial-time equivalent if the totient of $P-1$ has only small prime factors with respect to a (fixed) polynomial in $^2\log P.$ There is no algorithm known that solves the discrete log problem in probabilistic polynomial time for the this case, i.e., where the totient of $P-1$ is smooth. Consequently, either there exists a (probabilistic) polynomial algorithm to solve the discrete log problem when the totient of $P-1$ is smooth or there exists primes (satisfying this condition) for which Diffie-Hellman key exchange is secure.}

\T {A Digital Multisignature Scheme Using Bijective Public-Key Cryptosystems}
\A {T. Okamoto}
\J {ACM Trans. on Comp. Sys. {\bf 6,} 4, pp. 432--441}
\D {1988}

\T {A Digital Signature Based On A Conventional Encryption Function}
\A {Ralph C. Merkle}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {A new digital signature based only on a conventional encryption function (such as DES) is described which is as secure as the underlying encryption function---the security does not depend on the difficulty of factoring and the high computational costs of modular arithmetic are avoided. The signature system can sign an unlimited number of messages, and the signature size increases logarithmically as a function of the number of messages signed. Signature size in a `typical' system might range from a few hundred bytes to a few kilobytes, and generation of a signature might require a few hundred to a few thousand computations of the underlying conventional encryption function.}

\T {Digital Signatures---An Overview}
\A {S. Matyas}
\J {Computer Networks {\bf 3,} pp. 87--94}
\D {1979}

\T {A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks}
\A {Shafi Goldwasser}
\A {Silvio Micali}
\A {Ronald L. Rivest}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {We present a digital signature scheme based on the computational difficulty of integer factorization. The scheme possesses the novel property of being robust against an adaptive chosen-message attack: an adversary who receives signatures for messages of his choice (where each message may be chosen in a way that depends on the signatures of previously chosen messages) cannot later forge the signature of even a single additional message. This may be somewhat surprising, since in the folklore the properties of having forgery being equivalent to factoring and being invulnerable to an adaptive chosen-message attack were considered to be contradictory. More generally, we show how to construct a signature scheme with such properties based on the existence of a ``claw-free'' pair of permutations---a potentially weaker assumption than the intractability of integer factorization. The new scheme is potentially practical: signing and verifying signatures are reasonably fast, and signatures are compact.}

\T {Digital Signatures with RSA and Other Public-Key Cryptosystems}
\A {D. E. R. Denning}
\J {C ACM {\bf 27,} pp. 388--392}
\D {1984}

\T {Dining Cryptographers Problem, the: Unconditional Sender and Recipient Untraceability}
\A {David Chaum}
\J {J. of Cryptology, {\bf 1,} pp. 65--75}
\D {1988}
\X {Keeping confidential who sends which messages, in a  world where any physical transmission can be traced to its  origin, seems impossible. The solution presented here is unconditionally or cryptographically secure, depending on whether it is based on one-time-use keys or on public keys, respectively. It can be adapted to address efficiently a wide variety of practical considerations.}

\T {Direct Minimum-Knowledge Computations}
\A {Russell Impagliazzo}
\A {Moti Yung}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {We present a protocol scheme which {\em directly\/} simulates any given computation, defined on any computational device, in a {\em minimum-knowledge\/} fashion. We also present a scheme for simulation of computation is {\em dual\/} (perfect) {\em minimum-knowledge\/} fashion. Using the simulation protocol, we can assure that one user transfers to another user exactly the result of a given computation and nothing more. The simulation is direct and efficient; it extends, simplifies and unifies important recent results resultswhichwhich have useful applications in cryptographic protocol design. Our technique can be used to implement several different sorts of transfer of knowledge, including: transfer of computational results, proving possession of information, proving knowledge of knowledge, gradual and adaptive revealing of information, and commitment to input values. The novelty of the simulation technique is the separation of the data encryption from the encryption of the device's structural (or control) information.}

\T {The Discrete Logarithm Hide $O(\log n)$ Bits}
\A {Douglas L. Long}
\A {Avi Wigderson}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {The main result of this paper is that obtaining any information about the $O(\log|p|)$ ``most significant'' bits of $x,$ given $g^x(\mod p),$ even with a tiny advantage over guessing, is equivalent to computing discrete logarithms mod $p.$}

\T {A Discrete Logarithm Implementation of Zero-Knowledge Blobs}
\A {J. F. Boyar}
\A {M. W. Krentel}
\A {S. A. Kurtz}
\J {Technical Report 87-002, University of Chicago}
\D {1987}

\T {Discrete Logarithms in Finite Fields and Their Cryptographic Significance}
\A {A. M. Odlyzko}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Given a primitive element $g$ of a finite field $GF(q),$ the discrete logarithm of a nonzero element $u\in GF(q)$ is that integer $k,$ $1\le k\le q-1,$ for which $u=g^k.$ The well-known problem of computing discrete logarithms in finite fields has acquired importance in recent years due to its applicability in cryptography. Several cryptographic systems would become insecure if an efficient discrete logarithm algorithm were discovered. This paper surveys and analyzes known algorithms in this area, with special attention devoted to algorithms for the fields $GF(2^n).$ It appears that in order to be safe from attacks using these algorithms, the value of $n$ for which $GF(2^n)$ is used in a cryptosystem has to be very large and carefully chosen. Due in large part to recent discoveries, discrete logarithms in fields $GF(2^n)$ are much easier to compute than in fields $GF(p)$ with $p$ prime. Hence the fields $GF(2^n)$ ought to be avoided in all cryptographic applications. On the other hand, the fields $GF(p)$ with $p$ prime appear to offer relatively high levels of security.}

\T {Discrete Logarithms in {\bf GF$(p)$}}
\A {D. Coppersmith}
\A {A. M. Odlyzko}
\A {R. Schroeppel}
\J {Algorithmica {\bf 1,} pp. 1--15}
\D {1986}

\T {Discrete Utterance Speech Recognition Without Time Alignment}
\A {John E. Shore}
\A {David K. Burton}
\J {IEEE Trans. on Info. Th. {\bf IT-29,} 4}
\D {1983}
\X {The results of a new method are presented for discrete utterance speech recognition. The method is based on rate-distortion speech coding (speech coding by vector quantization), minimum cross-entropy pattern classification, and information-theoretic spectral distortion  measures. Separate vector quantization code books are designed from [?] sequences for each word in the recognition vocabulary. Inputs from outside the training sequence are classified by performing vector quantization and finding the code book that achieves the lowest average distortion per speech frame. The new method obviates time alignment. It achieves 99 percent accuracy for speaker-dependent recognition of a 20-word vocabularly that includes the ten digits, with higher accuracy for recognition of the digit subset. For speaker-independent recognition, the method achieves 88 percent accuracy for the 20-word vocabularly and 95 percent for the digit subset. Background of the method, detailed empirical results, and an analysis of computational requirements are presented.}

\T {Disposable Zero-Knowledge Authentication and Their Applications to Untraceable Electronic Cash}
\A {Tatsuaki Okamoto}
\A {Kazuo Ohta}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In this paper, we propose a new type of authentication system, {\em disposable zero-knowledge authentication system.} Informally speaking, in this authentication system, double usage of the same authentication is prevented. Based on these disposable zero-knowledge authentication systems, we propose a new {\em untraceable electronic cash\/} scheme satisfying both {\em untraceability\/} and {\em unreusability.} This scheme overcomes the problems of the previous scheme proposed by Chaum, Fiat and Naor through its greater efficiency and provable security under reasonable cryptographic assumptions. We also propose a scheme, {\em transferable untraceable electronic cash\/} scheme, satisfying {\em transferability\/} as well as the above two criteria, whose properties have not been previously proposed in any other scheme. Moreover, we also propose a new type of electronic cash, {\em untraceable electronic coupon ticket,} in which the value of one piece of the electronic cash can be subdivided into many pieces.} 

\T {Distributing the Power of a Government to Enhance the Privacy of Voters}
\A {J. D. Benaloh}
\A {M. Yung}
\J {Proceedings of the 5th ACM Symp. on Distributed Computing}
\D {1986}

\T {Divergence Bounds On Key Equivocation and Error Probability in Cryptanalysis}
\A {Johan {van Tilburg}}
\A {Dick E. Boekee}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {A general methods, based on the $f$-divergence (Csiszar) is presented to obtain divergence bounds on error probability and key equivocation. The method presented here is applicable for discrete data as well as for continuous data. As a special case of the $f$-divergence it is shown that the upper bound on key equivocation derived by Blom is of the Bhattacharyya type. For a pure cipher model using a discrete memoryless message source a recursive formula is derived for the error probability. A generalization of the $\beta$-unicity distance is given, from which it is shown why the key equivocation is a poor measure of theoretical security in many cases, and why lower bounds on error probability must be considered instead of upper bounds. Finally the concept of unicity distance is generalized in terms of the error probability and is called the Pe-Security Distance.}

\T {Divertible Zero Knowledge Interactive Proofs and Commutative Random Self-Reducibility}
\A {Tatsuaki Okamoto}
\A {Kazuo Ohta}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper, a new class of zero knowledge interactive proofs, a {\em divertible\/} zero knowledge interactive proof is presented. Informally speaking, we call $(A,B,C),$ a triplet of Turing machines, a divertible zero knowledge interactive proof, if $(A,B)$ and $(B,C)$ are zero knowledge interactive proofs and $B$ converts $(A,B)$ into $(B,C)$ such that any evidence regarding the relationship between $(A,B)$ and $(B,C)$ is concealed. It is shown that any {\em commutative random self-reducible\/} problem, which is a variant of the {\em random self-reducible\/} problem introduced by Angluin et al., has a divertible perfect zero knowledge interactive proof. We also show that a specific class of the commutative random self-reducible problems have {\em more practical\/} divertible prefect zero knowledge interactive proofs. This class of zero knowledge interactive proofs has two sides; one positive, the other negative. On the positive side, divertible zero knowledge interactive proofs can be used to protect privacy in networked and computerized environments. Electronic checking and secret electronic balloting are described in this paper to illustrate this side. On the negative side, identification systems based on these zero knowledge interactive proofs are vulnerable to an abuse, which is, however, for the most part common to all logical identification schemes. This abuse and some measures to overcome it are also presented.}

\T {Does co-NP Havse Short Interactive Proofs?}
\A {R. B. Boppana}
\A {J. Hastad}
\A {S. Zachos}
\J {Info. Proc. Letters {\bf 25,} 6}
\D {1987}
\X {Babai and Goldwasser, Micali and Rackoff introduced two probabilistic
extensions of the complexity class NP. The two complexity classes, denoted
AM[Q] and IP[Q] respectively, are defined using randomized interactive proofs
between a prover and veifier. Goldwasser and Sipser proved that the two classes
are equal. We prove that if the complexity class co-NP is contained in IP[k]
for some constant k (i.e., if every language in co-NP has a short interactive
proof), then the polynomial-time hierarchy collapses to the second level. As a
corollary, we show that if the Graph Isomorphism problem is NP-complete, then
the polynomial-time hierarchy collapses.}

\T {Draft Proposed American National Standard for Retail Key Management}
\A {ANSI X9.24}
\J {American Bankers Association}
\D {1988}

\T {Dynamic Threshold Scheme Based On the Definition of Cross-Product in an $N$-Dimensional Linear Space}
\A {Chi-Sung Laih}
\A {Lein Harn}
\A {Jau-Yien Lee}
\A {Tzonelih Hwang}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {This paper investigates the characterizations of threshold/ramp schemes which give rise to the time-dependent threshold schemes. These schemes are called the ``dynamic threshold schemes'' as compared to the conventional time-independent threshold scheme. In a $(d,m,n,T)$ dynamic threshold scheme, there are secret shadows and a public shadow, $p^j,$ at time $t=t_j,$ $1\le t_j\le T.$ After knowing any $m$ shadows, $m\le n,$ and the public shadow, $p^j,$ we can easily recover $d$ master keys, $K_1^j, K_2^j, \ldots,$ and $K_d^j.$ Furthermore, if the $d$ master keys have to be changed to $K_1^{j+1}, K_2^{j+1}, \ldots,$ and $K_d^{j+1}$ for some security reasons, only the public shadow, $p^j,$ has to be changed to $p^{j+1}.$ All the $n$ secret shadows issued initially remain unchanged. Compared to the conventional threshold/ramp schemes, at least one of the previous issued $n$ shadows need to be changed whenever the master keys need to be updated for security reasons. A $(1,m,n,T)$ dynamic threshold scheme based on the definition of cross-product in an $N$-dimensional linear space is proposed to illustrate the characterizations of the dynamic threshold schemes.}

\T {Echanges {T}\'{e}l\'ematiques entre les Banques et leurs Clients, Standard {ETEBAC} 5, v1.1}
\A {Comit\'{e} Fran\c{c}ais d'Organisation et de Normalisation Bancaire}
\J {Paris}
\D {1989}

\T {Efficient and Portable Combined Random Number Generators}
\A {Pierre L'Ecuyer}
\J {CACM {\bf 31,} 6}
\D {1988}
\X {In this paper we present an efficient way to combine two or more Multiplicative Linear Congruential Generators (MLCGs) and profile several new generators. The individual MLCGs, making up the proposed combined generators, satisfy stringent theoretical criteria for the quality of the sequence they produced (based on the Spectral Test) and are easy to implement in a portable way. The proposed simple combination method is new and produces a generator whose period is the least common multiple of the individual periods. Each proposed generator has been submitted to a comprehensive battery of statistical tests. We also describe portable implementation, using 16-bit or 32-bit integer arithmetic. The proposed generators have most of the beneficial properties of MLCGs. For example, each generator can be split into many independent generators and it is easy to skip a long subsequence of numbers without doing the work of generating them all.}

\T {Efficient and Secure Pseudo-Random Number Generation}
\A {Umesh V. Vazirani}
\A {Vijay V. Vazirani}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\J {Proc. of the 25th IEEE Symposium on Foundations of Comp. Sc., pp. 458--463}
\D {1983}
\X {Cryptographically secure pseudo-random number generators known so far suffer from the handicap of being inefficient; the most efficient ones can generate only one bit on each modular multiplication ($n^2$ steps). Blum, Blum and Shub ask the open problem of outputting even two bits securely. We state a simple condition, the {\bf XOR-Condition,} and show that {\bf any generator} satisfying this condition can output $\log n$ bits on each multiplication. We also show that the $\log n$ least significant bits of RSA, Rabin's Scheme, and the $x^2\mod N$ generator satisfy this condition. As a corollary, we prove that all boolean predicates of these bits are secure. Furthermore, we strengthen the security of the $x^2\mod N$ generator, which being a Trapdoor Generator, has several applications, by proving it {\bf as hard as Factoring.}}

\T {Efficient Dispersal of Information for Security Load Balancing, and Fault
Tolerance}
\A {Michael O. Rabin}
\J {J ACM {\bf 36,} 2}
\D {1989}
\X {An Information Dispersal Algorithm (IDA) is developed that breaks a file
$F$ of length $L=|F|$ into $n$ pieces $F_i,$ $1\le i\le n,$ each of length
$|F_i|=L/m,$ so that evey $m$ pieces suffice for reconstructing $F.$ Dispersal
and reconstruction are computationally efficient. The sum of the lengths
$|F_i|$ is $(n/m)\cdot L.$ Since $n/m$ can be chosen to be close to 1, the IDA
is space efficient. IDA has numerous applications to secure and reliable
storage of information in computer netowkrs and even on single disks, to
fault-tolerant and efficient transmission of information in networks, and to
communications between processors in parallel computations. For the latter
problem provably time-efficient and highly fault-tolerant routing on the
$n$-cube is achieved, using just constant size buffers.}

\T {Efficient Factoring Based On Partial Information}
\A {Ronald L. Rivest}
\A {Adi Shamir}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Efficient Hardware Implementation of the DES}
\A {Frank Hoornaert}
\A {Jo Goubert}
\A {Yvo Desmedt}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {Several improvements to realize implementations for DES are discussed. One proves that the initial permutation and the inverse initial permutation can be located at the input, respectively the output of each mode in DES. A realistic design for an exhaustive key search machine is presented.}

\T {Efficient Identification and Signatures for Smart Cards}
\A {C. P. Schnorr}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {An Efficient Identification Scheme Based on Permuted Kernels}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In 1985 Goldwasser Micali and Rackoff proposed a new type of interactive proof system which reveals no knowledge whatsoever about the assertion except its validity. The practical significance of these proofs was demonstrated in 1986 by Fiat and Shamir, who showed how to use efficient zero knowledge proofs of quadratic residuosity to establish user identities and to digitally sign messages. In this paper we propose a new zero knowledge identification scheme, which is even faster than the Fiat-Shamir scheme, using a small number of communicated bits, simple 8-bit arithmetic operations, and compact public and private keys. The security of the new scheme depends on an $NP$-complete algebraic problem rather than on factoring, and thus it widens the basis of public key cryptography, which has become dangerously dependent on the difficulty of a single problem.}

\T {Efficient Identification Schemes Using Two Prover Interactive Proofs}
\A {Michael Ben-Or}
\A {Shafi Goldwasser}
\A {Joe Kilian}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We present two efficient identification schemes based on the difficulty of solving the subset sum problem and the circuit satisfiability problem. Both schemes use the two prover model, where the verifier (e.g. the Bank) interacts with two untrusted provers (e.g. two bank identification cards) who have jointly agreed on a strategy to convince the verifier of their identity. To believe the validity of their identity proving procedure, the verifier must make sure that the two provers can not communicate with each other during the course of the proof process. In addition to the simplicity and efficiency of the schemes, the resulting two prover interactive proofs can be shown to be perfect zero knowledge, making no intractability assumptions.}

\T {Efficient Offline Electronic Checks}
\A {David Chaum}
\A {Bert den Boer}
\A {Eug\'ene {van Heyst}}
\A {Stig Mj{\o}lsnes}
\A {Adri Steenbeek}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Chaum, Fiat, and Naor proposed an offline check system, which has the advantage that the withdrawal and (anonymous) payment of a check are unlinkable. Here we present an improved protocol that saves 91\% of the signatures, 41\% of the other multiplications, 73\% of the divisions, and 33\% of the bit transmissions.}

\T {Efficient Parallel Pseudorandom Number Generation}
\A {J. H. Reif}
\A {J. D. Tygar}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {We present a parallel algorithm for pseudorandom number generation. Given a seed of $n^\epsilon$ truly random bits for any $\epsilon>0,$ our algorithm generates $n^c$ pseudorandom bits for any $c>1.$ This takes poly-log time using $n^{\epsilon^\prime}$ processors where $\epsilon^\prime = k\epsilon$ for some fixed small constant $k>1.$ We show that the pseudorandom bits output by our algorithm cannot be distinguished from truly random bits in parallel poly-log time using a polynomial number of processors with probability ${1\over2}+1/n^{O(1)}$ if the Multiplicative Inverse Problem almost always cannot be solved in {\bf RNC.} The proof is interesting and is quite different from previous proofs for sequential pseudorandom number generators. Our generator is fast and its output is provably as effective for {\bf RNC} algorithms as truly random bits. Our generator passes all the statistical tests in Knuth. Moreover, the existence of our generator has a number of central consequences for complexity theory. Given a randomized parallel algorithm {\cal A} (over a wide class of machine models such as parallel RAMs and fixed connection networks) with time bound $T(n)$ and processor bound $P(n),$ we show that {\cal A} can be simulated by a parallel algorithm with time bound $T(n)+O((\log n)(\log\log n)),$ processor bound $P(n)n^\epsilon,$ and using only $n^\epsilon$ truly random bits for any $\epsilon>0.$ Also, we show that if the Multiplicative Inverse Problem is almost always not in {\bf RNC,} the {\bf RNC} is within the class of languages accepted by uniform poly-log depth circuits with unbounded fan-in and strictly subexponential size $\bigcup_{\epsilon>0} 2^{n^\epsilon}.$}

\T {Efficient, Perfect Random Number Generators}
\A {S. Micali}
\A {C. P. Schnorr}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {We describe a method that transforms every perfect random number generator into one that can be accelerated by parallel evaluation. Our methods of parallelization is perfect, $m$ parallel processors speed the generation of pseudo-random bits by a factor $m;$ these parallel processors need not to communicate. Using sufficiently many parallel processors we can generate pseudo-random bits with nearly any speed. These parallel generators enable fast retrieval of substrings of very long pseudo-random strings. Individual bits of pseudo-random strings of length $10^{20}$ can be accessed within a few seconds. We improve and extend the RSA-random number generator to a polynomial generator that is almost as efficient as the linear congruential generator. We question the existence of polynomial random number generators that are perfect and use a prime modulus.}

\T {{\em Efficient\/} Probabilistic Public-Key Encryption Scheme Which Hides All Partial Information}
\A {Manuel Blum}
\A {Shafi Goldwasser}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {This paper introduces the first probabilistic public-key encryption scheme which combines the following two properties: (1) {\bf Perfect secrecy with respect to polynomial time eavesdroppers:} For all message spaces, no polynomial time bounded passive adversary who is tapping the lines, can compute any partial information about messages from their encodings, unless {\bf factoring} composite integers is in probabilistic polynomial time. (2) {\bf Efficiency:} It compares favorably with the deterministic RSA public-key cryptosystem in both {\bf encoding} and {\bf decoding} and bandwidth expansion. The security of the system we propose can also be based on the assumption that the RSA function is intractable, maintaining the same cost for encoding and decoding and the same data expansion. This implementation may have advantages in practice.}

\T {An Efficient Signature Scheme Based on Quadratic Equations}
\A {H. Ong}
\A {C. P. Schnorr}
\A {A. Shamir}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {Electronic messages, documents and checks must be authenticated by digital signatures which are not forgeable even by their recipients. The RSA system can generate and verify such signatures, but each message requires hundreds of high precision modular multiplications which can be implemented efficiently only on special purpose hardware. In this paper we propose a new signature scheme which can be easily implemented in software on microprocessors: signature generation requires one modular multiplication and one modular division, signature verification requires three modular multiplications, and the key size is comparable to that of the RSA system. The new scheme is based on the quadratic equation $m=s_1^2+ks_2^2(\mod n),$ where $m$ is the message, $s_1$ and $s_2$ are the signature, and $k$ and $n$ are the publicly known key. While we cannot prove that the security of the scheme is equivalent to factoring, all the known methods for solving this quadratic equation for arbitrary $k$ require the extraction of square roots modulo $n$ of the solution of similar problems which are at least as hard as factoring. A novel property of the new scheme is that legitimate users can choose $k$ in such a way that they can sign messages even without knowing the factorization of $n,$ and thus everyone can use the same modulus if no one knows its factorization.}

\T {Efficient Signature Schemes Based On Polynomial Equations}
\A {H. Ong}
\A {C. P. Schnorr}
\A {A. Shamir}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {Signatures based on polynomial equations modulo $n$ have been introduced by Ong, Schnorr, Shamir. We extend the original binary quadratic OSS-scheme to algebraic integers. So far the generalised scheme is not vulnerable by the recent algorithm of Pollard for solving $s_1^2 + ks_2^2 = m(\mod n)$ which has broken the original scheme.}

\T {An Efficient Software Protection Scheme}
\A {Rafail Ostrovsky}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In 1979 Pippenger and Fischer showed how a two-tape Turing Machine whose head positions (as a function of time) are independent of the input, can simulate, one-line, a one-tape Turing Machine with a logarithmic slowdown in the running time. We show a similar result for random-access machine (RAM) model of computation. In particular, we show how to do an on-line simulation of arbitrary RAM program by probabilistic RAM whose memory access pattern is independent of the program which is being executed with a poly-logarithmic slowdown in the running time. A main application of our result concerns {\em software protection,} one of the most important issues in computer practice. A theoretical formulation of the problem for a generic one-processor, random-access machine (RAM) model of computation was given by Goldreich. In this paper, we present a simple and an efficient software protection scheme for this model. In particular, we show how to protect any program at the cost of a poly-logarithmic slowdown in the running time of the protected program, previously conjectured to be impossible.}

\T {Efficient Zero-Knowledge Identification Scheme For Smart Cards}
\A {Thomas Beth}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {In this paper we present a Fiat-Shamir like authentication protocol for the El-Gamal Scheme.}

\T {Ein Effizienzvergleich der Faktorisierungsverfahren von Morrison-Brillhart und Schroeppel}
\A {J. Sattler}
\A {C. P. Schnorr}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {Die Algorithmen von Morrison-Brillhart und Schroeppel sind f\"ur gro\ss e nat\"ur\-liche Zahlen (allgemeiner Gestalt und bez\"ugl. der worst-case-Rechenzeit) die effizientesten aller bis heute bekannten Faktorisierungsalgorithmen. Der vorgelegte Effizienzvergleich basiert auf einer theoretischen Analyse, deren Annahmen experimentell verifiziert wurden. Wegen der \"ubergro\ss en Rechenzeiten ist n\"amlich ein experimenteller Vergleich der Laufzeiten beider Algorithmen f\"ur Zahlen $n>10^{50}$ zur Zeit technisch sehr schwierig. Die der Analyse zugrunde gelegten Annahmen betreffen das Verhalten der zahlentheoretischen Funktion $$\psi(n,v) := \#\{x\in[1,n]|(p \mbox{prim}\land p|x) \Rightarrow p\le v\}$$ sowie damit verwandter Funktionen. Entgegen den bisherigen Vermutungen k\"onen wir zeigen, da\ss\ der Morrison-Brillhart-Algorithmus dem Schroeppel-Algor\-ithmus f\"ur Zahlen aller Gr\"o\ss enbereiche \"uberlegen ist.}

\T {Elections with Unconditionally-Secret Ballots and Disruption Equivalent to Breaking RSA}
\A {David Chaum}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Electronic Funds Transfer Point Of Sale In Australia}
\A {Ralph Gyoery}
\A {Jennifier Seberry}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {The Australia wide eftpos systems was developed by the Australian Retail Banks to meet Australian conditions including a small population, which overwhelmingly uses cash for transactions, a small number of banks capable of ``exchange of value'' settlements and enormous distances. This paper discusses the system that has evolved first involving only ATM's and banks, then extending to POS systems for retailers and non bank financial institutions.}

\T {Elements of Cryptology}
\A {M. Davio}
\A {J. Geothals}
\J {Secure Digital Communications, G.~Longo(ed.), pp. 1--57}
\D {1983}

\T {Elliptic Curve Cryptosystems}
\A {N. Koblitz}
\J {Mathematics of Computation {\bf 48,} pp. 203--209}
\D {1987}

\T {Embedding Cryptographic Trapdoors in Arbitrary Knapsack Systems}
\A {A. Shamir}
\J {Info. Proc. Letters {\bf 17,} 2}
\D {1983}
\X {In this paper we show that after sufficiently many modular multiplications,
any knapsack system becomes a trapdoor system that can be used in public-key
cryptography.}

\T {The Empirical Evaluation of a Security-Oriented Datagram Protocol}
\A {David P. Anderson}
\A {D. Ferrari}
\A {P. V. Rangan}
\A {B. Sartirana}
\J {Technical Report: 350, University of California, Berkeley}
\D {1987}

\T {Encrypting by Random Rotations}
\A {N. J. A. Sloane}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {This paper gives some well-known, little known, and new results on the problem of generating random elements in groups, with particular emphasis on applications to cryptography. The groups of greatest interest are the group of all orthogonal $n\times n$ matrices and the group of all permutations of a set. The chief application is to A.~D.~Wyner's analog scrambling scheme for voice signals.}

\T {Encrypting Problem Instances}
\A {Joan Feigenbaum}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {An Encryption and Authentication Procedure for Telesurveillance Systems}
\A {Odoardo Brugia}
\A {Salvatore Improta}
\A {William Wolfowicz}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {To perform message authentication in a telesurveillance system, the paper proposes a non linear time varying encryption algorithm, based on key layering in three levels (system key, intermediate key, running key) and on encryption organization into two or more sets of three operations (running key rotation, message digit substitution and transposition). The algorithm was designed to be implemented on an 8-bit microprocessor.}

\T {Encryption and Key Management for the ECS Satellite Service}
\A {S. C. Serpell}
\A {C. B. Brookson}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {This contribution describes the encryption and key management techniques realised with prototype hardware by British Telecom Research for use on the SatStream service offered on the European Communication Satellite. The security objectives, channel unit functions and operation, encryption methods and key management systems are described.}

\T {Encryption: Needs, Requirements and Solutions in Banking Networks}
\A {U. Rimensberger}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Engineering Secure Information Systems}
\A {Donald W. Davies}
\A {Wyn L. Price}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {This paper gives a brief survey of the authors' experience in designing and assessing systems for the secure processing and transmission of information in electronic media. It considers the range of encipherment algorithms currently available in the civil field for use in protecting financial transactions and the like. As a consequence of using encipherment, key management must be properly engineered and the right physical environment provided for the various sensitive functions. Finally some of the management aspects of secure systems are addressed.}

\T {Enigma}
\A {W. Kozaczuk}
\J {University Publications of America}
\D {1984}

\T {ENIGMA Variations}
\A {H.-R. Schuchmann}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Equivalence Between Two Flavours of Oblivious Transfers}
\A {Claude Cr\'epeau}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Equivocations for Homophonic Ciphers}
\A {Andrea Sgarro}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Substitution ciphers can be quite weak when the probability distribution of the message letters is dinstinctly non-uniform. A time-honoured solution to remove this weakness is to ``split'' each high-probability letter into a number of ``homophones'' and use a substitution cipher for the resulting extended alphabet. Here the performance of a homophonic cipher is studied from a Shannon-theoretic point of view. The key and message equivocations (conditional entropies given the intercepted cryptograms) are computed both for finite-length messages and ``very long'' messages. The results obtained are strictly related to those found by Blom and Dunham for substitution ciphers. The key space of a homophonic cipher is specified carefully, so as to avoid misunderstandings which appear to have occurred on this subject.}

\T {Error-Correcting Codes and Cryptography}
\A {N. J. A. Sloane}
\J {The Mathematical Gardner, David A. Klarner (ed.), Prindle, Weber \& Schmidt}
\D {1981}

\T {Error-Correction Coding for Digital Communications}
\A {G. Clark}
\A {J. Cain}
\J {Plenum Press}
\D {1981}

\T {Establishing Internal Technical Systems Security Standards}
\A {Charles Cresson Wood}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {Many organizations are jeopardizing long-term systems cost-effectiveness, interoperability, and security by allowing various groups within the organization to make decentralized and uncoordinated technical systems security decisions. Cost-effectiveness is compromised because volume-related vendor discounts and cross-system controls are often overlooked or unavailable. Interoperability between systems and networks is compromised because the machines cannot readily exchange secure data. Security is compromised because decentralized development teams are creating controls that address only obvious short-term needs. The solution to this serious problem is to develop, promulgate, and enforce organization-wide technical systems security standards. This paper addresses the organizational, political, technical and project management related matters associated with the development of an encryption standard document at a large American commercial bank. The observations and recommended steps are equally applicable to the development of other technical as opposed to policy oriented or precural, systems security standards.}

\T {Estimation of Some Encryption Functions Implemented into Smart Cards}
\A {H. Groscot}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {We study a family of encryption functions, which is particularly adapted for the situations that arise in smart cards. Probabilistic arguments show us that ``big key'' is not synonymous of ``good security'' for these functions. We think that the security of such functions has to rely on other criteria.}

\T {European Call For Cryptographic Algorithms: Ripe; Race Integrity Primitives Evaluation}
\A {J. Vandewalle}
\A {D. Chaum}
\A {W. Fumy}
\A {C. Jansen}
\A {P. Landrock}
\A {G. Roelofsen}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {The first aim of this paper is to situate the call for integrity and authentication algorithms within research on cryptography and within evolution of telecommunication. Motivations for submitting primitives and details on the submission process are also given.}

\T {Evaluating Logarithms in $GF(2^n)$}
\A {Don Coppersmith}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {We present a method for determining logarithms in $GF(2^n).$ Its asymptotic running time is $O(\exp(cn^{1/3}\log^{2/3}n))$ for a small constant $c,$ while, by comparison, Adleman's scheme runs in time $O(\exp(c^\prime n^{1/2}\log^{1/2}n)).$ The ideas give a dramatic improvement even for moderate-sized fields such as $GF(2^{127}),$ and make (barely) possible computations in fields of size around $2^{400}.$ The method is not applicable to $GF(q)$ for a large prime $q.$}

\T {Everything in $NP$ Can Be Argued in {\em Perfect\/} Zero-Knowledge in a {\em Bounded\/} Number of Rounds}
\A {Gilles Brassard}
\A {Claude Cr\'epeau}
\A {Moti Yung}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {A perfect zero-knowledge interactive proof allows a prover to convince a verifier of the validity of a statement in a way that does not give the verifier any additional information. Such protocols take place by the exchange of messages back and forth between the prover and the verifier. An important measure of efficiency for these protocols is the number of rounds of interaction. In previously known perfect zero-knowledge protocols for statements concerning $NP$-complete problems, at least $k$ rounds were necessary in order to prevent one part from having a probability of undetected cheating greater than $2^{-k}.$ In the full version of this paper, we give the first perfect zero-knowledge protocol that offers arbitrarily high security for any statement in $NP$ with a constant number of rounds (under a suitable cryptographic assumption). This protocol is a BCC-{\em argument\/} rather than a GMR-proof, as are all the known perfect zero-knowledge protocols for $NP$-complete problems.}

\T {Everything Provable is Provable in Zero-Knowledge}
\A {Michael Ben-Or}
\A {Oded Goldreich}
\A {Shafi Goldwasser}
\A {Johan Hastad}
\A {Joe Kilian}
\A {Silvio Micali}
\A {Phillip Rogaway}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Assuming the existence of a secure probabilistic encryption scheme, we show that every language that admits an interactive proof admits a (computational) zero-knowledge interactive proof. This result extends the result of Goldreich, Micali, and Wigderson, that, under the same assumption, all of $NP$ admits zero-knowledge interactive proofs. Assuming envelopes for bit commitment, we show that every language that admits an interactive proof admits a perfect zero-knowledge interactive proof.}

\T {Experiments with Relaxation Algorithms for Breaking Simple Substitution Ciphers}
\A {D. G. N. Hunter}
\A {A. R. McKenzie}
\J {Comp. J. {\bf 26,} 1}
\D {1983}
\X {In a recent paper, Peleg and Rosenfeld have proposed two relaxation algorithms for breaking simple substution ciphers with explicit word boundaries. This paper reports detailed results for similar ciphers in which word boundaries are concealed, and concludes that convergence towards a correct solutions is possible only after suitable choice of algorithm and initial conditions. We have not included a criterion to terminate the algorithms, but it would be resonable to regard a lack of progress over four or five iterations as such a criterion, for the length of test message considered here.}

\T {An Extended-Precision Operand Computer for Integer Factoring}
\A {Jeffrey W. Smith}
\A {Samuel S. {Wagstaff Jr.}}
\J {AFIPS Conference Proceedings {\bf 53} National Computer Conference}
\D {1984}
\X {We describe an extended-precision operand computer (EPOC). The
single-precision word length is 128 bits. This makes possible calculations with
large integers without resort to multiprecision techniques in software. Since
this is a special purpose machine, the hardware and software have been
developed from scratch to implement it. The application toward which the EPOC
is directed is the factoring of large integer using the continued fraction
algorithm. This application presents interesting mathematical and architectural
problems to solve and has implications in cryptography.}

\T {Extension of Brickell's Algorithm For Breaking High Density Knapsacks}
\A {F. Jorissen}
\A {J. Vandewalle}
\A {R. Govaerts}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Factoring and Cryptography}
\A {R. L. Rivest}
\J {Science {\bf 242,} 4885, p.~1493}
\D {1988}

\T {Factoring by Electronic Mail}
\A {Arjen K. Lenstra}
\A {Mark S. Manasse}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper we describe our distributed implementation of two factoring algorithms, the elliptic curve method (ecm) and the multiple polynomial quadratic sieve algorithm (mpqs). Since the summer of 1987, our ecm-implementation on a network of MicroVAX processors at DEC's Systems Research Center has factored several most and more wanted number from the Cunningham project. In the summer of 1988, we implemented the multiple polynomial quadratic sieve algorithm on the same network. On this network alone, we are now able to factor any 100 digit integer, or to find 35 digit factors of numbers up to 150 digits long within one month. To allow an even wider distribution of our programs we made use of electronic mail networks for the distribution of the programs and for inter-processor communication. Even during the initial stage of this experiment, machines all over the United~States and at various places in Europe and Australia contributed 15 percent of the total factorization effort. At all the sites where our program is running we only use cycles that would otherwise have been idle. This shows that the enormous computational task of factoring 100 digit integers with the current algorithms can be completed almost for free. Since we use a negligible fraction of the idle cycles of all the machines on the worldwide electronic mail networks, we could factor 100 digit integers within a few days with a little more help.}

\T {Factoring Integers with Elliptic Curves}
\A {H. W. {Lenstra Jr.}}
\J {Ann. of Math., {\bf 126,} pp. 649--673}
\D {1987}

\T {Factoring Multivariate Polynomials Over Finite Fields}
\A {Arjen K. Lenstra}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {This paper describes an algorithm for the factorization of multivariate polynomials with coefficients in a finite field that is polynomial-time in the degrees of the polynomial to be factored. The algorithm makes used of a new basis reduction algorithm for lattices over $\F_q.$}

\T {Factoring Polynomials Using Fewer Random Bits}
\A {Eric Bach}
\A {Victor Shoup}
\J {Computer Science Technical Report TR 757, University of Wisconsin}
\D {1988}
\X {Let $F$ be a field of $q = p^n$ elements, where $p$ is prime.  We present two new probabilistic algorithms for factoring polynomials in $F(X)$ that make particularly efficient use of random bits. They are easy to implement, and require no randomness beyond an initial seed whose length is proportional to the input size.  The first algorithm is based on a procedure of Berlekamp; on input $f$ in $F(X)$ of degree $d$, it uses $d\log_2 p$ random bits and produces in polynomial time a complete factorization of $f$ with a failure probability of no more than $1/p^{1-a}1/2d$.  (Here $a$ denotes a fixed parameter between 0 and 1 that can be chosen by the implementor.)  The second algorithm is based on a method of Cantor and Zassenhaus; it uses $d\log_2 q$ random bits and fails to find a complete factorization with probability no more than $1/q^{1-a}1/4d$.  For both of these algorithms, the failure probability is exponentially small in the number ofrandom bits used.}

\T {Factoring Polynomials with Rational Coefficients}
\A {A. K. Lenstra}
\A {H. W. {Lenstra, Jr.}}
\A {L. {Lov\'asz}}
\J {Mathematische Annalen, {\bf 261,} pp. 515--534}
\D {1982}

\T {Factorization and Primality Testing}
\A {D. M. Bressoud}
\J {Springer-Verlag, NY}
\D {1989}

\T {Factorization of Large Integers On A Massively Parallel Computer}
\A {James A. Davis}
\A {Diane B. Holdridge}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Factorization of Polynomial over Finite Fields and Factorization of Primes in Algebraic Number Fields}
\A {Ming-Deh A. Huang}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {Based on Kummer Theorem, we study the deterministic complexity of two factorization problems: polynomial factorization over finite fields and prime factorization in algebraic number fields. We show that factoring polynomials of degree $n$ in $F_p[x],$ with $p$ prime, is polynomially equivalent to factoring $p$ in algebraic number field of extension degree $n$ over $Q,$ where $p$ is ``regular'' with respect to the generating polynomials of the number fields. Part of the proof also yields an efficient polynomial time algorithm for computing the factorization pattern. Number theoretical methods are then developed to solve two important kinds of polynomials: $\Phi_n(x)\mod p$ when $\Phi_n$ is the $n$-th cyclotomic polynomial, and $x^n-a\mod p$ where $a\in N.$ We show that when the Extended Riemann Hypothesis is assumed, all the roots of both kinds of polynomials in $F_p$ can be found efficiently in time polynomial in $n$ and $\log p.$ As a consequence, when $p\equiv1(n),$ factorization of $p$ in the $n$-th cyclotomic field can be computed in polynomial time. The result on finding all rots of $x^n\equiv\alpha(p)$ extends a result of Adleman, Manders, and Miller, which states that the least root of $x^n\equiv\alpha(p)$ can be found in polynomial time, when Extended Riemann Hypothesis is assumed.}

\T {Factor Refinement}
\A {Eric Bach}
\A {James Driscoll}
\A {Jeffrey Shallit}
\J {Computer Science Technical Report TR 883, University of Wisconsin}
\D {1989}
\X {Suppose we have obtained a partial factorization of an integer $m$, say $m = m_1 m_2 \cdots m_j$. Can we efficiently ``refine'' this factorization of $m$
to a more complete factorization $m = \prod_ {1\le i\le k} n_i^{e_i},$ where all the $n_i\ge 2$ are pairwise relatively prime, and $k\ge2$? A procedure to find such refinements can be used to convert a method for splitting integers into one that produces complete factorizations, to combine independently generated factorizations of a composite number, and to parallelize the generalized Chinese remainder algorithm. We apply Sleator and Tarjan's formulation of amortized analysis to prove the surprising fact that our factor refinement algorithm takes $O((\log m )^2 )$ bit operations, the same as required for a single gcd.  This is our main result, and appears to be the first application of amortized techniques to the analysis of a number-theoretic algorithm. We also characterize the output of our factor refinement algorithm, showing that the result of factor refinement is actually a natural generalization of the greatest common divisor. Finally, we also show how similar results can be obtained for polynomials.  As an application, we give algorithms to produce relatively prime squarefree factorizations and normal bases.}

\T {Fair Exchange of Secrets}
\A {Tom Tedrick}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {We consider two problems which arose in the context of ``The Exchange of Secret Keys''. (1). In the original protocol, one party may halt the exchange and have a 2 to 1 expected time advantage in computing the other party's secret. To solve this problem, when there is a particular point in the exchange where this time advantage may be critical, we presented at CRYPTO 83, a method for exchanging ``fractions'' of a single bit. In this paper we extend the method so as to apply it to all bits to be exchanged, and show how it can be used in a more abstract setting. (2). We also present a solution to the problem of how to ensure a fair exchange of secrets when one party in the exchange is ``risk seeking'', while the other is ``risk-adverse''.}

\T {A Family of Codes Commutatively Equivalent to Prefix Codes}
\A {S. Mauceri}
\A {A. Restivo}
\J {Info. Proc. Letters {\bf 12,} 1}
\D {1981}

\T {A Family of Jacobians Suitable for Discrete Log Cryptosystems}
\A {Neal Koblitz}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {We investigate the jacobians of the hyperelliptic curves $v^2+v=u^{2g+1}$ over finite fields, and discuss which are likely to have ``almost prime'' order.}

\T {Fast Authentication in a Trapdoor-Knapsack Public Key Cryptosystem}
\A {P. Sch\"obi}
\A {J. L. Massey}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {Public Key Cryptosystems based on the trapdoor knapsack method proposed by Merkle and Hellman are not well suited to provide authentication in the sense of public key authentication because only a small fraction of all possible message words of a typical length lead to a binary solution of the knapsack problem. In this paper, a new method is discussed which provides a nonbinary solution for the knapsack problem of a Merkle/Hellman scheme. The algorithm works for any message word a comparatively short computation time. Thus, the solution can be used as a secure authentication pattern.}

\T {Fast Correlation Attack on Nonlinearly Feedforward Filtered Shift-Register Sequences}
\A {R\'ejane Forr\'e}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {An algorithm recently introduced by Meier and Staffelbach is modified to be applicable to stream-ciphers with running key generators (RKG) consisting of a single linear feedback shift-register (LFSR) with a (nonlinear) feedforward filter applied to it. It is shown that, under certain assumptions, this modified algorithm can be used by a cryptanalyst to determine an equivalent system---consisting of a couple of LFSR's together with a suitable combining function---which generates the same running key sequence. Finally, design criteria are given, which ensure that a RKG withstands the modified attack.}

\T {Fast Correlation Attacks on Stream Ciphers}
\A {Willi Meier}
\A {Othmar Staffelbach}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Fast Cryptanalysis of the Matsumoto-Imai Public Key Scheme}
\A {P. Delsarte}
\A {Y. Desmedt}
\A {A. Odlyzko}
\A {P. Piret}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {Fast Data Encipherment Algorithm FEAL}
\A {Akihiro Shimizu}
\A {Shoji Miyaguchi}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Fast Decipherment Algorithm for RSA Public-Key Cryptosystem}
\A {J.-J Quisquater}
\A {C. Couvreur}
\J {Electronic Letters {\bf 18,} pp. 905--907}
\D {1982}

\T {Fast Decoding of the Huffman Codes}
\A {A. {Siemi\'nski}}
\J {Info. Proc. Letters {\bf 26,} 5}
\D {1988}

\T {A Fast Elliptic Curve Cryptosystem}
\A {G. B. Agnew}
\A {R. C. Mullin}
\A {S. A. Vanstone}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Faster Primality Testing}
\A {Wieb Bosma}
\A {Marc-Paul {van der Hulst}}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Several major improvements to the Jacobi sum primality testing algorithm will speed it up in such a way that proving primality of primes of up to 500 digits will be a matter of routine. Primes of about 800 digits will take at most one night on a Cray.}

\T {Fast Evaluation of Logarithms in Fields of Characteristic Two}
\A {Don Coppersmith}
\J {IEEE Trans. on Info. Th. {\bf IT-30,} 4}
\D {1984}
\X {A method for determining logarithms in $GF(2^n)$ is presented. Its asymptotic running time is $O(\exp(cn^{1/3}\log^{2/3}n))$ for a small constant $c,$ while, by comparison, Adleman's scheme runs in time $O(\exp(c^\prime n^{1/2}\log^{1/2} n)).$ The ideas give a dramatic improvement even for moderate-sized fields such as $GF(2^{127}),$ and make (barely) possible computations in fields of size around $2^{400}.$ The method is not applicable to $GF(q)$ for a large prime $q.$}

\T {Fast Exponentiation in $GF(2^n)$}
\A {G. B. Agnew}
\A {R. C. Mullin}
\A {S. A. Vanstone}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Fast Generation of Secure RSA-Moduli with Almost Maximal Diversity}
\A {Ueli M. Maurer}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper describes a new method for generating primes together with a {\em proof of their primality\/} that is extremely {\em efficient\/} (for 100-digit primes the average running time is equal to the average time required for finding a ``strong pseudoprime'' of the same size that passes the Miller-Rabin test for only four bases), that yields primes that are nearly {\em uniformly distributed\/} over the set of all primes in a given interval, and that is easily modified to yield (with no additional computational effort) primes that are nearly uniformly distributed over the subset of these prime that satisfy certain {\em security constraints\/} for use in the RSA cryptosystem. This method is used to generate, for a given encryption exponent $e,$ an RSA-modulus $m=pq$ that is nearly uniformly distributed over all secure RSA-moduli in a given interval $I,$ i.e., over the set of all integers in $I$ that are (1) the product of exactly two primes $p$ and $q$ none of which is smaller than a given limit $L,$ where (2) $(p-1,e)=(q-1,e)=1$ and (3) $p-1$ and $q-1$ each contain a prime factor greater than a given limit $L^\prime,$ and where (4) for all but a provably (given) small fraction of plaintexts in $Z_m^*,$ the minimum number of iterated encryptions with exponent $e$ required to recover the plaintext, is provably greater than a given limit $M.$ Our method exploits a well-known result due to Pocklington that allows one to prove the primality of $p$ when only a partial factorization of $p-1$ is known. These prime factors of $p-1$ are generated by recursive application of the prime generating procedure. Although the discussion is centered on the RSA system, our method can of course be used in other cryptographic systems, such as the Diffie-Hellman public key distribution system, that require large primes satisfying certain security constraints.}

\T {A Fast Modular Arithmetic Algorithm Using a Residue Table}
\A {Shin-ichi Kawamura}
\A {Kyoko Hirano}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {A Fast Modular-multiplication Algorithm Based On a Higher Radix}
\A {Hikaru Morita}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {This paper presents a new fast compact modular-multiplication algorithm, which will multiply modulo $N$ in $\log(N)/\log(r)$ clock pulses when the algorithm is based on radix $r$ ($r\ge4$).}

\T {A Fast Pseudo Random Permutation Generator With Applications to Cryptology}
\A {Selim G. Akl}
\A {Henk Meijer}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Fast RSA-Hardware: Dream or Reality?}
\A {Frank Hoornaert}
\A {Marc Decroos}
\A {Joos Vandewalle}
\A {Ren\'e Govaerts}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {This paper describes a successful hardware implementation of the RSA algorithm. It is implemented as an 120-bit bit-slice processor, which may be interconnected without additional circuitry to obtain arbitrary word lengths. With 512-bit operands, exponentiation takes less than 30 milliseconds.}

\T {Fast Spectral Tests for Measuring Nonrandomness and the DES}
\A {Frank A. Feldman}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Two spectral tests for detecting nonrandomness were proposed in 1977. One test, developed by J. Gait, considered properties of power spectra obtained from the discrete Fourier transform of finite binary strings. Gait tested the DES in output-feedback mode, as a pseudorandom generator. Unfortunately, Gait's test was not properly developed, nor was his design for testing the DES adequate. Another test, developed by C. Yuen, considered analogous properties for the Walsh transform. In estimating the variance of spectral bands, Yuen assumed the spectral components to be independent. Except for the special case of Gaussian random numbers this assumption introduces a significant error into his estimate. We recently constructed a new test for detecting nonrandomness in finite binary strings, which extends and quantifies Gait's test. Our test is based on an evaluation of a statistic, which is a function of Fourier periodgrams. Binary strings produced using short-round versions of the DES in output-feedback mode were tested. By varying the number of DES rounds from 1 to 16, it was thought possible to gradually vary the degree of randomness of the resulting strings. However, we found that each of the short-round versions, consisting of 1, 2, 3, 5 and 7 rounds, generated ensembles for which at least $10\%$ of the test strings were rejected as random, at a confidence level approaching certainty. A new test, based on an evaluation of the Walsh spectrum, is presented here. This test extends the earlier test of C. Yuen. Testing of the DES, including the short-round versions, has produced results consistent with those previously obtained. We prove that our measure of the Walsh spectrum is equivalent to a measure of the skirts of the logical autocorrelation function. It is clear that an analogous relationship exists between Fourier periodgrams and the circular autocorrelation function.}

\T {FEAL-8 Cryptosystem and a Call for Attack}
\A {Shoji Miyaguchi}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Feedforward Functions Defined by de Bruijn Sequences}
\A {Z. D. Dai}
\A {K. C. Zeng}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper, we show that feedforward functions defined by de~Bruijn sequences, called de~Bruijn functions, satisfy some basic cryptographic requirements. It is shown how the family of de~Bruijn feedforward functions could be parametrized by a key space. De~Bruijn feedforward functions are balanced and complete. A lower bound of the degree of de~Bruijn functions is given. A certain correlational weakness of a class of de~Bruijn functions is analyzed and an algebraic method to meliorate the weakness is also given and it will not cause any substantial drawbacks with regard to other requirements. The lower bound given in this paper is by no means discouraging, yet there is hope for substantial improvements. So, improving the given lower bound is proposed as an open problem at the end of this paper.}

\T {File Security and the UNIX Crypt Command}
\A {J. A. Reeds}
\A {P. J. Weinberger}
\J {AT\&T Bell Laboratories Technical J. {\bf 63,} 8, part 2, pp. 1673--1684}
\D {1984}

\T {Finding Irreducible Polynomials Over Finite Fields}
\A {Leonard M. Adleman}
\A {Hendrik W. {Lenstra Jr.}}
\J {Proc. of the 18th Annual ACM Symp. of Theory of Computing}
\D {1986}

\T {Fingerprinting Long Forgiving Messages}
\A {G. R. Blakley}
\A {C. Meadows}
\A {G. B. Purdy}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Finite Fields}
\A {Rudolf Lidl}
\A {Harald Niederreiter}
\J {Encyclopedia of Mathematics and its Applications, 20, Gian-Caro Rota (ed.), Addison-Wesley}
\D {1983}

\T {Finite Semigroups and the RSA-Cryptosystem}
\A {A. Ecker}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Finite State Machine Modelling of Cryptographic Systems in Loops}
\A {Franz Pichler}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {FIPS Publication 46-1: Data Encryption Standard}
\A {NBS}
\D {1988}

\T {FIPS Publication 81: DES Modes of Operation}
\A {NBS}
\D {1980}

\T {The First Ten Years of Public-Key Cryptography}
\A {Whitfield Diffie}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {Public-key cryptosystems separate the capacities for encryption and decryption so that 1) many people can encrypt messages in such a way that only one person can read them, or 2) one person can encrypt messages in such a way that many people can read them. This separation allows important improvements in the management of cryptographic keys and makes it possible to `sign' a purely digital message. Public key cryptography was discovered in the Spring of 1975 and has followed a surprising course. Although diverse systems were proposed early on, the ones that appear both practical and secure today are all very closely related and the search for new and different ones has met with little success. Despite this reliance on a limited mathematical foundation public-key cryptography is revolutionizing communication security by making possible secure communication networks with hundreds of thousands of subscribers. Equally important is the impact of public key cryptography on the theoretical side of communication security. It has given cryptographers a systematic means of addressing a broad range of security objectives and pointed the way toward a more theoretical approach that allows the development of cryptographic protocols with proven security characteristics.}

\T {Flexible Access Control with Master Keys}
\A {Gerald C. Chick}
\A {Stafford E. Tavares}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We show how to create a master key scheme for controlling access to a set of services. Each master key is a concise representation for a list of service keys, such that only service keys in this list can be computed easily from the master key. Our scheme is more flexible than others, permitting hierarchical organization and expansion of the set of services.}

\T {Formal Models for Computer Security}
\A {Carl E. Landwehr}
\J {ACM Computing Surveys {\bf 13,} 3}
\D {1981}
\X {Efforts to build ``secure'' computer systems have now been underway for
more than a decade. Many designs have been proposed, some prototypes have been
constructed, and a few systems are approaching the production stage. A small
number of systems are even operating in what the Department of Defense calls
the ``multilevel'' model: some information contained in these computer systems
may have a classification higher than the clearance of some of the users of
those systems. This paper reviwes the need for formal security models,
describes the structure and operation of military security controls, considers
how automation has affected security problems, surveys models that have been
proposed and applied to date, and suggests possible directions for future
models.}

\T {Founding Cryptography on Oblivious Transfer}
\A {Joe Kilian}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Suppose your netmail is being erratically censored by Captain Yossarian. Whenever you send a message, he censors each bit of the message with probability $1\over2$, replacing each censored bit by some reserved character. Well versed in such concepts as redundancy, this is no real problem to you. The question is, can it actually be turned around and used to your advantage? We answer this question strongly in the affirmative. We show that this protocol, more commonly known as {\em oblivious transfer,} can be used to simulate a more sophisticated protocol, known as {\em oblivious circuit evaluation.} We also show that with such a communication channel, one can have completely noninteractive zero-knowledge proofs of statements in $NP.$ These results do not use any complexity-theoretic assumptions. We can show that they have applications to a variety of models in which oblivious transfer can be done.}

\T {A Framework for the Study of Cryptographic Protocols}
\A {Richard Berger}
\A {Sampath Kannan}
\A {Ren\'e Peralta}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {We develop a simple model of computation under which to study the meaning of cryptographic protocol and security. We define a protocol as a mathematical object and security as a possible property of this object. Having formalized the concept of a secure protocol we study its general properties. We back up our contention that the model is reasonable by solving some well known cryptography problems within the framework of the model.}

\T {Full Encryption in a Personal Computer System}
\A {Robert L. Bradey}
\A {Ian G. Graham}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Full Secure Key Exchange and Authentication with No Previously Shared Secrets}
\A {Josep Domingo i Ferrer}
\A {Lloren\c c Huguet i Rotger}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {When speaking about secure networks, the bootstrapping process is very often forgotten or at least ignored. Some of the methods used so far do not protect against impersonation (Diffie-Hellman exponential key exchange) or have an important computational complexity (public-key based methods). A new algorithm is presented which is able to achieve key exchange whilst ensuring secrecy and authentication with a reasonable amount of computation.}

\T {The Fundamental Physical Limit of Computation}
\A {Charles H. Bennett}
\A {Rolf Landauer}
\J {Scientific American, {\bf 253,} 1}
\D {1985}
\X {What constraints govern the physical process of computing? Is a minimum amount of energy required, for example, per logic step. There seems to be no minimum, but some other questions are open.}

\T {A Generalization of El Gamal's Public Key Cryptosystem}
\A {W. J. Jaburek}
\A {Vienna Gabe}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {A Generalization of Hellman's Extension to Shannon's Approach to Cryptography}
\A {P. Beauchemin}
\A {G. Brassard}
\J {J. of Cryptology, {\bf 1,} 2, pp. 129--132}
\D {1988}

\T {A Generalized Birthday Attack}
\A {Marc Girault}
\A {Robert Cohen}
\A {Mireille Campana}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {We generalize the birthday attack presented by Coppersmith at Crypto'85 which defrauded a Davies-Price message authentication scheme. We first study the birthday paradox and a variant for which some convergence results and related bounds are provided. Secondly, we generalize the Davies-Price scheme and show how the Coppersmith attack can be extended to this case. As a consequence, the case $p=4$ with DES (important when RSA with a 512-bit modulus is used for signature) appears not to be secure enough.}

\T {Generalized Kolmogorov Complexity and the Structure of Feasible Computations}
\A {J. Hartmanis}
\J {Technical Report: TR83--573, Cornell University}
\D {1983}

\T {Generalized Linear Threshold Scheme}
\A {S. C. Kothari}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {A generalized linear threshold scheme is introduced. The new scheme generalizes the existing linear threshold schemes. The basic principles involved in the construction of linear threshold schemes are laid out and the relationships between the existing schemes are completely established. The generalized linear scheme is used to provide a hierarchical threshold scheme which allows multiple thresholds necessary in a hierarchical environment.}

\T {Generalized Multiplexed Sequences}
\A {Mu-lan Liu}
\A {Zhe-xian Wan}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Generalized Secret Sharing and Monotone Functions}
\A {Josh Benaloh}
\A {Jerry Leichter}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Secret Sharing from the perspective of {\em threshold schemes\/} has been well-studied over the part decade. Threshold schemes, however, can only handle a small fraction of the secret sharing functions which we may wish to form. For example, if it is desirable to divide a secret among four participants $A, B, C,$ and $D$ in such a way that either $A$ together with $B$ can reconstruct the secret or $C$ together with $D$ can reconstruct the secret, then threshold schemes (even with weighting) are provably insufficient. This paper will present general methods for constructing secret sharing schemes for {\em any\/} given secret sharing function. There is a natural correspondence between the set of ``generalized'' secret sharing functions and the set of monotone functions, and tools developed for simplifying the latter set can be applied equally well to the former set.}

\T {A General Zero-Knowledge Scheme}
\A {Mike V. D. Burmester}
\A {Yvo Desmedt}
\A {Fred Piper}
\A {Michael Walker}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {There is a great similarity between then Fiat-Shamir zero-knowledge scheme, the Chaum-Evertse-van de Graaf, the Beth and the Guillou-Quisquater schemes. The Feige-Fiat-Shamir and the Desmedt proofs of knowledge also look alike. This suggests that a generalization is overdue. We present a general zero-knowledge proof which encompasses all these schemes.}

\T {Generation of Binary Sequences with Controllable Complexity and Ideal $r$-Tupel Distribution}
\A {Thomas Siegenthaler}
\A {R\'ejane Forr\'e}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {A key stream generator is analyzed which consists of a single linear feedback shift register (LFSR) with a primitive connection polynomial and a nonlinear feedforward logic. It is shown, how, for arbitrary integers $n$ and $r$ and a binary LFSR of length $L=nr$ the linear complexity of the generated keystream can be determined for a large class of nonlinear feedforward logics. Moreover, a simple condition imposed on these logics ensures an ideal $r$-tupel distribution for these keystreams. Practically useful solutions exist where the keystream has linear complexity $nr^{n-1}$ together with an ideal $r$-tupel distribution.}

\T {The Generation of Random Numbers that are Probably Prime}
\A {P. Beauchemin}
\A {G. Brassard}
\A {C. Cr\'epeau}
\A {C. Goutier}
\A {C. Pomerance}
\J {J. of Cryptology, {\bf 1,} 1, pp. 53--64}
\D {1988}

\T {Generator of Pseudorandom Sequences with Variable Delay}
\A {G. R. Avanesyan}
\J {Instruments and Experimental Techniques {\bf 30,} 4, pp. 852--854}
\D {1988}

\T {Good S-Boxes Are Easy To Find}
\A {Carlisle Adams}
\A {Stafford Tavares}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We describe an efficient design methodology for the s-boxes of DES-like cryptosystems. Our design guarantees that the resulting s-boxes will be bijective and will exhibit the strict avalanche criterion and the output bit independence criterion.}

\T {Gradual and Verifiable Release of a Secret}
\A {Ernest F. Brickell}
\A {David Chaum}
\A {Ivan B. Damg{\aa}rd}
\A {Jeroen {van de Graaf}}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Protocols are presented allowing someone with a secret discrete logarithm to release it, bit by bit, such that anyone can verify each bit's correctness as they receive it. This new notion of {\em release of secrets\/} generalizes and extends that of the already known {\em exchange of secrets\/} protocols. Consequently, the protocols presented allow exchange of secret discrete logs between any number of parties. The basic protocol solves an even more general problem than that of releasing a discrete log. Given any instance of a discrete log problem in a group with public group operation, the party who knows the solution can make public some interval $I$ and convince anyone that the solution belongs to $I,$ while releasing no additional information, such as any hint as to where in $I$ the solution is. This can be used directly to release a discrete log, or to {\em transfer\/} it securely between different groups, i.e. prove that two instances are related such that knowledge of the solution to one implies knowledge of the solution to the other. We show how this last application can be used to implement a more efficient release protocol by transferring the given discrete log instance to a group with special properties. In this scenario, each bit of the secret can be verified by a single modular squaring, and unlike the direct use of the basic protocol, no interactive proofs are needed after the basic setup has been done. Finally, it is shown how the basic protocol can be used to release the factorization of a public composite number.}

\T {Grant Levels in an Authorization Mechanism}
\A {J. Paredaens}
\A {F. Ponsaert}
\J {Info. Proc. Letters {\bf 11,} 4 and 5}
\D {1980}

\T {Greater Awareness of Security in Aftermath of Computer Worm}
\A {S. Shulman}
\A {J. Palca}
\J {Nature {\bf 336,} 6197, p.~301}
\D {1988}

\T {Green Book}
\X {{\em See:\/} Department of Defense ({DoD}) Password Management Guidelines}

\T {A Graph Theoretic Approach tp Statistical-Data Security}
\A {D. Gusfield}
\J {SIAM J. on Computing {\bf 17,} 3, pp. 552--571}
\D {1988}

\T {Hacker Runs Rings Round Military Security}
\A {Anonymous}
\J {New Scientist {\bf 118,} 1610, pp. 25--26}
\D {1988}

\T {A Hard-Core Predicate for all One-Way Functions}
\A {Oded Goldreich}
\A {Leonid A. Levin}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {A central tool in constructing pseudorandom generators, secure encryption functions, and in other areas are ``hard-core'' predicates $b$ of functions (permutations) $f$. Such $b(x)$ cannot be efficiently guessed (substantially better than 50--50) given only $f(x).$ Both $b,f$ are computable in polynomial time. Yao transforms any one-way function $f$ into a more complicated one, $f^*,$ which has a hard-core predicate. The construction applies the original $f$ to many small piece of the input to $f^*$ just to get one ``hard-core'' bit. The security of this bit may be smaller than any constant positive power of the security of $f.$ In fact, for inputs (to $f^*$) of practical size, the pieces effected by $f$ are so small that $f$ can be inverted (and the ``hard-core'' bit computed) by exhaustive search. In this paper we show that every one-way function, padded to the form $f(p,x)=(p,g(x)),$ $\|p\|=\|x\|,$ has by itself a hard-core predicate of the same (within a polynomial) security. Namely, we prove a conjecture that the scalar product of boolean vectors $p,x$ is a hard-core of every one-way function $f(p,x)=(p,g(x)).$ The result extends to multiple (up to the logarithm of security) such bits and to any distribution on the $x$'s for which $f$ is hard to invert.}

\T {Hard-Core Theorems for Complexity Classes}
\A {Shimon Even}
\A {Alan L. Selman}
\A {Yacov Yacobi}
\J {J ACM {\bf 32,} 1, pp. 205--217}
\D {1985}
\X {Nancy Lynch proved that if a decision problem $A$ is not solvable in polynomial time, then there exists an infinite recursive subset $X$ of its domain on which the decision is almost everywhere complex. In this paper, general theorems of this kind that can be applied to several well-known automata-based complexity classes, including a common class of randomized algorithms, are proved.}

\T {Hardware Protection Against Software Piracy}
\A {Tim Maude}
\A {Derwent Maude}
\J {C ACM {\bf 27,} 9}
\D {1984}
\X {Illicit duplication of proprietary software can be prevented by using a
public key cryptogram to customize programs for each computer.}

\T {Hash-Functions Using Modulo-$N$ Operations}
\A {Marc Girault}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Hellman Presents No Shortcut Solutions to the DES}
\A {Walter Tuchman}
\J {IEEE Spectrum, July}
\D {1979}

\T {Hellman's Data Does Not Support His Conclusion}
\A {Dennis Branstad}
\J {IEEE Spectrum, July}
\D {1979}

\T {Hellman's Scheme Breaks DES In Its Basic Form}
\A {George I. Davida}
\J {IEEE Spectrum, July}
\D {1979}

\T {High-Performance Interface Architectures for Cryptographic Hardware}
\A {David P. Anderson}
\A {P. Venkat Rangan}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {High Speed Implementation of DES}
\A {S. K. Banerjee}
\J {Computers \& Security, {\bf 1}}
\D {1982}

\T {A High Speed Manipulation Detection Code}
\A {Robert R. Jueneman}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Manipulation Detection Codes (MDC) are defined as a class of checksum algorithms which can detect both accidental and malicious modifications of an electronic message or document. Although the MDC result must be protected by encryption to prevent an attacker from succeeding in substituting his own Manipulation Detection Code (MDC) along with the modified text, MDC algorithms do not require the use of secret information such as a cryptographic key. Such techniques are therefore highly useful in allowing encryption and message authentication to be implemented in different protocol layers in a communication system without key management difficulties, as well as in implementing digital signature schemes. It is shown that cryptographic checksums that are intended to detect fraudulent messages should be on the order of 128 bits in length, and the ANSI X9.9--1986 Message Authentication Standard is criticized on that basis. A revised 128-bit MDC algorithm is presented which overcomes the so-called Triple Birthday Attack introduced by Coppersmith. A fast, efficient implementation is discussed which makes use of the Intel 8087/80287 Numeric Data Processor coprocessor chip for the IBM PC/XT/AT and similar microcomputers.}

\T {The History of Book Ciphers}
\A {Albert C. Leighton}
\A {Stephen M. Matyas}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {How Discreet is the Discrete Log?}
\A {Douglas L. Long}
\A {Avi Wigderson}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {Blum and Micali showed how to hide one bit using the discrete logarithm function. In this paper we show how to hide $c\log\log p$ bits for any constant $c,$ where $p$ is the modulus.}

\T {How Easy is Collision Search? Application to DES}
\A {Jean-Jacques Quisquater}
\A {Jean-Paul Delescaille}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {How Easy is Collision Search. New Results and Applications to DES}
\A {Jean-Jacques Quisquater}
\A {Jean-Paul Delescaille}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {How Polish Mathematicians Deciphered the Enigma}
\A {M. Rejewski}
\J {Annals of the History of Computing {\bf 3,} pp. 213--234}
\D {1981}

\T {How to Break Okamoto's Cryptosystem by Reducing Lattice Bases}
\A {Brigitte Vall\'ee}
\A {Marc Girault}
\A {Philippe Toffin}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {The security of several signature schemes and cryptosystems, essentially proposed by Okamoto, is based on the difficulty of solving polynomial equations or inequations modulo $n.$ The encryption and the decryption of these schemes are very simple when the factorization of the modulus, a large composite number, is known. We show here that we can, for any odd $n,$ solve, in polynomial probabilistic time, quadratic equations modulo $n,$ even if the factorization of $n$ is hidden, provided we are given a sufficiently good approximation of the solutions. We thus deduce how to break Okamoto's second degree cryptosystem and we extend, in this way, Brickell's and Shamir's previous attacks. Our main tool is lattices that we use after a linearisation of the problem, and the success of our method depends on the geometrical regularity of a particular kind of lattices. Our paper is organized as follows: First we recall the problems already posed, their partial solutions and describe how our results solve extensions of these problems. We then introduce our main tool, lattices and show how their geometrical properties fit in our subject. Finally, we deduce our results. These methods can be generalized to higher dimensions.}

\T {How to Break the Direct RSA-Implementation of MIXes}
\A {Birgit Pfitzmann}
\A {Andreas Pfitzmann}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {MIXes are a means of untraceable communication based on a public key cryptosystem, as published by David Chaum in 1981. In the case where RSA is used as this cryptosystem directly, i.e. without composition with other functions (e.g. destroying the multiplicative structure), we show how the resulting MIXes can be broken by an active attack which is perfectly feasible in a typical MIX-environment. The attack does not affect the idea of MIXes as a whole: if the security requirements are concretized suitable and if a cryptosystem fulfills them, one can implement secure MIXes directly. However, it shows that present security notions for public key cryptosystems, which do not allow active attacks, do not suffice for a cryptosystem which is used to implement MIXes directly. We also warn of the same attack and others on further possible implementations of MIXes, and we mention several implementations which are not broken by any attack we know.}

\T {How to Cheat at Mental Poker}
\A {R. Lipton}
\J {Proc. of AMS Short Course on Cryptography}
\D {1981}

\T {How to Construct Pseudorandom Permutations from Pseudorandom Functions}
\A {Michael Luby}
\A {Charles Rackoff}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {We show how to efficiently construct a pseudorandom invertible permutation generator from a pseudorandom function generator. Goldreich, Goldwasser and Micali introduce the notion of pseudorandom function generator and show how to efficiently construct a pseudorandom function generator from a pseudorandom bit generator. We use some of the ideas behind the design of the Data Encryption Standard for our construction. A practical implication of our result is that any pseudorandom bit generator can be used to construct a block private key cryptosystem which is secure against chosen plaintext attack, which is one of the strongest known attacks against a cryptosystem.}

\T {How to Construct Random Function}
\A {Oded Goldreich}
\A {Shafi Goldwasser}
\A {Silvio Micali}
\J {J ACM {\bf 33,} 4, pp. 792--807}
\D {1986}
\X {A constructive theory of randomness for functions, based on computational
complexity, is developed, and a pseudorandom function generator is presented.
This generator is a deterministic polynomial-time algorithm that transform
pairs $(g,r),$ where $g$ is {\em any\/} one-way function and $r$ is a random
$k$-bit string, to polynomial-time computable functions
$f_r:\{1,\ldots,2^k\}\rightarrow\{1,\ldots,2^k\}.$ These $f_r$'s cannot be
distinguished from {\em random\/} functions by any probabilistic
polynomial-time algorithm that asks and receives the value of a function at
arguments of its choice. The result has applications in cryptography, random
constructions, and complexity theory.}

\T {How to Control MVS User SuperVisor Calls}
\A {R. Paans}
\A {I. S. Herschberg}
\J {Computers \& Security, {\bf 5,} 1}
\D {1986}
\X {Many computing centres install their own extensions to standard operating systems. These extensions, when processed in an authorized status, may seriously endanger system integrity. This paper, based on case studies over the past five yeats, spells out the risks run by computing centres under MVS installing home-grown user SuperVisor Calls. A set of design requirements is formulated with which these user SVCs must comply if they are to be considered secure. The latest developments in improving the security of some risky operations are also outlined.}

\T {How to Detect Tampering of Data}
\A {S. C. Kak}
\J {Info. Proc. Letters {\bf 20,} 2}
\D {1985}
\X {A method of nested coding is desribed. It can be used to detect tampering
of data.}

\T {How to Exchange Half a Bit}
\A {T. Tedrick}
\J {Advances in Cryptology---CRYPTO '83, Proceedings, Plenum Press, pp. 147--151}
\D {1984}

\T {How to Exchange (Secret) Keys}
\A {Manuel Blum}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\J {ACM Trans. on Comp. Systems}
\D {1983}
\X {A protocol is presented whereby two adversaries may exchange secrets, though neither trusts the other. The secrets are the prime factors of their publicly announced composite numbers. The two adversaries can exchange their secrets bit by bit, but each fears the other will cheat by sending ``junk'' bits. To solve this problem we show how each of the two can prove, for each bit delivered, that the bit is good. Applications are suggested to such electronic business transactions as the signing of contracts and the sending of certified electronic mail.}

\T {How to Exchange Secrets by Oblivious Transfer}
\A {M. O. Rabin}
\J {Technical Memo TR-81, Aiken Computation Laboratory, Harvard University}
\D {1981}

\T {How to Explain Zero-Knowledge Protocols to Your Children}
\A {Jean-Jacques Quisquater}
\A {Myriam Quisquater}
\A {Muriel Quisquater}
\A {Micha\"el Quisquater}
\A {Loius Guillou}
\A {Marie Annick Guillou}
\A {Ga\"\i d Guillou}
\A {Anna Guillou}
\A {Gwenol\'e Guillou}
\A {Soazig Guillou}
\A {Tom Berson}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {How to Generate and Exchange Secrets}
\A {A. C.-C. Yao}
\J {Proc. of the 27th IEEE Symp. on the Foundations of Comp. Sc.}
\D {1982}

\T {How to Generate Cryptographically Strong Sequences of Pseudo-Random Bits}
\A {Manuel Blum}
\A {Silvio Micali}
\J {SIAM J. on Computing, {\bf 13,} 4}
\D {1984}
\X {We give a set of conditions that allow one to generate 50--50 unpredictable bits. Based on those conditions, we present a general algorithmic scheme for constructing polynomial-time deterministic algorithms that stretch a short secret random input into a long sequence of unpredictable pseudo-random bits. We given an implementation of our scheme and exhibit a pseudo-random bit generator for which any efficient strategy for predicting the next output bit with better than 50--50 chance is easily transformable to an ``equally efficient'' algorithm for solving the discrete logarithm problem. In particular: if the discrete logarithm problem cannot be solved in probabilistic polynomial time, no probabilistic polynomial-time algorithm can guess the next output bit better than by flipping a coin: if ``head'' guess ``0'', if ``tail'' guess ``1''.}

\T {How to Generate Factored Random Numbers}
\A {Eric Bach}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {This paper presents an efficient method for generating a random integer with known factorization. When given a positive integer $N,$ the algorithm produces the prime factorization of an integer $x$ drawn uniformly from $N/2<x\le N.$ The expected running time is that required for $O(\ln N)$ prime tests on integers less than or equal to $N.$ If there is a fast deterministic algorithm for primality testing, this is a polynomial-time process. The algorithm can also be implemented with randomized primality testing; in this case, the distribution of correctly factored outputs is uniform, and the possibility of an incorrectly factored output can in practice be disregarded.}

\T {How to Generate Random Numbers with Known Factorization}
\A {Eric Bach}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {Recent work in public-key cryptography has led to the need to generate large random numbers with known factorization. This paper describes a probabilistic algorithm that produces a random $k$-bit integer in factored form. Each such number is equally likely to appear. The expected running time is, up to a constant factor, that required for $k$ prime tests on $k$-bit integers. Thus, under reasonable assumptions about the speed of primality testing, it is a polynomial time process.}

\T {How to Improve Signature Schemes}
\A {Gilles Brassard}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Bellare and Micali have shown how to build strong signature schemes from the mere assumption that trapdoor permutation generators exist. Subsequently, Naor and Yung have shown how to weaken the assumption under which a strong signature scheme can be built: it is enough to start from permutations that are one-way rather than trapdoor. In this paper, which is independent from and orthogonal to the work of Naor and Yung, we weaken in a different way the assumption under which a strong signature scheme can be built: it is enough to start from what we call a weak signature scheme (defined below). Weak signature schemes are trapdoor in nature, but they need not be based on permutations. As an application, the Guillou-Quisquater-Simmons signature scheme (a variant on Williams' and Rabin's schemes, also defined below) can be used to build a strong signature scheme, whereas it is not clear that it gives rise directly to an efficient trapdoor (or even one-way) permutation generator.}

\T {How to Insure that Data Acquired to Verify Treaty Compliance are Trustworthy}
\A {Gustavus J. Simmons}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {In a series of papers, this author has documented the evolution at the Sandia National Laboratories of a solution to the problem of how to make it possible for two mutually distrusting (and presumed deceitful) parties, the host and the monitor, to both trust a data acquisition system whose function it is to inform the monitor, and perhaps third parties, whether the host has or has not violated the terms of a treaty. The even more important question of what data will adequately show compliance (or noncompliance) and of how this data can be gathered in a way that adequately insures against deception will not be discussed here. We start by assuming that such a data acquistion system exists, and that the opportunities for deception which are the subject of this paper lie only in the manipulation of the data itself, i.e., forgery, modification, retransmission, etc. The national interests of the various participants, host, monitor and third parties, at first appear to be mutually exclusive and irreconcilable, however we will arrive at the conclusion that it is possible to simultaneously satisfy the interests of all parties. The technical device on which this resolution depends is the concatenetation of two or more private authentication channels to create a system in which each participant need only trust that part of the whole which he contributed. In the resulting scheme, no part of the data need be kept secret from any participant at any time; no party, nor collusion of fewer than all of the parties can utter an undetectable forgery; no unilateral action on the part of any party can lessen the confidence of the others as to the authenticity of the data and finally third parties, i.e., arbiters, can be logically persuaded of the authenticity of data. Thus, finally after nearly two decades of development a complete technical solutions is in hand for the problem of trustworthy verification of treaty compliance.}

\T {How to Keep a Secret Alive: Extensible Partial Key, Key Safeguarding, and Threshold Systems}
\A {David Chaum}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {How to Keep Authenticity Alive in a Computer Network}
\A {Fritz Bauspie{\ss}}
\A {Hans-Joachim Knobloch}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper we present a cryptographic scheme that allows to ensure the ongoing authenticity and security of connections in a computer network. This is achieved by combining a zero-knowledge authentication and a public key exchange protocol. It is noteworthy that due to the combination both protocols gain additional security against attacks that would otherwise be successful. The scheme is applicable to both local area networks and internetworks.}

\T {How to Make Replicated Data Secure}
\A {Maurice P. Herlihy}
\A {J. D. Tygar}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Many distributed systems manage some form of long-lived data, such as files or databases. The performance and fault-tolerance of such systems may be enhanced if the repositories for the data are physically distributed. Neverthe less, distribution makes security more difficult, since it may be difficult to ensure that each repository is physically secure, particularly if the number of repositories is large. This paper proposes new techniques for ensuring the security of long-lived, physically distributed data. These techniques adapt replication protocols for fault-tolerance to the more demanding requirements of security. For a given threshold value, one set of protocols ensures that an adversary cannot ascertain the state of a data object by observing the contents of fewer than a threshold of repositories. These protocols are cheap; the message traffic needed to tolerate a given number of compromised repositories is only slightly more than the message traffic needed to tolerate the same number of failures. A second set of protocols ensures that an object's state cannot be altered by an adversary who can modify the contents of fewer than a threshold of repositories. These protocols are more expensive; to tolerate $t-1$ compromised repositories, clients executing certain operations must communicate with $t-1$ additional sites.}

\T {How to Play Any Mental Game}
\A {Oded Goldreich}
\A {Silvio Micali}
\A {Avi Wigderson}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {We present a polynomial-time algorithm that, given as input the description of a game with incomplete information and any number of players, produces a protocol for playing the game that leaks no partial information, provided the majority of the player is honest. Our algorithm automatically solves all the multi-party protocol problems addressed in complexity-based cryptography during the last 10 years. It actually is {\em a completeness theorem\/} for the class of distributed protocols with honest majority. Such completeness theorem is optimal in the sense that, if the majority of the players is not honest some protocol problems have no efficient solution.}

\T {How to Predict Congruential Generators}
\A {Hugo Krawczyk}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In this paper we show how to predict a large class of pseudorandom number generators. We consider congruential generators which output a sequence of integers $s_0,s_1,\ldots$ where $s_i$ is computed by the recurrence $\displaystyle s_i\equiv \sum_{j=1}^k \alpha_j\Phi_j(s_0,s_1,\ldots,s_{i-1})(\mod m)$ for integers $m$ and $\alpha_j,$ and integer functions $\Phi_j,$ $j=1,\ldots,k.$ Our predictors are efficient, provided that the functions $\Phi_j$ are computable (over the integers) in polynomial time. These predictors have access to the elements of the sequence prior to the element being predicted, but they do not know the modulus $m$ of the coefficients $\alpha_j$ the generator actually works with. This extends previous results about the predictability of such generators. In particular, we prove that multivariate polynomial generators, i.e. generators where $s_i\equiv P(s_{i-n},\ldots,s_{i-1})(\mod m),$ for a polynomial $P$ of fixed degree in $n$ variables, are efficiently predictable.}

\T {How to Prove All NP Statements in Zero-Knowledge and a Methodology of Cryptographic Protocol Design}
\A {Oded Goldreich}
\A {Silvio Micali}
\A {Avi Wigderson}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Under the assumption that encryption functions exist, we show that {\em all languages in NP posses zero-knowledge proofs.} That is, it is possible to demonstrate that a CNF formula is satisfiable without revealing any other property of the formula. In particular, without yielding neither a satisfying assignment nor weaker properties such as whether there is a satisfying assignment in which $x_1=TRUE,$ or whether there is a satisfying assignment in which $x_1=x_3$ etc. The above result allows us to prove two fundamental theorems in the field of (two-party and multi-party) cryptographic protocols. These theorems yield automatic and efficient transformations that, given a protocol that is correct with respect to an extremely weak adversary, output a protocol correct in the most adversarial scenario. Thus, these theorems imply powerful methodologies for developing two-party and multi-party protocols.}

\T {How to Prove a Theorem So No One Else Can Claim It}
\A {M. Blum}
\J {Proc. of the Int. Congress of Mathematician, Berekeley CA, pp. 1444--1451}
\D {1986}

\T {How to Prove Yourself: Practical Solutions to Identification and Signature Problems}
\A {Amos Fiat}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {In this paper we describe a simple identification and signature schemes which enable any user to prove his identity and the authenticity of his messages to any other user without shared or public keys. The schemes are provably secure against any known or chosen message attack if factoring is difficult, and typical implementations require only 1\% to 4\% of the number of modular multiplications required by the RSA scheme. Due to their simplicity, security and speed, these schemes are ideally suited for microprocessor-based devices such as smart cards, personal computers, and remote control systems.}

\T {How to (Really) Share a Secret!}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {How to Reduce your Enemy's Information}
\A {Charles H. Bennett}
\A {Gilles Brassard}
\A {Jean-Marc Robert}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {How to Say ``No''}
\A {Albrecht Beutelspacher}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We pose the question whether there exist threshold schemes with positive and negative votes (shadows), that is threshold scheme in which any qualified minority can prohibit the intended action. Using classical projective geometry, the existence of such systems is proved. Finally, possible attacks on such systems are discussed.}

\T {How to Share a Secret}
\A {Maurice Mignotte}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {How to Share a Secret with Cheaters}
\A {Martin Tompa}
\A {Heather Woll}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {This paper demonstrates that Shamir's scheme is not secure against cheating. A small modification to his scheme retains the security and efficiency of the original, is secure against cheating, and preserves the property that its security does not depend on any unproven assumptions such as the intractability of computing number-theoretic functions.}

\T {How to Sign Given Any Trapdoor Function}
\A {Mihir Bellare}
\A {Silvio Micali}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag (extended abstract only)}
\D {1988}
\X {We present a digital signature scheme which combines high security with the property of being based on a very general assumption: the existence of trapdoor permutations. Previous signature schemes with comparable levels of security were based on assumptions of the computational hardness of particular algebraic problems such as factoring. Our contribution is to free this important cryptographic primitive from the fortunes of any specific algebraic problem by establishing a truly general signature scheme.}

\T {How to Simultaneously Exchange a Secret Bit By Flipping a Symmetrically-Biased Coin}
\A {M. Luby}
\A {S. Micali}
\A {C. Rackoff}
\J {Proc. of the 24th IEEE Symp. on Foundations of Comp. Sc., pp. 11--21}
\D {1983}

\T {How to Solve any Protocol Problem---An Efficiency Improvement}
\A {Oded Goldreich}
\A {Ronen Vainish}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Consider $n$ parties having local inputs $x_1,x_2,\ldots,x_n$ respectively, and wishing to compute the value $f(x_1,\ldots,x_n),$ where $f$ is a predetermined function. Loosely speaking, an $n$-party protocol for this purpose has {\em maximum privacy\/} if whatever a subset of the users can efficiently compute when participating in the protocol, they can also compute from their local inputs and the value $f(x_1,\ldots,x_n).$ Recently, Goldreich, Micali and Wigderson have presented a polynomial-time algorithm that, given a Turing machine for computing the function $f,$ outputs an $n$-party protocol with maximum privacy for distributively computing $f(x_1,\ldots,x_n).$ The maximum privacy protocol output uses as a subprotocol a maximum privacy two-part protocol for computing a particular simple function $p_1(\cdot,\cdot).$ More recently, Haber and Micali have improved the efficiency of the above $n$-party protocols, using a maximum privacy two-party protocol for computing another particular function $p_2(\cdot,\cdot).$ Both works use a {\em general\/} result of Yao in order to implement protocols for the {\em particular\/} functions $p_1$ and $p_2.$ In this paper, we present direct solutions to the above two particular protocol problems, avoiding the use of Yao's general result. In fact, we present two alternative approaches for solving both problems. The first approach consists of a simple reduction of these two problems to a variant of {\em Oblivious Transfer.} The second approach consists of designing direct solutions to these two problems, assuming the intractability of the Quadratic Residuosity problem. Both approaches yield simpler and more efficient solutions than the ones obtained by Yao's result.}

\T {The Hut Six Story}
\A {Gordon Welchman}
\J {McGraw-Hill}
\D {1982}

\T {IC-Cards in High-Security Applications}
\A {I. Schaum\"uller-Bichl}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {IC-cards, which are credit-card-size plastic cards with integrated CPU and memory, have increasing attracted public interest in recent years. Mainly used as ``electronic money'' in the business of banking and as a storage medium at first, the IC-card is gaining more and more importance as a secure and user-optimised component for cryptographic systems. The following article analyses IC-cards with regard to their own security and their applications in the field of ``EDP security''. The paper is concluded with a glance at the requirements to be met by future card generations and on possible developments.}

\T {Identity-Based Conference Key Distribution Systems}
\A {Kenji Koyama}
\A {Kazuo Ohta}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {This paper proposes identity-based key distribution systems for generating a common secret conference key for two or more users. Users are connected in a ring, a complete graph, or a star network. Messages among users are authenticated using each user's identification information. The security of the proposed system is based on the difficulty of both factoring large numbers and computing discrete logarithms over large finite fields.}

\T {Identity-Based Cryptosystems and Signature Schemes}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {An Identity-Based Key-Exchange Protocol}
\A {Christoph G. G\"unther}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {The distribution of cryptographic key has always been a major problem in applications with many users. Solutions were found for closed groups or small open systems. These are, however, not efficient for large networks. We propose an identity-based approach to that problem which is simple and applicable to networks of arbitrary size. With the solution proposed, the user group can, furthermore, be extended at will. Each new user needs only to visit a key authentication center (KAC) once and is from then on able to exchange authenticated keys with each other user of the network. We expect this type of approach, which was originally conceived for authentication and signatures, to play an increasing role in the solution of all types of key distribution problems.}

\T {An Impersonation-Proof Identity Verification Scheme}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {The Implementation of a Cryptography-Based Secure Office System}
\A {Christian Mueller-Schloer}
\A {Neal R. Wagner}
\J {AFIPS Proceedings, 51, National Computer Conference}
\D {1982}
\X {A cryptography-based secure office system is discussed, including design
criteria and a specific implementation. The system is indented to be practical,
simple, and inexpensive, but also highly secure. The implementation uses a
hybrid scheme of conventional (DES) and public-key (RSA) cryptography. Randomly
generated DES keys encrypt messages and files, and the DES keys themselves and
a one-way hash of the messages are encrypted and signed by RSA keys. The system
provides secure electronic mail (including electronic registered mail and an
electronic notary public), secure two-way channels, and secure user files.
Timestamps and a special signed file of public keys help decrease the need for
an online central authority involved in all transactions.}

\T {Implementation Study of Public Key Cryptographic Protection in an Existing Electronic Mail and Document Handling System}
\A {J. Vandewalle}
\A {R. Govaerts}
\A {W. {de Becker}}
\A {M. Decroos}
\A {G. Speybrouck}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Implementing an Electronic Notary Public}
\A {L. M. Adleman}
\J {Advances in Cryptology---CRYPTO '82, Proceedings, Plenum Press}
\D {1983}

\T {Implementing the Rivest Shamir and Adleman Public Key Encryption Algorithm on a Standard Digital Signal Processor}
\A {Paul Barrett}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A description of the techniques employed at Oxford University to obtain a high speed implementation of the RSA encryption algorithm on an ``off-the-shelf'' digital signal processing chip. Using these techniques a two and a half second (average) encrypt time (for 512 bit exponent and modulus) was achieved on a first generation DSP (The Texas Instruments TMS 32010) and times below one second are achievable on second generation parts. Furthermore the techniques of algorithm development employed lead to a provably correct implementation.}

\T {The Importance of ``Good'' Key Scheduling Schemes (How to Make a Secure DES$^*$ Scheme with $\le$ 48 Bit Keys?)}
\A {Jean-Jacques Quisquater}
\A {Yvo Desmedt}
\A {Marc Davio}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {In DES the key scheduling scheme uses mainly shift registers. By modifying this key scheduling, conventional cryptosystems can be designed which are, {\em e.g.,} strong against exhaustive key search attacks (without increasing the key size), or have public key like properties. Other effects obtainable by modifying the key scheduling and their importance are discussed.}

\T {Impossibility and Optimality Results on Constructing Pseudorandom Permutations}
\A {Yuliang Zheng}
\A {Tsutomu Matsumoto}
\A {Hideki Imai}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Let $I_n=\{0,1\}^n,$ and $H_n$ be the set of all functions from $I_n$ to $I_n.$ For $f\in H_n,$ define the {\em DES-like transformation\/} associated with $f$ by $F_{2n,f}(L,R)=(R\oplus f(L),L),$ where $L,R\in I_n.$ For $f_1,f_2,\ldots,f_s\in H_n,$ define $\psi(f_s,\ldots,f_2,f_1) = F_{2n,f_s}\circ\cdots\circ F_{2n,f_2}\circ F_{2n,f_1}.$ Our main result is that $\psi(f^k,f^j,f^i)$ is {\em not\/} pseudorandom for any positive integers $i,j,k,$ where $f^i$ denotes the $i$-fold composition of $f.$ Thus, as immediate consequences, we have that (1) none of $\psi(f,f,f),$ $\psi(f,f,f^2)$ and $\psi(f^2,f,f)$ are pseudorandom and, (2) Ohnishi's constructions $\psi(g,g,f)$ and $\psi(g,f,f)$ are optimal. Generalizations of the main result are also considered.}

\T {An Improved Protocol For Demonstrating Possession of Discrete Logarithms and Some Generalizations}
\A {David Chaum}
\A {Jan-Hendrik Evertse}
\A {Jeroen {van de Graaf}}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {A new protocol is presented that allows $A$ to convince $B$ that she knows a solution to the Discrete Log Problem---i.e. that she knows an $x$ such that $\alpha^x\equiv\beta(\mod N)$ holds---without revealing anything about $x$ to $B.$ Protocols are given both for $N$ prime and for $N$ composite. We also give protocols for extensions of the Discrete Log problem allowing $A$ to show possession of: (1) multiple discrete logarithms to the same base at the same time, i.e. knowing $x_1,\ldots,x_K$ such that $\alpha^{x_1}\equiv\beta_1,\ldots,\alpha_K^{x_K}\equiv\beta_K;$ (2) several discrete logarithms to different bases at the same time, i.e. knowing $x_1,\ldots,x_K$ such that the product $\alpha_1^{x_1}\alpha_2^{x_2}\cdots\alpha_K^{x_K}\equiv\beta;$ (3) a discrete logarithm that is the simultaneous solution of several different instances, i.e. knowing $x$ such that $\alpha_1^{x_1}\equiv\beta_1,\ldots,\alpha_K^{x_K}\equiv\beta_K.$ We can prove that the sequential versions of these protocols do not reveal any ``knowledge'' about the discrete logarithm(s) in a well-defined sense, provided that $A$ knows (a multiple of) the order of $\alpha.$}

\T {An Improvement of the Fiat-Shamir Identification and Signature Scheme}
\A {Silvio Micali}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {In 1986 Fiat and Shamir exhibited zero-knowledge based identification and digital signature schemes which require only 10 to 30 modular multiplications per party. In this paper we describe an improvement of this scheme which reduces the verifier's complexity ti less than 2 modular multiplications and leaves the prover's complexity unchanged. The new variant is particularly useful when a central computer has to verify in real time signed messages from thousands of remote terminals, or when the same signature has to be repeatedly verified.}

\T {An Improvement to Rabin's Probabilistic Algorithm for Generating
Irreducible Polynomials Over GF$(p)$}
\A {J. Calmet}
\A {R. Loos}
\J {Info. Proc. Letters {\bf 11,} 2}
\D {1980}

\T {The Inaccessible Set: A Classification by Query Type of Security Risks in
Statistical Databases}
\A {E. L. Leiss}
\J {Info. Proc. Letters {\bf 23,} 6}
\D {1986}
\X {The inaccessible set consists of those elements in a statistical datbase
which cannot be compromised if querier of a certain fixed type are used. We
define the size of the inaccessible set as a measure of the security of
statisitical databases; this measure has the property that it reflects changes
in the type of the queries in a very direct way. We then dervie several of these
measures for various types of queries.}

\T {Increasing the Orders of Equidistribution of the Leading Bits of the
Tausworthe Sequence}
\A {M. Fushimi}
\J {Info. Proc. Letters {\bf 16,} 4}
\D {1983}

\T {An Industry Perspective of the CCEP}
\A {C. Barker}
\J {2nd Annual AIAA Computer Security Conf. Proc.}
\D {1986}

\T {Inferring Sequences Produced by Pseudo-Random Number Generators}
\A {Joan Boyar}
\J {J ACM {\bf 36,} 1}
\D {1989}
\X {In this paper, efficient algorithms are given for inferring sequences
produced by certain pseudo-random number generators. The generators cosidered
are all of the form $X_n=\sum_{j=1}^k
\alpha_j\phi_j(X_0,X_1,\ldots,X_{n-1})(\mod m).$ In each case, we assume that
the functions $\phi_j$ are known and polynomial time computable, but that the
coefficients $\alpha_j$ and the modulus $m$ are unknown. Using this general
method, specific examples of generators having this form, the linear
congruential method, linear congruences with $n$ terms in the recurrence, and
quadratic congruences are shown to be cryptographically insecure.}

\T {Informational Divergence Bounds for Authentication Codes}
\A {Andrea Sgarro}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We give an easy derivations of Simmons' lower bound for impersonation games which is based on the non-negativity of the informational divergence. We show that substitution games can be reduced to ancillary impersonation games. We use this fact to extend Simmons' bound to substitution games: the lower bound we obtain performs quite well against those available in the literature.}

\T {Information Security---An Overview}
\A {A. L. Andreassen}
\A {D. F. Schreiber}
\A {W. J. Leighton}
\J {AT\&T Technical J. {\bf 67,} 3, pp. 2--8}
\D {1988}

\T {Information System Security and Privacy}
\A {Willis H. Ware}
\J {C ACM {\bf 27,} 4}
\D {1984}
\X {Industry experts provide a perspective on present and future dimensions of
the computer security and privacy issue.}

\T {Information-Theoretic Reductions Among Disclosure Problems}
\A {G. Brassard}
\A {C. Cr\'epeau}
\A {J.-M. Robert}
\J {Proc. of the 27th IEEE Symp. on Foundations of Comp. Sc., pp. 168--173}
\D {1986}

\T {An Information-Theoretic Treatment of Homophonic Substitution}
\A {Hakon N. Jendal}
\A {Yves J. B. Kuhn}
\A {James L. Massey}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Information Theory Without the Finiteness Assumption, I: Cryptosystems as Group-Theoretic Objects}
\A {G. R. Blakley}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Information Theory Without the Finiteness Assumptions, II: Unfolding the DES}
\A {G. R. Blakley}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {The DES is described in purely mathematical terms by means of confusion, diffusion and arithmetic involving a group of messages and a group of keys. It turns out to be a diffusion/arithmetic cryptosystem in which confusion plays no role, although the $S$-boxes effect an arithmetic operation of replacement (which is sometimes mistaken for confusion) as an important part of the encryption process.}

\T {Initializing Generalized Feedback Shift Register Pseudorandom Number
Generators}
\A {Bruce Jay Collings}
\A {G. Barry Hembree}
\J {J ACM {\bf 33,} 4}
\D {1986}
\X {The generalized feedback shift register pseudorandom number generators
proposed by Lewis and Payne provide a very attractive method of random number
generation. Unfortunately, the published initialization procedure can be
extremely time consuming. This paper considers an alternative method of
initialization based on a natural polynomial representation for the terms of a
feedback shift register sequence that results in substantial improvements in
the initialization process.}

\T {Insecurity of Set Controls for Statistical Databases}
\A {J. {Schl\"orer}}
\J {Info. Proc. Letters {\bf 18,} 2}
\D {1984}

\T {Insuring Computer Risks}
\A {Roy Martin Richards}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {Individuals and organizations who own or use computers in daily operations face many exposures to the risk of loss of hardware, software, and other computing assets, including liability arising from computing operations. Many loss prevention techniques have been developed to lessen the frequency and severity of such losses but in the end, insurance coverage must be obtained for maximum protection. Securing proper computer insurance coverage at a reasonable price is not always easy. In fact, much time and expense can go into a well-planned insurance program for computing operations. This article examines ways to minimize premiums for computer coverage as part of an overall plan of loss prevention, risk control, and contingency funding. It explains why computer insurance premiums fluctuate and how to take advantage of the fluctuation in the computer insurance market. It also identifies some of the factors that are important to insurers and how they relate to computer insurance. The techniques explained in the article, when used as a part of the comprehensive risk management plan, can help the insured computing operation provide for loss contingencies and minimize the overall cost.}

\T {Integrating Cryptography in ISDN}
\A {K{\aa} re Presttun}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Integrating Security Activities into the Software Development Life Cycle and the Software Quality Assurance Process}
\A {Frederick G. Tompkins}
\A {Russell Rice}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {Security concerns should be an integral part of the entire planning, development, and operation of a computer application. Inadequacies in the design and operation of computer applications are a very frequent source of security vulnerabilities associated with computers. In most cases, the effort to improve security should concentrate on the application software. The system development life cycle (SDLC) technique provides the structure to assume that security safeguards are planned, designed, developed and tested in a manner that is consistent with the sensitivity of the data and/or the application. The software quality assurance process provides the reviews and audits to assure that the activities accomplished during the SDLC produce operationally effective safeguards.
This paper addresses two issues of concern to those responsible for ensuring that the safeguards incorporated into application software are adequate and appropriate. The first issue addresses the integration of specific security activities into the SDLC. The discussion of this issue addresses the following security activities in the SDLC; determination of the sensitivity of the application and data; determination of security objectives; assessment of the security risks; conduct of the security feasibility study; definition of security requirements; development of the security test plan; design of the security specifications; development of the security test procedures; writing of the security-relevant code; writing of the security-relevant documentation; conduct of the security test and evaluation; writing on the security test analysis report and, preparation of the security certification report.
The second security issue addresses the security reviews and audits that should be integrated into the software quality assurance process to ensure that the security activities in the SDLC are accomplished. The security reviews and audits discussed include: the security requirements review; the security design review; the security specification review; the security readiness review; and the security test and evaluation review. Also addressed is how quality software is defined and achieved and why and how the concept of quality should be applied to application software security safeguards.}

\T {An Interactive Data Exchange Protocol Based on Discrete Exponentiation}
\A {G. Agnew}
\A {R. Mullin}
\A {S. Vanstone}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Internal Control in Local Area Networks: an Accountant's Perspective}
\A {Robert M. {Harper Jr.}}
\J {Computers \& Security, {\bf 5,} 1}
\D {1986}
\X {Control and security are, arguably, among the major weaknesses of today's local area networks (LANs). This article presents an accountant's view of selected issues related to six internal control categories: (1) transmission controls, (2) access controls, (3) file management, (4) encryption, (5) activity monitoring, and (6) application controls. The discussion includes a detailed example of a popular, commercially available LAN.}

\T {The Internet Worm: Crisis and Aftermath}
\A {Eugene H. Spafford}
\J {Communications of the ACM, {\bf 32,} 6, pp. 678++}
\D {1989}
\X {Last November the Internet was infected with a worm program that eventually spread to thousands of machines, disrupting normal activities and Internet connectivity for many days. The following article examines just how this worm operated.}

\T {The Internet Worm Incident}
\A {E. H. Spafford}
\J {Technical Report 933, Purdue University}
\D {1989}

\T {The Internet Worm Program: An Analysis}
\A {E. H. Spafford}
\J {Technical Report 823, Purdue University}
\D {1988}

\T {Intractable Problems in Number Theory}
\A {Eric Bach}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {This paper surveys computational problems related to integer factorization and the calculation of discrete logarithms in various groups. Its aim is to provide theory sufficient for the derivation of heuristic running time estimates, and at the same time introduce algorithms of practical value.}

\T {An Introduction to Arithmetic Coding}
\A {Glen G. {Langdon Jr.}}
\J {IBM J. of Research and Development, {\bf 28,} 2}
\D {1984}
\X {Arithmetic coding is a data compression technique that encodes data (the data string) by creating a code string which represents a fractional value on the number line between 0 and 1. The coding algorithm is symbolwise recursive, i.e., it operates upon and encodes (decodes) one data symbol per iteration or recursion. On each recursion, the algorithm successively partitions an interval of the number line between 0 and 1, and retains one of the partitions as the new interval. Thus, the algorithm successively deals with smaller intervals, and the code string, viewed as a magnitude, lies in each of the nested intervals. The data string is recovered by using magnitude comparison on the code string to recreate how the encoder must have successively partitioned and retained each nested subinterval. Arithmetic coding differs considerably from the more familiar compression coding techniques, such as prefix (Huffman) codes. Also, it should not be confused with error control coding whose object is to detect and correct errors in computer operations. This paper presents the key notions of arithmetic coding by means of simple examples.}

\T {An Introduction to Contemporary Cryptology}
\A {James L. Massey}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {An appraisal is given of the current status, both technical and nontechnical, of cryptologic research. The principal concepts of both secret-key and public-key cryptography are described. Shannon's theory of secrecy and Simmon's theory of authenticity are reviewed for the insight that they give into practical cryptographic systems. Public-key concepts are illustrated through consideration of the Diffie-Hellman public-key distribution system and the Rivest-Shamir-Adleman public-key cryptosystem. The subtleties of cryptographic protocols are shown through consideration of some specific such protocols.}

\T {An Introduction to Cryptology}
\A {Henk C. A. {van Tilborg}}
\J {Kluwer Academic Publishers}
\D {1988}
\X {Classical systems, Vigen\`ere, Caesar, incidences of coincidences, shift register sequences, linear feedback, nonlinear algorithms, Shannon theory, Huffman codes, DES, public key cryptography, the discrete logarithm problem, RSA, primality tests, the McEliece system, the knapsack problem, threshold schemes. Appendices for elementary number theory and the theory of finite fields.}

\T {An Introduction to Fast Generation of Large Prime Numbers}
\A {C. Couvreur}
\A {J.-J. Quisquater}
\J {Philips J. of Research, {\bf 37,} pp. 231--264}
\D {1982}

\T {An Introduction to Minimum Disclosure}
\A {G. Brassard}
\A {D. Chaum}
\A {C. Cr\'epeau}
\J {CWI Quarterly, {\bf 1,} pp. 3--17}
\D {1988}

\T {Is DES a Pure Cipher (Results of More Cycling Experiments on DES)}
\A {Burton S. {Kaliski Jr.}}
\A {Ronald L. Rivest}
\A {Alan T. Sherman}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {During summer 1985, we performed eight cycling experiments on the Data Encryption Standard (DES) to see if DES has certain algebraic weaknesses. Using special-purpose hardware, we applied the cycling closure test described in our Eurocrypt 85 paper to determine whether DES is a pure cipher. We also carried out a stronger version of this test. (A cipher is {\em pure\/} if, for any keys $i,j,k,$ there exists some key $l$ such that $T_iT_j^{-1}T_k=T_l,$ where $T_w$ denotes encryption under key $w.$) In addition, we followed the orbit of a randomly chosen DES transformation for $2^{36}$ steps, as well as the orbit of the composition of two of the ``weak key'' transformations. Except for the weak key experiment, our results are consistent with the hypothesis that DES acts like a set of randomly chosen permutations. In particular, our results show with overwhelming confidence that DES is not pure. The weak key experiment produced a short cycle of about $2^{33}$ steps, the consequences of hitting a fixed point for each weak key.}

\T {Is the Data Encryption Standard a Group?}
\A {Burton S. {Kaliski Jr.}}
\A {Ronald L. Rivest}
\A {Alan T. Sherman}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\J {J. of Cryptology, {\bf 1}}
\D {1988}
\X {The Data Encryption Standard (DES) defines an indexed set of permutations acting on the message space $M=\{0,1\}^{64}.$ If this set of permutations were closed under functional composition, then DES would be vulnerable to a known-plaintext attack that runs in $2^{28}$ steps, on the average. It is unknown in the open literature whether or not DES has this weakness. We describe two statistical tests for determining if an indexed set of permutations acting on a finite message space forms a group under functional composition. The first test is a ``meet-in-the-middle'' algorithm which uses $O(\sqrt{K})$ time and space, where $K$ is the size of the key space. The second test, a novel cycling algorithm, uses the same amount of time but only a small constant amount of space. Each test yields a known-plaintext attack against any finite, deterministic cryptosystem that generates a small group. The cycling test takes a pseudo-random walk in the message space until a cycle is detected. For each step of the pseudo-random walk, the previous ciphertext is encrypted under a key chosen by a pseudo-random function of the previous ciphertext. Results of the test are asymmetrical: long cycles are overwhelming evidence that the set of permutations is not a group; short cycles are strong evidence that the set of permutations has a structure different from that expected from a set of randomly chosen permutations. Using a combination of software and special-purpose hardware, we applied the cycling test to DES. Our experiments show, with a high degree of confidence, that DES is not a group.}

\T {Is There an Ultimate Use of Cryptography}
\A {Yvo Desmedt}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Cryptography can increase the security of computers and modern telecommunications systems. Software viruses and hardware trapdoors are aspects of computer security. Based on a combination of these two aspects, an attack on computer security is presented. The complexity of finding such an attack is discussed. A new open problem is: can cryptography prevent such an attack.}

\T {Is the RSA - Scheme Safe?}
\A {C. P. Schnorr}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {We present a new factoring algorithm which under reasonable assumptions and for $r\ge2$ will factor about $n(r-2)^{-(r-2)}$ integers in $[1,n]$ within $n^{1/2r}$ multiplications in $G(-n).$ Here $G(-n)$ is the group of equivalence classes under $SL_2(\Z),$ of primitive, positive forms $ax^2 + bxy + cy^2$ with discriminant $-n = b^2 - 4ac.$ Let $h(-n) = |G(-n)|$ be the class number. Then $n$ will be factored within this time bound if (1) the largest prime divisor of $h(-n)$ is $\le n^{1/r}$ (2) the second largest prime divisor of $h(-n)$ is $\le n^{1/2r}.$ So far it is unpredictable which integers $n$ satisfy these conditions.}

\T {A Jacobi-Like Algorithm for Computing the QR-Decomposition}
\A {F. T. Luk}
\J {Technical Report: TR84--612, Cornell University}
\D {1984}

\T {Josephson Pseudorandom Bit-Sequence Generator}
\A {N. Fujimaki}
\A {T. Imamura}
\A {S. Hasuo}
\J {IEEE J. of Solid-State Circuits}
\D {1988}

\T {Kahn On Codes: Secrets of the New Cryptology}
\A {David Kahn}
\J {MacMillan, NY}
\D {1983}
\X {Uncovering cryptology's past, how {\em The Codebreakers\/} was written, historical and technical studies, the politics of cryptology, American codes and the Pentagon papers, tapping computers, big ear or big brother?, cryptology goes public, some book reviews, codes in context, the future.}

\T {The $k$-Distribution of Generalized Feedback Shift-Register Pseudorandom
Numbers}
\A {M. Fushimi}
\A {S. Tezuka}
\J {C ACM {\bf 26,} 7}
\D {1983}
\X {Based on a GFSR theorem, a test for $k$-distributivity is proposed.}

\T {Key Agreements Based On Function Composition}
\A {Rainer A. Rueppel}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Two protocols are presented that accomplish the same goal as the original Diffie-Hellman protocol, namely, to establish a common secret key using only public messages. They are based on $n$-fold composition of some suitable elementary function. The first protocol is shown to fail always when the elementary function is chosen to be linear. This does not preclude its use for a suitable nonlinear elementary function. The second protocol is shown to be equivalent to the Diffie-Hellman protocol when the elementary function is chosen to be linear. Some examples are given to illustrate the use of both protocols. It is still an open problem whether the presented approach allows for an improvement in terms of speed and/or security over the original DH-protocol.}

\T {Key Distribution Protocol for Digital Mobile Communication Systems}
\A {Makoto Tatebayashi}
\A {Natsume Matsuzaki}
\A {David B. {Newman Jr.}}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A key distribution protocol is proposed for digital mobile communication systems. The protocol can be used with a star-type network. User terminals have a constraint of being hardware-limited. Security of the protocol is discussed. A countermeasure is proposed to cope with a possible active attack by a conspiracy of two opponents.}

\T {A Key Distribution Protocol Using Event Markers}
\A {K. R. Bauer}
\A {T. A. Bersen}
\A {R. J. Feiertag}
\J {ACM Trans. on Comp. Sys. {\bf 1,} 3, pp. 249--255}
\D {1983}

\T {Key Distribution System Based On Any One-Way Function}
\A {George Davida}
\A {Yvo Desmedt}
\A {Ren\'e Peralta}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Key Distribution Systems Based on Identification Information}
\A {Eiji Okamoto}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {Two types of key distribution systems based on identification information are proposed, one for decentralized networks and the other for centralized networks. The system suitable for decentralized networks is analogous to the DiffHellmanie-Hellman public key distribution system, in which the former uses each user's identification information instead of a public file used in the latter. The proposed system is able to defend the networks from impostors. The system suitable for centralized networks, which is less analogous to the Diffie-Hellman system, can also defend the networks from impostors. , though the network center does not have any directory of public or private key-encrypting keys of the users. Both of the systems proposed in this paper do not require any services of a center to distribute work keys. Therefore, key management in cryptosystems can be practical and simplified by adopting the identity-based key distribution systems.}

\T {Key Exchange System Based on Real Quadratic Fields}
\A {Johannes A. Buchmann}
\A {Hugh C. Williams}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Key Exchange Using `Keyless Cryptography'}
\A {Bowen Alpern}
\A {Fred B. Schneider}
\J {Information Processing Letters, {\bf 16,} pp. 79--81}
\D {1983}
\J {Technical Report: TR82--513, Cornell University}
\D {1982}
\X {Protocols to generate and distribute secret keys in a computer network are described. They are based on {\em keyless cryptography,} a new cryptographic technique where information is hidden by only keeping the originator of a message, and not its contents secret.}

\T {Keying the German Navy's ENIGMA}
\A {David Kahn}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Key Management For Secure Electronic Funds Transfer in a Retail Environment}
\A {Henry Beker}
\A {Michael Walker}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Key Management Standard}
\A {{American Bankers Association}}
\J {ABA Document 4.3}
\D {1980}

\T {Key Minimal Authentication Systems for Unconditional Secrecy}
\A {Philippe Godlewski}
\A {Chris Mitchell}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper is concerned with cryptosystems offering unconditional secrecy. For those perfect secrecy systems which involve using key just once, the theory is well established since Shannon's works; however, this is not the case for those systems which involve using a key several times. This paper intends to take a rigorous approach to the definition of such systems. We use the basic model for a security code developed by Simmons, initially for unconditional authentication. We consider the definition of perfect L-fold secrecy given by Stinson and used by De~Soete and others. We consider other definitions: Ordered Perfect L-fold secretly and Massey's Perfect L-fold secrecy, and attempt to classify them. Lower bounds are given for the number of keys in such perfect systems and characterisation of systems meeting these lower bounds are obtained. The last part of the paper is concerned with discussing examples of key minimal systems providing unconditional secrecy.}

\T {Keystream Sequences With a Good Linear Complexity Profile for Every Starting Point}
\A {Harald Niederreiter}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {A Knapsack Type Public Key Cryptosystem Based On Arithmetic in Finite Fields}
\A {Benny Chor}
\A {Ronald L. Rivest}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {We introduce a new knapsack type public key cryptosystem. The system is based on a novel application of arithmetic in finite fields, following a construction by Bose and Chowla. Appropriately choosing the parameters, we can control the density of the resulting knapsack. In particular, the density can be made high enough to foil ``low density'' attacks against our system. At the moment, we do not know of any attacks capable of ``breaking'' this system in a reasonable amount of time.}

\T {A Knapsack Type Public Key Cryptosystem Based On Arithmetic in Finite Fields}
\A {Benny Chor}
\A {Ronald L. Rivest}
\J {IEEE Trans. on Info. Th. {\bf 34,} 5}
\D {1988}
\X {A new knapsack-type public key cryptosystem is introduced. The system is based on a novel application of arithmetic in finite fields, following a construction by Bose and Chowla. By appropriately choosing the parameters, one can control the density of the resulting knapsack, which is the ratio between the number of elements in the knapsack and their size in bits. In particular, the density can be made high enough to foil ``low-density'' attacks against our system. At the moment, no attacks capable of ``breaking'' this system in a reasonable amount of time are known.}

\T {Knowledge-Based Analysis of Zero Knowledge}
\A {Joseph Y. Halpern}
\A {Yoram Moses}
\A {Mark R. Tuttle}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {While the intuition underlying a zero knowledge proof system is that no ``knowledge'' is leaked by the prover to the verifier, researches are just beginning to analyze such proof systems in terms of formal notions of knowledge. In this paper we show how interactive proof systems motivate a new notion of {\em practical knowledge,} and we capture the definition of an interactive proof system in terms of practical knowledge. Using this notion of knowledge, we formally capture and prove the intuition that the prover does not leak any knowledge of any fact (other than the fact being proven) during a zero knowledge proof. We extend this result to show that the prover does not leak any knowledge of how to compute any information (such as the factorization of a number) during a zero knowledge proof. Finally, we define the notion of a {\em weak interactive proof\/} in which the prover is limited to probabilistic, polynomial-time computations, and we prove analogous security results for such proof systems. We show that, in a precise sense, any nontrivial weak interactive proof must be a proof about the prover's knowledge, and show that, under natural conditions, the notions of interactive proofs of knowledge are instances of weak interactive proofs.}

\T {Knowledge Complexity of Interactive Proof-Systems}
\A {Shafi Goldwasser}
\A {Silvio Micali}
\A {Charles Rackoff}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}

\T {Large-Scale Randomization Techniques}
\A {Neal R. Wagner}
\A {Paul S. Putter}
\A {Marianne R. Cain}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {This paper looks at a collection of especially simple conventional cryptosystems that use a very large blocksize. One variation use a single xor randomization followed by a single bit permutation. Tight upper and lower bounds are obtained on the number of bits of matching plaintext/ciphertext needed to break the systems. These results follow from two interesting combinatorial theorems. The cryptosystems are not practical because the number of bits is about the same as the keysize. We can make the systems practical by introducing key-dependent pseudo-random numbers, though we then lose any proofs of the difficulty of cryptanalysis.}

\T {A Layered Approach to the Design of Private Key Cryptosystems}
\A {T. E. Moore}
\A {S. E. Tavares}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {This paper presents a layered approach to the design of private key cryptographic algorithms based on a few strategically chosen layers. Each layer is a conceptually simple invertible transformation that may be weak in isolation, but makes a necessary contribution to the security of the algorithm. This is in constrast to algorithms such as DES which utilize many layers and depend on S-boxes that have no simple mathematical interpretation. A property called transparency is introduced to deal with interaction of layers and how they must be selected to eliminate system weaknesses. Utilizing this layered approach, a private key cryptographic algorithm consisting of three layers is constructed to demonstrate the design criteria. The algorithm has an adequate key space and valid keys can be easily generated. The design is based on a symmetrical layered configuration, which allows encryption and decryption to be performed using the same algorithm. The algorithm is suitable for VLSI implementation. Some statistical tests are applied to the algorithm in order that its cryptographic performance can be evaluated. The test results and attempts at cryptanalysis suggest that the three-layered algorithm is secure.}

\T {The Legal Protection of Computer Software}
\A {Robert L. Graham}
\J {C ACM {\bf 27,} 5}
\D {1984}
\X {Legal controversy still surrounds the issue of providing meaningful
protection for commercial software.}

\T {Legal Protection of Software: A Survey}
\A {Michael C. Gemignani}
\J {Advances in Computers, {\bf 22}}
\D {1983}
\X {Copyright, patents, trade secrecy.}

\T {Legal Requirements Facing New Signature Technology}
\A {Mireille Antoine}
\A {Jean-Fran\c cois Brakeland}
\A {Marc Eloy}
\A {Yves Poullet}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {The recognition of electronic signature and electronic message creates many legal problem in its application in the different law systems (ex: Automatic Teller Machines, Odette, $\ldots$). The electronic signature could be declared inadmissible before the Courts; even if declared admissible, the parties will still have to demonstrate its evidence value before a judge, not aware of the technique and who therefore will be suspicious. In fact, the electronic signature, even if so far ignored by the lawmaker, offers a guarantee of quality and certitude unrivalled by the manuscript signature. Nevertheless, if legal texts are unsuited to reality, a simple concealment of these texts is not an adequate answer to the problems faced. Therefore some legal modifications must be done. Jurists are ware of this necessity: International Institutions both public and private are now fighting to encourage the recognition of standard norms in specific areas (customs, banks, $\ldots$). What are the legal requirements related to the definition of the traditional signature? How can the definition of an electronic signature fulfill these legal requirements? From the legal point of view, which lessons could be drawn from the comparison between the two types of signature? What is the technical impact of the norms proposed by International Institutions (UNCID) about ETD (Electronic Transfer of Data)? These are some of the questions which will be dealt within the context of this paper.}

\T {Lentra's Factorisation Method Based On Elliptic Curves}
\A {N. M. Stephens}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Lifetimes of Keys in Cryptographic Key Management Systems}
\A {E. Okamoto}
\A {K. Nakamura}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Limits on the Provable Consequences of One-way Permutations}
\A {Russell Impagliazzo}
\A {Steven Rudich}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {We present strong evidence that the implication ``if one-way permutations exists, then secure secret key agreement is possible'', is not provable by standard techniques. Since both sides of this implication are widely believed true in real life, to show that the implication is false requires a new model. We consider a world where all parties have access to a black box for a randomly selected permutation. Being totally random, this permutation will be strongly one-way in a provable, information-theoretic way. We show that, if $P=NP,$ no protocol for secret key agreement is secure in such a setting. Thus, to prove that a secret key agreement protocol which uses a one-way permutation as a black box is secure is as hard as proving $P\ne NP.$ We also obtain, as a corollary, that there is an oracle relative to which the implication is false, i.e., there is a one-way permutation, yet secret-exchange is impossible. Thus, no technique which relativizes can prove that secret exchange can be based on any one-way permutation. Our results present a general framework for proving statements of the form, ``Cryptographic application $X$ is not likely possible based solely on complexity assumption $Y.$''}

\T {Limits on the Security of Coin Flips When Half the Processors are Faulty}
\A {Richard Cleve}
\J {Proc. of the 18th Annual ACM Symp. of Theory of Computing}
\D {1986}

\T {Linear Ciphers and Random Sequence Generators with Multiple Clocks}
\A {James L. Massey}
\A {Rainer A. Rueppel}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {A construction is given for perfect linear ciphers that uses two digits of key per plaintext digit, which appears to be the minimum possible. The construction utilizes two shift-registers that are clocked at different speeds, and suggests a new type of random sequence generator in which two linear feedback shift-registers are clocked at different speeds and their contents combined at the lower clock rate. The effects of variable speed are analyzed, and the linear complexity of the sequences produced by such generators is determined.}

\T {Linear Complexity and Random Sequences}
\A {Rainer A. Rueppel}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {The problem of characterizing the randomness of finite sequences arises in cryptographic applications. The idea of randomness clearly reflects the difficulty of predicting the next digit of a sequence from all the previous ones. The approach taken in this paper is to measure the (linear) unpredictability of a sequence (finite or periodic) by the length of the shortest linear feedback shift register (LFSR) that is able to generate the given sequence. This length is often referred to in the literature as the {\em linear complexity\/} of the sequence. It is shown that the expected linear complexity of a sequence of $n$ independent and uniformly distributed binary random variables is very close to $n/2$ and, that the variance of the linear complexity is virtually independent of the sequence length, i.e. is virtually a constant! For the practically interesting case of periodically repeating a finite truly random sequence of length $2^m$ or $2^m-1,$ it is shown that the linear complexity is close to the period length.}

\T {Linear Complexity Profiles and Continued Fractions}
\A {Muzhong Wang}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {The linear complexity, ${\cal L}(s^n),$ of a sequence $s^n$ is defined as the length of the shortest linear feedback shift-register (LFSR) that can generate the sequence. The linear complexity profile, $L_{s^n} = L_1L_2\cdots L_n,$ of $s^n$ (where $L_i={\cal L}(s^i),$ $1\le i\le n,$ denotes the linear complexity of first $i$ digits of $s^n$) provides better insight into the complexity of an individual sequence. By the increment sequence $\Delta_{s^n} = \Delta_1\Delta_2\cdots\Delta_m$ in a linear complexity profile, $L_1L_2\cdots L_n,$ we mean the subsequence of positive numbers in the sequence $L_1(L_2-L_1)\cdots(L_n-L_{n-1}).$ For example, if $L_1\cdots L_5= 0 2 2 2 3,$ its increment sequence is $\Delta_{s^5} = \Delta_1\Delta_2 = 2 1.$ If we associate a sequence $s^n$ over {\bf F} with an element $S(z)$ in the field of Laurent series over {\bf F} in the following way $$s^n=s_1s_2\cdots s_n\Longleftrightarrow S(z) = s_1z^{-1} + s_2z^{-2} + \cdots + s_nz^{-n},$$ $S(z)$ can then be written as $$S(z) = a_0(z) + {1\over a_1(z) + {1\over a_2(z) + {\over\ddots + {1\over a_k(z)}}}},$$ where $a_i(z)\in{\bf F}[z],$ the ring of polynomials in $z$ over {\bf F,} for all $i\ge0.$ It will be shown that, for a sequence $s^n,$ the increment sequence $\Delta_{s^n}$ of the linear complexity profile of $s^n$ is as follows. (1) If $2\sum_{i=1}^k \deg(a_i(z)) - \deg (a_k(z))\le n,$ then $\Delta_{s^n} = \deg(a_1(z))\deg(a_2(z))\cdots\deg(a_k(z)).$ (2) If $2\sum_{i=1}^k \deg(a_i(z))-\deg(a_k(z))>n,$ then $\Delta_{s^n} = \deg(a_1(z))\deg(a_2(z))\cdots\deg(a_{k^\prime}(z)),$ where $k^\prime = \max\{j:2\sum_{i=1}^j \deg(a_i(z)-\deg(a_j(z))\le n\}.$}

\T {Linear Recurring $m$-Arrays}
\A {Dongdai Lin}
\A {Mulan Liu}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {In this paper, the properties, structures and translation equivalence relations of linear recurring $m$-arrays are systematically studied. The number of linear recurring $m$-arrays is given.}

\T {Linear Structures in Blockciphers}
\A {Jan-Hendrik Evertse}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Local Authentication in Insecure Environments}
\A {S. Kawai}
\J {Info. Proc. Letters {\bf 25,} 3}
\D {1987}
\X {A local authentication mechanism in which system information such as user
identifiers must be protected from both codebreaking and faking is proposed.
The key is the two-step usage of public key cryptosystem which allows the
public decryption.}

\T {Lock-in Effect in Cascades of Clock-Controlled Shift-Registers}
\A {William G. Chambers}
\A {Dieter Gollmann}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Cascaded cryptographic keystream generators as proposed by Gollmann possess a cryptanalytic weakness termed ``lock-in'' in this article. If the initial state has been guessed correctly apart from its phase a decryption cascade can be set up in which the effects of each stage of the original cascade are unravelled in reverse order. Once the decryption cascade has ``locked in'' on the original cascade, the state of the latter is known, and hence its future output and its output in the remote past. This weakness is studied; its effects are readily mitigated by taking certain precautions. Lock-in may also be used constructively as a synchronization technique.}

\T {A Logic of Authentication}
\A {Michael Burrows}
\A {Martin Abadi}
\A {Roger Needham}
\J {DEC Systems Research Centre}
\D {1989}
\X {Questions of belief are essential in analyzing protocols for authentication in distributed computing systems.  In this paper we motivate, set out, and exemplify a logic specifically designed for this analysis; we show how various protocols differ subtly with respect to the required initial assumptions of the participants and their final beliefs.  Our formalism has enabled us to isolate and express these differences with a precision that was not previously possible. It has drawn attention to features of protocols of which we and their authors were previously unaware, and allowed us to suggest improvements to the protocols.  The reasoning about some protocols has been mechanically verified.  This paper starts with an informal account of the problem, goes on to explain the formalism to be used, and gives examples of its application to protocols from the literature, both with conventional shared-key cryptography and with public-key cryptography.  Some of the examples are chosen because of their practical importance, while others serve to illustrate subtle points of the logic and to explain how we use it.  We discuss extensions of the logic motivated by actual practice---for example, in order to account for the use of hash functions in signatures.  The final sections contain a formal semantics of the logic and some conclusions.}

\T {Lower Bounds on Time-Accuracy Tradeoffs for the 0-1 Knapsack Problem}
\A {Joseph G. Peters}
\J {Technical Report CMPT TR 85--19, Simon Fraser University}
\D {1985}

\T {An LSI Digital Encryption Processor (DEP)}
\A {R. C. Fairfield}
\A {A. Matusevich}
\A {J. Plany}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {This paper describes an LSI digital encryption processor (DEP) for data ciphering. The DEP combines a fast hardware implementation of the Data Encryption Standard (DES) published by the National Bureau of Standards (NBS) with a set of multiplexers and registers under the control of a user programmed sequencer. This architecture enables the user to program any of the DES modes of operation published by NBS. In addition, multiple ciphering operations and multiplexed ciphering operations using up to four different keys may be programmed and internally executed without any external hardware. The DEP is designed as a standard microprocessor peripheral. This LSI device should reduce the current cost and simplify the process of encrypting digital data to a point where it is feasible to include a ciphering function in modems, terminals, and work stations. The ability to internally program cascaded ciphers should substantially increase the security of the DES algorithm and hence, the life of the encryption equipment.}

\T {An LSI Random Number Generator (RNG)}
\A {R. C. Fairfield}
\A {R. L. Mortenson}
\A {K. B. Coulthart}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {LUCIFER: A Cryptographic Algorithm}
\A {A. Sorkin}
\J {Cryptologia {\bf 8,} 1, pp. 22--35}
\D {1984}

\T {An M$^3$ Public-Key Encryption Scheme}
\A {H. C. Williams}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Machine Cryptography and Modern Cryptanalysis}
\A {C.A. Deavours}
\A {L. Kruh}
\J {Artech House, Dedham, MA}
\D {1985}

\T {Making Conditionally Secure Cryptosystems Unconditionally Abuse-Free in a General Context}
\A {Yvo G. Desmedt}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Simmons introduced the concept of subliminal channel in the context of signature systems. Desmedt presented a solution against subliminal channels and extended the solution to abuse-free coin flipping, abuse-free generation of public keys, and abuse-free zero-knowledge. In this paper we demonstrate that a whole family of systems (generalized Arthur-Merlin games) can be made abuse-free, avoiding the exhaustive approach of Desmedt. We will hereto formalize the concept of abuse.}

\T {Managing the EDP Audit and Security Functions}
\A {John G. Beatson}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {As data security and EDP audit assume greater importance in organizational matters, there will be an equally important need for the functions to be properly managed. Data security responsibilities should be delegated to a separate group outside the data processing department and, with EDP audit, must be adequately staffed to meet the requirements of the rapidly changing environment in which personnel are required to work.}

\T {Manipulation and Errors, Detection and Localization}
\A {Ph. Godlewski}
\A {P. Camion}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {We investigate the possibility of using error correcting codes in digital signatures. A scheme combining one way functions and a MDS code is presented and analyzed. We then study an attack upon this scheme and upon more general ones called ``random knapsack schemes'' involving a linear combination $\sum_i T(x_i,i)$ of the message elements $x_i.$}

\T {Master Keys for Group Sharing}
\A {D. E. Denning}
\A {F. B. Schneider}
\J {Info. Proc. Letters {\bf 12,} 1}
\D {1981}

\T {Mathematical Cryptology for Computer Scientists and Mathematicians}
\A {Wayne Patterson}
\J {Rowman \& Littlefield}
\D {1987}

\T {Mathematical Games: Patterns in Primes are a Clue to the Strong Law of Small Numbers}
\A {Martin Gardner}
\J {Scientific American, {\bf 243,} 1}
\D {1980}

\T {Mathematical Investigations of the Data Encryption Standard}
\A {M. Franklin}
\J {Masters Thesis, University of California, Berkeley, CA}
\D {1985}

\T {Maya Writing}
\A {David Stuart}
\A {Stephen D. Houston}
\J {Scientific American, August}
\D {1989}
\X {The Maya had the most sophisticated script in pre-Columbian America. In the past decade scholars have finally been able to read it, filling in significant gaps in our knowledge of Maya society.}

\T {A Measure of Semiequivocation}
\A {Andrea Sgarro}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {A Shannon-theoretic cryptographic model is described in which the purpose of the cryptanalyst is to find a set of $M$ elements containing the solution, rather than finding the solution itself. For $M=2$ we introduce the notions of semientropy, semiequivocation and duplicity distance, which are counterparts to well-known notions met in the case $M=1.$ It is argued that is some situations our model takes into account the semantical competence of the cryptanalyst (as opposed to his statistical competence) better than the usual model does.}

\T {Mental Poker}
\A {Adi Shamir}
\A {Ronald L. Rivest}
\A {Leonard M. Adleman}
\J {The Mathematical Gardner, David A. Klarner (ed.), Prindle, Weber \& Schmidt}
\D {1981}
\X {Can two potentially dishonest players play a fair game of poke without using any cards---for example, over the phone? This paper provides the following answers: {\bf 1} No. (Rigorous mathematical proof supplied.) {\bf 2} Yes, (Correct and complete protocol given.)}

\T {Mental Poker with Three or More Players}
\A {Imre B\'ar\'any}
\A {Zolta\'n F\"uredi}
\J {Information and Control, {\bf 59,} pp. 84--93}
\D {1983}
\X {A protocol is given which deals cards to three or more players in a fair way. Some related questions are also discussed.}

\T {A Message Authentication Algorithm Suitable For a Mainframe Computer}
\A {Donald Watts Davies}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Message Authentication and Dynamic Passwords}
\A {H. J. Beker}
\A {G. M. Cole}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Message Authentication with Arbitration of Transmitter/Receiver Disputes}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Message Protection By Spread Spectrum Modulation in a Packet Voice Radio Link}
\A {M. Kowatsch}
\A {B. O. Eichinger}
\A {F. J. Seifert}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Metamagical Themas: Virus-like Sentences and Self-replicating Structures}
\A {Douglas R. Hofstadter}
\J {Scientific American, {\bf 248,} 1}
\D {1983}

\T {A Method for Obtaining Digital Signatures and Public-Key Cryptosystems}
\A {R. L. Rivest}
\A {A. Shamir}
\A {L. Adleman}
\J {C ACM {\bf 26,} 1}
\D {1983}
\X {An encryption method is presented with the novel property that publicly
revealing an encryption key does not thereby reveal the corresponding
decryption key. This has two important consequences: (1) Couriers or other
secure means are not needed to transmit keys, since a message can be enciphered
using an encryption key publicly revealed by the intended recipient. Only he
can decipher the message, since only he knows the corresponding decryption key.
(2) A message can be ``signed'' using a privately help decryption key. Anyone
can verify this signature using the corresponding publicly revealed encryption
key. Signatures cannot be forged, and a signer cannot later deny the validity
of his signature. This has obvious applications in ``electronic mail'' and
``electronic funds transfer'' systems. A message is encrypted by representing
it as a number $M,$ raising $M$ to a publicly specified power $e,$ then taking
the remainder when the result is divided by the publicly specified product,
$n,$ of two large secret prime numbers $p$ and $q.$ Decryption is similar; only
a different, secret, power $d$ is used, where $e*d\equiv1(\mod(p-1)*(q-1)).$
The security of the system rests in part on the difficulty of factoring the
published divisor, $n.$}

\T {A Method of Software Protection Based on the Use of Smart Cards and Cryptographic Techniques}
\A {Ingrid Schaum\"ueller-Bichl}
\A {Ernst Piller}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {The paper presents a software protection system that prevents ``software piracy'' reliably while allowing to produce an unlimited number of program copies. Based on a combination of smart card technology and cryptographic techniques the system provides not only a high level of security, but also enhanced ease-of-use for the software manufacturer as well as for the user.}

\T {Minimum Disclosure Proofs of Knowledge (revised edition)}
\A {G. Brassard}
\A {D. Chaum}
\A {C. Cr\'epeau}
\J {Technical Report PM-R8710, Centre for Mathematics and Computer Science (CWI), Amsterdam, The Netherlands}
\D {1987}

\T {Minimum-Knowledge Interactive Proofs for Decision Problems}
\A {Zvi Galil}
\A {Stuart Haber}
\A {Moti Yung}
\J {Technical Report: CUCS-328-88, University of Columbia}
\D {1988}

\T {Minimum Resource Zero-Knowledge Proofs}
\A {Joe Kilian}
\A {Silvio Micali}
\A {Rafail Ostrovsky}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {This is only an extended abstract.}

\T {Modeling for Text Compression}
\A {Timothy Bell}
\A {Ian H. Witten}
\A {John G. Cleary}
\J {ACM Computing Surveys {\bf 21,} 4}
\D {1989}
\X {The best schemes for text compression use large models to help them predict
which characters will come next. The actual next characters are coded with
respect to the prediction, resulting in compression of information. Models are
best formed adaptively, based on the text seen so far. This paper surveys
successful strategies for adaptive modeling that are suitable for use in
practical text compression systems. The strategies fall into three main
classes: finite-context modeling, in which the last few characters are used to
condition the probability distribution for the next one; finite-state modeling,
in which the distribution is conditioned by the current state (and which
subsumes finite-context modeling as an important special case); and dictionary
modeling, in which strings of characters are replaced by pointers into an
evolving dictionary. A comparison of different methods on the same sample texts
is included, along with an analysis of future research directions.}

\T {Modeling of Encryption Techniques for Security and Privacy in Multi-user Networks}
\A {G. B. Agnew}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Modern Cryptology: A Tutorial}
\A {Gilles Brassard}
\J {Lecture Notes in Computer Science (325), Springer-Verlag}
\D {1988}
\X {Topics: Cryptology, secret key, DES, public key, RSA, hybrid systems, random number generation, digital signatures, coin flipping, user identification, authentication, bit commitment schemes, minimum disclosure proofs, privacy, quantum cryptography. Contains a good bibliography and a readable introduction.}

\T {Modes of Blockcipher Algorithms and Their Protection Against Active Eavesdropping}
\A {Cees J. A. Jansen}
\A {Dick E. Boekee}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {A Modification of a Broken Public-Key Cipher}
\A {John J. Cade}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A possible public-key cipher is described and its security against various cryptanalytic attacks is considered.}

\T {A Modification of the Fiat-Shamir Scheme}
\A {Kazuo Ohta}
\A {Tatsuaki Okamoto}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Fiat-Shamir's identification and signature scheme is efficient as well as provably secure, but it has a problem in that the transmitted information size and memory size cannot simultaneously be small. This paper proposes an identification and signature scheme which overcomes this problem. Our scheme is based on the difficulty of extracting the $L$-th roots mod $n$ (e.g., $L=2\sim10^{20}$) when the factors of $n$ are unknown. We define some variations of no transferable information and prove that the sequential version of our scheme is a zero knowledge interactive proof system and our parallel version satisfies these variations of no transferable information under some conditions. The speed of our scheme's typical implementation is at least one order of magnitude faster than that of the RSA scheme and is relatively slow in comparison with that of the Fiat-Shamir scheme.}

\T {A Modification of the RSA Public-Key Encryption Procedure}
\A {H. C. Williams}
\J {IEEE Trans. on Info Theory {\bf IT-26,} pp. 726--729}
\D {1980}
\X {The Rivest, Shamir, and Adleman (RSA) public-key encryption algorithm can be broken if the integer $R$ used as the modulus can be factored. It may however be possible to break this system without factoring $R.$ A modification of the RSA scheme is described. For this modified version it is shown that, if the encryption procedure can be broken in a certain number of operations, then $R$ can be factored in only a few more operations. Furthermore, this technique can also be used to produce digital signatures, in much the same manner as the RSA scheme.}

\T {Modified Id-Based Cryptosystem Using Discrete Logarithm Problem}
\A {C. S. Laih}
\A {J. Y. Lee}
\J {Elec. Letters {\bf 24,} 14, pp. 858--859}
\D {1988}

\T {Modified Lu-Lee Cryptosystem}
\A {B. S. Adiga}
\A {P. Shankar}
\J {Elec. Letters {\bf 21,} 18, pp. 794--795}
\D {1985}

\T {A Modular Approach to Key Safeguarding}
\A {Charles Asmuth}
\A {John Bloom}
\J {IEEE Trans. on Info. Th. {\bf IT-29,} 2}
\D {1983}
\X {A method is proposed for a key safeguarding scheme (threshold scheme) in which the shadows are congruence classes of a number associated with the original key. A variation of this scheme provides efficient error detection and even exposes deliberate tampering. Certain underlying similarities of this scheme with Shamir's interpolation method make it possible to incorporate these protective features in that method as well.}

\T {Modular Exponentiation Using Recursive Sums of Residues}
\A {P. A. Findlay}
\A {B. A. Johnson}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {This paper describes a method for computing a modular exponentiation, useful in performing the RSA Public Key algorithm, suitable for software or hardware implementation. The method uses conventional multiplication, followed by partial modular reduction based on sums of residues. We show that for a simple recursive system where the output of partial modular reduction is the input for the next multiplication, overflow presents few problems.}

\T {More Analysis of Double Hashing}
\A {George S. Lueker}
\A {Mariko Molodowitch}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {It has been shown that double hashing is equivalent to the ideal uniform hashing up to a load factor of about 0.319. In this paper we give an analysis which extends this to load factors arbitrarily close to 1. We understand that Ajtai, Guibas, Koml\'os, and Szemer\'edi obtained this result in the first part of 1986; the analysis in this paper is of interest nonetheless because we demonstrate how a resamplying technique can be used to obtain a remarkably simple proof.}

\T {More Efficient Match-Making and Satisfiability: The Five Card Trick}
\A {Bert den Boer}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {A two-party cryptographic protocol for evaluating any binary gate is presented. It is more efficient than previous two-party computations, and can even perform single-party (i.e. satisfiability) proofs more efficiently than known techniques. As in all earlier multiparty computations and satisfiability protocols, commitments are a fundamental building block. Each party in our approach encodes a single input bit as 2 bit commitments. There are then combined to form 5 bit commitments, which are permuted, and can then be opened to reveal the output of the gate.}

\T {More on Master Keys for Group Sharing}
\A {D. E. Denning}
\A {H. Meijer}
\A {F. B. Schneider}
\J {Info. Proc. Letters {\bf 13,} 3}
\D {1981}

\T {More on the Decoder Error Probability for Reed-Solomon Codes}
\A {Kar-Ming Cheung}
\J {IEEE Trans. on Info. Th. {\bf 35,} 4}
\D {1989}
\X {McEliece and Swanson offered an upper bound on $P_E(u),$ the decoder error probability for Reed-Solomon codes (more generally, linear maximum distance separable coders), given that $u$ symbol errors occur. Their upper bound is slightly greater than $Q,$ the probability that a completely random error pattern will cause a decoder error. We use a combinatorial technique similar to the principle of inclusion and exclusion to obtain an exact formula for $P_E(u).$ The $P_E(u)$'s for the (255,223) Reed-Solomon code used by NASA, and the (31,15) Reed-Solomon code (JTIDS code) are calculated using the exact formula and are observed to approach the $Q$'s of the codes rapidly as $u$ gets large. An upper bound for the expression $|(P_E(u)/Q)-1|$ is derived and subsequently shown to decrease nearly exponentially as $u$ increases.}

\T {Multiparty Computations Ensuring Privacy of Each Party's Input and Correctness of the Result}
\A {David Chaum}
\A {Ivan B. Damg{\aa}rd}
\A {Jeroen {van de Graaf}}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {A protocol is presented that allows a set of parties to collectively perform any agreed computation, where every party is able to choose secret inputs and verify that the resulting output is correct, and where all secret inputs are optimally protected. The protocol has the following properties. One participant is allowed to hide his secrets {\em unconditionally,} i.e. the protocol releases no Shannon information about these secrets. This means that a participant with bounded resources can perform computations securely with a participant who may have unlimited computing power. To the best of our knowledge, our protocol is the first of its kind to provide this possibility. The cost of our protocol is linear in the number of gates in a circuit performing the computations, and in the number of participants. We believe it is conceptually simpler and more efficient that other protocols solving related problems. It therefore leads to practical solutions of problems involving small circuits. The protocol is {\em openly verifiable,} i.e. any number of people can later come in and rechallenge any participant to verify that no cheating has occurred. The protocol is optimally secure against conspiracies: even if $n-1$ out of the $n$ participants collude, they will not find out more about the remaining participants' secrets than what they could already infer from their own input and the public output. Each participant has a chance of undetected cheating that is only exponentially small in the amount of time and space needed for the protocol. The protocol adapts easily, and with negligible extra cost, to various additional requirements, e.g. making part of the output private to some participant, ensuring that the participants learn the output simultaneously, etc. Participants can prove relations between data used in different instance of the protocol, even if those instances involve different groups of participants. For example, it can be proved that the output of one computation was used as input to another, without revealing more about this data. The protocol can be used as an essential tool in proving that all languages in IP have zero knowledge proof systems, i.e. any statement which can be proved interactively can also be proved in zero knowledge. The rest of this paper is organised as follows: First we survey some related results. Then Section 2 gives an intuitive introduction to the protocol. In Section 3, we present one of the main tools used in this paper: bit commitment schemes. Sections 4 and 5 contain the notation, terminology, etc. used in the paper. In Section 6, the protocol is presented, along with proofs of its security and correctness. In Section 7, we show how to adapt the protocol to various extra requirements and discuss some generalisations and optimisations. Finally, Section 8 contains some remarks on how to construct zero knowledge proof systems for any language in IP.}

\T {Multiparty Computation with Faulty Majority}
\A {Donald Beaver}
\A {Shafi Goldwasser}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We address the problem of performing a multiparty computation when more than half of the processor are cooperating Byzantine faults. We show how to compute any boolean function of $n$ inputs distributively, preserving the privacy of inputs held by nonfaulty processors, and ensuring that faulty processors obtain the function value ``if and only iff'' the nonfaulty processors do. If the nonfaulty processors do not obtain the correct function values, they detect cheating with high probability. Our solution is based on a new type of verifiable secret sharing in which the secret is revealed not all at once but in small increments. This slow-revealing process ensures that all processors discover the secret at roughly the same time. Our solution assumes the existence of an oblivious transfer protocol and uses broadcast channels. We do not require that the processors have equal computing power.}

\T {Multiparty Protocols and Logspace-hard Pseudorandom Sequences}
\A {L\'aszl\'o Babai}
\A {Noam Nisan}
\A {Mario Szegedy}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {Let $f(x_1,\ldots,x_k)$ be a Boolean function that $k$ parties wish to collaboratively evaluate. The $i$'th party knows each input argument except $x_i;$ and each party has unlimited computational power. They share a blackboard, viewed by all parties, where they can exchange messages. The objective is to minimize the numbers of bits written on the board. We prove lower bounds of the form $\Omega(n\cdot c^{-k}),$ for the number of bits that need to be exchanged in order to compute some (explicitly given) functions in P. Our bounds hold even if the parties only wish to have a 1\% advantage at guessing the value of $f$ on random inputs. We then give several applications of our lower bounds. Our first application is a pseudorandom generator for Logspace. We explicitly construct (in polynomial time) pseudorandom sequences of length $n$ from a random seed of length $\exp(c\sqrt{\log n})$ that no Logspace Turing machine will be able to distinguish from truly random sequences. As a corollary we give an explicit construction of universal traversal sequence of length $\exp(\exp(c\sqrt{\log n}))$ for arbitrary undirected graphs on $n$ vertices. We then apply the multiparty protocol lower bounds to derive several new time-space tradeoffs. We give a tight time-space tradeoff of the form $TS=\Theta(n^2),$ for general, $k$-head Turing-Machines; the bounds hold for a function that can be computed in linear time and constance space by a $k+1$-head Turing Machine. We also give a new length-width tradeoff for oblivious branching programs; in particular our bound implies new lower bounds on the size of arbitrary branching programs, or on the size of boolean formulas (over an arbitrary finite base).}

\T {Multiparty Protocols Tolerating Half Faulty Processors}
\A {Donald Beaver}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We show that a complete broadcast network of $n$ processors can evaluate any function $f(x_1,\ldots,x_n)$ at private inputs supplied by each processor, revealing no information other than the result of the function, while tolerating up to $t$ maliciously faulty parties for $2t<n.$ This improves the previous bound of $3t<n$ on the tolerable number of faults. We demonstrate a resilient method to multiply secretly shared values without using unproven cryptographic assumptions. The crux of our method is a new, non-cryptographic zero-knowledge technique which extends verifiable secret sharing to allow proofs based on secretly shared values. Under this method, a single party can secretly share values $v_1,\ldots,v_m$ along with another secret $w=P(v_1,\ldots,v_m),$ where $P$ is any polynomial size circuit; and she can prove to all other parties that $w=P(v_1,\ldots,v_m),$ without revealing $w$ or any other information. Our protocols allow an exponentially small chance of error, but are provably optimal in their resilience against Byzantine faults. Furthermore, our solutions use operations over exponentially large fields, greatly reducing the amount of interaction necessary for computing natural functions.}

\T {Multiparty Unconditionally Secure Protocols}
\A {David Chaum}
\A {Claude Cr\'epeau}
\A {Ivan Damg{\aa}rd}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Under the assumption that each pair of participants can communicate secretly, we show that any reasonable multiparty protocol can be achieved if at least $2n\over3$ of the participants are honest. The secrecy achieved is unconditional. It does not rely on any assumption about computational intractability.}

\T {The Multiple Polynomial Quadratic Sieve}
\A {R. D. Silverman}
\J {Math. Comp. {\bf 48,} pp. 329--339}
\D {1987}

\T {Multiplexed Sequences: Some Properties of the Minimum Polynomial}
\A {S. M. Jennings}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Multi-Prover Interactive Proofs: How to Remove Intractability Assumptions}
\A {Michael Ben-Or}
\A {Shafi Goldwasser}
\A {Joe Kilian}
\A {Avi Wigderson}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Quite complex cryptographic machinery has been developed based on the assumption that one-way functions exist, yet we know of only a few possible such candidates. It is important at this time to find alternative foundations to the design of secure cryptography. We introduce a new model of generalized interactive proofs as a step in this direction. We prove that all $NP$ languages have perfect zero-knowledge proof-systems in this model, without making any intractability assumptions. The generalized interactive-proof model consists of two computationally unbounded and untrusted provers, rather than one, who jointly agree on a strategy to convince the verifier of the truth of an assertion and then engage in a polynomial number of message exchanges with the verifier in their attempt to do so. To believe the validity of the assertion, the verifier must make sure that the two provers can not communicate with each other during the course of the proof process. Thus, the complexity assumptions made in previous work, have been traded for a physical separation between the two provers. We call this new model the multi-prover interactive-proof model, and examine its properties and applicability to cryptography.}

\T {A Natural Taxonomy for Digital Information Authentication Schemes}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Network Security and Vulnerability}
\A {J. Michael Nye}
\J {AFIPS Conference Proc. 52, National Computer Conference}
\D {1983}
\X {Technology-based society demands efficient and reliable communication
networks. The introduction of microwave communication links has significantly
increased the vulnerability of voice and data communications to electronic
interception. With the wide acceptance of automated office systems and the
increasing use of communicating word processors and distributed data terminals,
proprietary, sensitive, and personal-privacy information can easily be
intercepted through passive eavesdropping with relatively inexpensive equipment
and limited technical resources. This session will provide an in-depth look at
the problem and will review a variety of techniques for protecting facsimile,
data, and voice communication.}

\T {Networks Without User Observability---Design Options}
\A {Andrea Pfitzmann}
\A {Michael Waidner}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {In usual communication networks, the network operator or an intruder could easily observe when, how much and with whom the users communicate (traffic analysis), even if the users employ end-to-end encryption. When ISDNs are used for almost everything, this becomes a severe threat. Therefore, we summarize basic concepts to keep the recipient and sender or at least their relationship unobservable, consider some possible implementations and necessary hierarchical extensions, and propose some suitable performance and reliability enhancements.}

\T {A New Algorithm for the Solution of the Knapsack Problem}
\A {Ingemar Ingemarsson}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {A new algorithm for the solution of the knapsack problem is described. The algorithm is based upon successive reductions modulo suitably chosen integers. Thus the original knapsack problem is transformed into a system of modified knapsack problems. Very often a partial solution to the system can be found. The system and the original knapsack can then be reduced to a lower dimensionality and the algorithm repeated. So far we have not been able to characterize the class of knapsack problems for which the algorithm is effective. There are indications, however, that most knapsack problems for which we know that there is one and only one solution may be solved fast by the use of the new algorithm.}

\T {New Algorithms for Finding Irreducible Polynomials over Finite Fields}
\A {Victor Shoup}
\J {Computer Science Technical Report TR 763, University of Wisconsin}
\D {1988}
\X {Let $p$ be a prime number, $F$ be the finite field with 
$p$ elements, and $n$ be a positive integer.  We present new algorithms
for finding irreducible polynomials in $F(X)$ of degree $n$.  We show
that in time polynomial in $n$ and log $p$ we can reduce the problem of
finding an irreducible polynomial over $F$ of degree $n$ to the problem
of factoring polynomials over $F$.  Combining this with Berlekamp's 
deterministic factoring algorithm, we obtain a deterministic algorithm for 
finding irreducible polynomials that runs in time polynomial in $n$ and
$p$.  This is useful when $p$ is small.  Unlike earlier results in
this area, ours does not rely on any unproven hypotheses, such as the Extended
Riemann Hypothesis.  We also present a new randomized algorithm for finding
irreducible polynomials that runs in time polynomial in $n$ and log $p$
and makes particularly efficient use of randomness.  It uses $n\log p$ 
random bits, and fails with probability less than $1/(p^\alpha n)$ where
$\alpha$ is a constant between 0 and 1/4.  This result is interesting in a setting where random bits are viewed as a scarce resource.}

\T {A New Approach to Protecting Secrecy is Discovered}
\A {J. Gleik}
\J {New York Times, 17~February, p. C1}
\D {1987}

\T {A New Class of Nonlinear Functions for Running-key Generators}
\A {Shu Tezuka}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {A systematic approach to the design of running-key generators in stream cipher systems is proposed using a new class of nonlinear functions based on integer arithmetic operations. This approach is applicable to both feedforward- and feedback-types running-key generators. Most practical nonlinear functions that use only one addition and one multiplication are fully analyzed. Cryptographic properties, such as 0-1 balance, linear complexity, and correlation, of the key-sequence generated by this scheme are examined and several important criteria for determining the parameters of such generators are derived. This approach will prove valuable in designing running-key generators.}

\T {New Codes Coming Into Use}
\A {G. B. Kolata}
\J {Science Magazine {\bf 208,} p. 694}
\D {1980}

\T {New Hash Functions and Their Use in Authentication and Set Equality}
\A {Mark N. Wegman}
\A {J. Lawrence Carter}
\J {J. of Computer and System Sciences, {\bf 22.}}
\D {1981}
\X {In this paper we exhibit several new classes of hash functions with certain desirable properties, and introduce two novel applications for hashing which make use of these functions. One class contains a small number of functions, yet is almost universal$_2$. If the functions hash $n$-bit long names into $m$-bit indices, then specifying a member of the class requires only $O((m+\log_2\log_2(n))\cdot\log_2(n))$ bits as compared to $O(n)$ bits for earlier techniques. For long names, this is about a factor of $m$ larger than the lower bound of $m+\log_2n-\log_2m$ bits. An application of this class is a provably secure authentication technique for sending messages over insecure lines. A second class of functions satisfies a much stronger property than universal$_2$. We present the application of testing sets for equality. The authentication technique allows the receiver to be certain that a message is genuine. An ``enemy''---even one with infinite computer resources---cannot forge or modify a message without detection. The set equality technique allows operations including ``add member to set,'' ``delete member from set'' and ``test two sets for equality'' to be performed in expected constant time and with less than a specified probability of error.}

\T {A New Multiple Key Cipher and an Improved Voting Scheme}
\A {Colin Boyd}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {New Paradigms for Digital Signatures and Message Authentication Based on Non-Interactive Zero Knowledge Proofs}
\A {Mihir Bellare}
\A {Shafi Goldwasser}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Using non-interactive zero knowledge proofs we provide a simple new paradigm for digital signing and message authentication secure against adaptive chosen message attack. For digital signatures we require that the non-interactive zero knowledge proofs be {\em quickly verifiable:\/} they should be checkable by anyone rather than directed at a particular verifier. We accordingly show how to implement non-interactive zero knowledge proofs in a network which have the property that anyone in the network can individually check correctness while the proof is zero knowledge to any sufficiently small coalition. This enables us to implement signatures which are history independent.}

\T {A New Probabilistic Encryption Scheme}
\A {He Jingmin}
\A {Lu Kaicheng}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {In this paper we present a new probabilistic public key cryptosystem. The system is polynomially secure. Furthermore, it is highly efficient in that it's message expansion is $l+(k-1)/l,$ where $k$ is the security parameter and $l$ the length of the encrypted message. Finally, the system can be used to sign signatures.}

\T {New Pseudorandom Natural Code Conversion Method}
\A {E. M. Petriu}
\J {Elec. Letters {\bf 24,} 22, pp. 1358--1359}
\D {1988}

\T {New Trapdoor Knapsack Public Key Cryptosystem}
\A {R. M. F. Goodman}
\A {A. J. McAuley}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {This paper presents a new trapdoor-knapsack public-key cryptosystem. The encryption equation is based on the general modular knapsack equation, but unlike the Merkle-Hellman scheme the knapsack components do not have to have a superincreasing structure. The trapdoor is based on transformations between the modular and radix form of the knapsack components, via the Chinese Remainder Theorem. The resulting cryptosystem has a high density and has a typical message block size of 2000 bits and a public key of 14K bits. The security is based on factoring a number composed of 256 bit prime factors. The major advantage of the scheme when compared with the RSA scheme is one of speed. Typically, knapsack schemes such as the one proposed here are capable of throughput speeds which are orders of magnitude faster than the RSA scheme.}

\T {No Harm Done}
\A {Peter Rivetts}
\J {Amiga Computing, December}
\D {1989}
\X {What is the truth behind software theft.}

\T {The Noisy Oracle Problem}
\A {U. Feige}
\A {A. Shamir}
\A {M. Tennenholtz}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {We describe a model in which a computationally bounded verifier consults with a computationally unbounded oracle, in the presence of malicious faults on the communication lines. We require a fairness condition which in essence says that some of the oracle's messages arrive uncorrupted. We show that a deterministic polynomial time verifier can test membership in any language in P-space, but cannot test membership in languages not in P-space, even if he is allowed to toss random coins in private. We discuss the zero knowledge aspects of our model, and demonstrate zero knowledge tests of membership for any language in P-space.}

\T {Non-Expanding, Key-Minimal, Robustly-Perfect, Linear and Bilinear Ciphers}
\A {James L. Massey}
\A {Ueli Maurer}
\A {Muzhong Wang}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Non-Interactive Oblivious Transfer and Applications}
\A {Mihir Bellare}
\A {Silvio Micali}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We show how to implement oblivious transfer without interaction, through the medium of a public file. As an application we can get non-interactive zero knowledge proofs via the same public file.}

\T {Non-Interactive Zero-Knowledge and Its Applications}
\A {Manuel Blum}
\A {Paul Feldman}
\A {Silvio Micali}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {We show that interaction in {\em any\/} zero-knowledge proof can be replaced by sharing a common, short, random string. We use this result to construct the {\em first\/} public-key cryptosystem secure against chosen ciphertext attack.}

\T {Non-Interactive Zero-Knowledge Proof Systems}
\A {Alfredo {de Santis}}
\A {Silvio Micali}
\A {Giuseppe Persiano}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {The intriguing notion of a Zero Knowledge Proof System has been introduced by Goldwasser, Micali and Rackoff and its wide applicability has been demonstrated by Goldreich, Micali and Wigderson. Based on complexity theoretic assumptions, Zero-Knowledge Proof Systems exists, provided that (i) The prover and the verifier are allowed to talk back and forth. (ii) The verifier is allowed to flip coins whose result the prover cannot see. Blum, Feldman and Micali have recently shown that, based on specific complexity theoretic assumption (the computational difficulty of distinguishing products of two primes from those product of three primes), both the requirements (i) and (ii) above are not necessary to the existence of Zero-Knowledge Proof Systems. Instead of (i), it is enough for the prover only to talk and for the verifier only to listen. Instead of (ii), it is enough that both the prover and verifier share a randomly selected string. We strengthen their result by showing  that Non-Interactive Zero-Knowledge Proof Systems exist based on the weaker and well-known assumption that quadratic residuosity is hard.}

\T {Non-Interactive Zero-Knowledge with Preprocessing}
\A {Alfredo {de Santis}}
\A {Silvio Micali}
\A {Giuseppe Persiano}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Non-Interactive Zero-Knowledge Proof Systems have been proven to exist under a specific complexity assumption; namely, under the Quadratic Residuosity Assumption which gives rise to a specific secure probabilistic encryption scheme. In this paper we prove that the existence of {\em any\/} secure probabilistic encryption scheme, actually any {\em one-way encryption scheme,} is enough got Non-Interactive Zero-Knowledge in a modified model. That is, we show that the ability to prove a randomly chosen theorem allows to subsequently prove non-interactively and in Zero-Knowledge any smaller size theorem whose proof is discovered.}

\T {A Nonlinear Congruential Pseudorandom Number Generator with Power of 2 Modulus}
\A {J. Eichenauer}
\A {A. Topuzoglu}
\A {J. Lehn}
\J {Mathematics of Computation {\bf 51,} 184, pp. 757==759}
\D {1988}

\T {Nonlinearity Criteria for Cryptographic Functions}
\A {Willi Meier}
\A {Othmar Staffelbach}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Nonlinearity criteria for Boolean functions are classified in view of their suitability for cryptographic design. The classification is set up in terms of the largest transformation group leaving a criterion invariant. In this respect two criteria turn out to be of special interest, the distance to linear structures and the distance to affine transformations, which are shown to be invariant under all affine transformations. With regard to these criteria an optimum class of functions is considered. These functions simultaneously have maximum distance to affine functions and maximum distance to linear structures, as well as minimum correlation to affine functions. The functions with these properties are proved to coincide with certain functions known in combinatorial theory, where they are called bent functions. They are shown to have practical applications for block ciphers as well as stream ciphers. In particular they give rise to a new solution of the correlation problem.}

\T {Non-linearity of Exponent Permutations}
\A {Josef P. Pieprzyk}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {The paper deals with an examination of exponent permutations with respect to their non-linearity. The first part gives the necessary background to be able to determine permutation non-linearity. The second examines the interrelation between non-linearity and Walsh transform. The next part summarizes results gathered while experimenting with different binary fields. In the last part of the work, we discuss the results obtained and questions which are still open.}

\T {Non Linear Non Commutative Functions For Data Integrity}
\A {S. Harari}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {A Nonlinear Public Key Cryptosystem}
\A {W. A. Webb}
\J {Computers \& Maths. with Applications {\bf 26,} 3, pp. 229--232}
\D {1988}

\T {Non-Oblivious Hashing}
\A {Amos Fiat}
\A {Moni Naor}
\A {Jeanette P. Schmidt}
\A {Alan Siegel}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Non-oblivious hashing, where the information gathered by performing ``unsuccessful'' probes determines the probe strategy, is introduced and used to obtain the following results for static lookup on full tables: a. An $O(1)$ worst case scheme that requires only logarithmic additional memory (improving previous linear space upper bounds). b. An almost sure $O(1)$ probabilistic worst case scheme, without any additional memory (improving on previous logarithmic time upper bounds). c. Enhancements to hashing: Solving (a) and (b) in the multikey record environment, search can be performed under any key in time $O(1);$ finding the nearest neighbor, the rank, etc. in logarithmic time. Our non-oblivious upper bounds are much better than the appropriate oblivious lower bounds.}

\T {Non-transitive Transfer of Confidence: A {\em Perfect\/} Zero-Knowledge Interactive Protocol for SAT and Beyond}
\A {G. Brassard}
\A {C. Cr\'epeau}
\J {Proc. of the 27th IEEE Symp. on Foundations of Comp. Sc., pp. 188--195}
\D {1986}

\T {A Note On ``A Cryptosystem for Multiple Communication''}
\A {H. Meijer}
\J {Info. Proc. Letters {\bf 12,} 4}
\D {1981}

\T {A Note On `Master Keys for Group Sharing'}
\A {A. E. Brouwer}
\A {P. van Emde Boas}
\J {Info. Proc. Letters {\bf 14,} 1}
\D {1982}

\T {A Note On Sequences Generated By Clock Controlled Shift Registers}
\A {Bernard Smeets}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {In this paper the linear feedback shift registers are determined that can generate the output sequence of two types of clock controlled shift registers suggested by P.~Nyffeler. For one type of clock control sufficient conditions are given which guarantee that maximum linear complexity is obtained. Furthermore, it is shown that the randomness properties for sequences of maximal linear complexity depend on clocking procedure.}

\T {A Note on Square Roots in Finite Fields}
\A {Eric Bach}
\J {Computer Science Technical Report TR 795, University of Wisconsin}
\D {1988}
\X {A simple method is presented whereby the quadratic character in a finite field of odd order $q$ can be computed in $O(\log q)^2$ steps.  It is also shown how sequences generated deterministically from a random seed can be used reliably in a recent randomized algorithm of Peralkta for computing square roots in finite fields.}

\T {Notes sur la cryptographie et la s\'ecurit\'e}
\A {J.-J. Quisquater}
\A {Y. Delvaux}
\J {Rapport, Philips Research Laboratory, Bruxelles, Belgium}
\D {1988}

\T {The Notion of Security for Probabilistic Cryptosystems}
\A {Silvio Micali}
\A {Charles Rackoff}
\A {Bob Sloan}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
and,
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag (extended abstract only)}
\D {1987}
\X {Three very different formal definitions of security for public-key cryptosystems have been proposed---two by Goldwasser and Micali and one by Yao. We prove all of them to be equivalent. This equivalence provides evidence that the right formalization of the notion of security has been reached.}

\T {Novel Security Techniques for On-Line Systems}
\A {Richard Botting}
\J {C ACM {\bf 29,} 5}
\D {1986}
\X {With an on-line system as a collection of subsystems (zones) having
different facilities and security levels, log-in procedures can be designed to
do more than just delay illicit access.}

\T {Number-Theoretic Algorithms}
\A {Eric Bach}
\J {Computer Science Technical Report TR 844, University of Wisconsin}
\D {1989}
\X {This paper is a report on algorithms to solve problems in number theory.  I believe the most interesting such problems to be those from elementary number theory whose complexity is still unknown.  For this reason, I shall concentrate on methods to test primality, to find the prime factors of numbers, and to solve equations in various finite groups, rings, and fields.  These problems have the attractive feature that they are easily stated, and frequently can be solved by algorithms that are easy to implement.  However, the intuition behind these algorithms and the methods used to analyze them are often anything but
elementary; for this reason I describe not only the algorithms but also the underlying mathematics.}

\T {An Observation on the Security of McEliece's Public-Key Cryptosystem}
\A {P. J. Lee}
\A {E. F. Brickell}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {The best known cryptanalytic attack on McEliece's public-key cryptosystem based on algebraic coding theory is to repeatedly select $k$ bits at random from an $n$-bit ciphertext vector, which is corrupted by at most $t$ errors, in hope that none of the selected $k$ bits are in error until the cryptanalyst recovers the correct message. The method of determining whether the recovered message is the correct one has not been throughly investigated. In this paper, we suggest a systematic method of checking, and describe a generalized version of the cryptanalytic attack which reduces the work factor significantly (factor of $2^{11}$ for the commonly used example of $n=1024$ Goppa code case). Some more improvements are also given. We also note that these cryptanalytic algorithms can be viewed as generalized probabilistic decoding algorithms for any linear error correcting codes.}

\T {An $O(n)$ Algorithm for the Linear Multiple Choice Knapsack Problem and
Related Problems}
\A {E. Zemel}
\J {Info. Proc. Letters {\bf 18,} 3}
\D {1984}
\X {We present an $O(n)$ algorithm for the Linear Multiple Choice Knapsack
Problem and its $d$-dimensional generalization which is based on Megiddo's
algorithms for linear programming. We also consider a certain type of convex
programming problems which are common in geometric location models. An
application of the linear case is an $O(n)$ algorithm for finding a least
distance hyperplane in $\R^d$ according to the rectilinear norm. The best
previosuly available algorithm for this problem was an $O(n\log^2 n)$ algorithm
for the two-dimensional case. A simple application of the nonlinear case is an
$O(n)$ algorithm for finding the point at which a `pursuer' minimizes its
distance from the furthest amongst $n$ `targets', when the trajectories
involved are straight lines in $\R^d.$}

\T {On a Problem of Oppenheim Concerning `Factorisatio Numerorum'}
\A {E. R. Canfield}
\A {P. Erd\"os}
\A {C. Pomerance}
\J {J. Number Theory {\bf 17,} pp. 1--28}
\D {1983}

\T {On Breaking Generalized Knapsack Public Key Cryptosystems}
\A {Leonard M. Adleman}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}

\T {On Concurrent Identification Protocols}
\A {Oded Goldreich}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {We consider communication networks in which it is not possible to identify the source of a message which is broadcasted through the network. A natural question is whether it is possible for two users to identify each other concurrently, through a secure two-party protocol. We show that more than the existence of a secure Public Key Cryptosystem should be assumed in order to present a secure protocol for concurrent identification. We present two concurrent identification protocols: The first one relies on the existence of a center who has distributed ``identification tags'' to the the users; while the second protocol relies on the distribution of ``experimental sequences'' by instances of a pre-protocol which have taken place between every two users.}

\T {On Computationally Secure Authentication Tags Requiring Short Secret Shared Keys}
\A {G. Brassard}
\J {Advances in Cryptology---CRYPTO '82, Plenum Press, pp. 79--86}
\D {1983}

\T {On Computing Logarithms Over Finite Fields}
\A {Taher ElGamal}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {The problem of computing logarithms over finite fields has proved to be of interest in different fields. Subexponential time algorithms for computing logarithms over the special cases $GF(p), GF(p^2)$ and $GF(p^m)$ for a fixed $p$ and $m\rightarrow\infty$ have been obtained. In this paper, we present some results for obtaining a subexponential time algorithms for the remaining cases $GF(p^m)$ for $p\rightarrow\infty$ and fixed $m\ne1,2.$ The algorithm depends on mapping the field $GF(p^m)$ into a suitable cyclotomic extension of the integers (or rationals). Once an isomorphism between $GF(p^m)$ and a subset of the cyclotomic field $Q(\omega_q)$ is obtained, the algorithms becomes similar to the previous algorithms for $m=1,2.$ A rigorous proof for subexponential time is not yet available, but using some heuristic arguments we can show how it could be proved. If a proof would be obtained, it would use results on the distribution of certain classes of integers and results on the distribution of some ideal classes in cyclotomic fields.}

\T {On Cryptosystems Based On Polynomials And Finite Fields}
\A {R. Lidl}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {In many single-key, symmetric or conventional cryptosystems the elements of a finite field can be regarded as the characters of a plaintext and ciphertext alphabet. Some properties of polynomials or polynomial functions on finite fields can be used for constructing cryptosystems. This note demonstrates by way of examples that great care has to be taken in choosing polynomials for enciphering and deciphering. Often complex looking polynomial functions induce very simple permutations of the elements of a finite field and therefore are not suitable for the construction of cryptosystems. Also an indication is given of some further areas of research in algebraic cryptography.}

\T {On Different Modes of Communication}
\A {Bernd Halstenberg}
\A {R\"udiger Reischuk}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {We compare the communication complexity of discrete functions under different modes of computation, unifying and extending several known models. Protocols can be deterministic or probabilistic and in the last case the error probability may vary. On the other hand communication can be 1-way, 2-way or as an intermediate stage consist of a fixed number $k>1$ of rounds. The following main results are obtained. A square gap between deterministic and nondeterministic communication complexity is shown for a specific function, which is the maximal possible. For probabilistic 1- and 2-way protocols we prove linear lower bounds for functions that satisfy certain independence conditions. Further, with more technical effort an exponential gap between deterministic $k$-round and probabilistic $(k-1)$-round communication with fixed error probability is obtained. On contrast for arbitrary error probabilities less than $1/2$ there is no difference between the complexity of 1- and 2-way protocols. Finally we consider communication with fixed message length and uniform probability distributions and give simulations of arbitrary protocols by such uniform ones with little overhead.}

\T {On Distinguishing Prime Numbers from Composite Numbers}
\A {L. M. Adleman}
\A {C. Pomerance}
\A {R. S. Rumley}
\J {Annals of Mathematics {\bf 117,} 1, pp. 173--206}
\D {1983}

\T {One-Time Pads Are Key Safeguarding Schemes, Not Cryptosystems. Fast Key Safeguarding Schemes (Threshold Schemes) Exist}
\A {G. R. Blakley}
\J {Proc. of the 1980 Symp. on Security and Privacy, IEEE Comp. Sc., pp.~108--113}
\D {1980}

\T {One-Way Functions and Pseudorandom Generators}
\A {Leonid A. Levin}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}
\X {One-way are those functions which are easy to compute, but hard to invert on a non-negligible fraction of instances. The existence of such functions with some additional assumptions was shown to be sufficient for generating perfect pseudorandom strings. Below, among a few other observations, a weaker assumption about one-way functions is suggested, which is not only sufficient, but also necessary for the existence of pseudorandom generators. The main theorem can be understood without reading the sections 3--6.}

\T {One Way Hash Functions and DES}
\A {Ralph C. Merkle}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {One way hash functions are a major tool in cryptography. DES is the best known and most widely used encryption function in the commercial world today. Generating a one-way hash function which is secure if DES is a ``good'' block cipher would therefore be useful. We show three such functions which are secure if DES is a good random block cipher.}

\T {One-Way Permutations in NC$^0$}
\A {J. Hastad}
\J {Info. Proc. Letters {\bf 26,} 3}
\D {1987}
\X {We prove that there is a family of permutations which are computable by a
family of NC$^0$ circuits while their inverse are P-hard to compute. Thus,
these permutations are one-way from the point of view of parallel computation.}

\T {On Feedforward Transforms and $p$-Fold Periodic $p$-Arrays}
\A {Dong-sheng Chen}
\A {Zong-duo Dai}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {In this paper we discuss non-linear feedforward transforms of arbitrary non-singular linear shift register sequences. The approach is to give an algebraic representation of $p$-array modules together with description of the structure of such modules. On the basis of this, an algebraic description of the non-linear transform is given.}

\T {On Foiling Computer Crime}
\A {Robert Sugarman}
\J {IEEE Spectrum, July}
\D {1979}
\X {Can a thief with lots of LSI chips crack present data scrambling schemes? The experts debate the matter.}

\T {On Functions of Linear Shift Register Sequences}
\A {Tore Herlestam}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {This paper is intended as an overview, presenting several results on the linear complexity of sequences obtained from functions applied to linear shift registers. Especially for cryptologic applications it is of course highly desirable that the linear complexity by as large as possible, and not only to get a huge period. The theory reviewed in this paper contains several criteria on how to achieve such goals.}

\T {On Generating Solved Instance of Computational Problems}
\A {Martin Abadi}
\A {Eric Allender}
\A {Andrei Broder}
\A {Joan Feigenbaum}
\A {Lane A. Hemachandra}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {We consider the efficient generation of solved instance of computational problems. In particular, we consider {\em invulnerable generators.} Let $S$ be a subset of $\{0,1\}^*$ and $M$ be a Turing Machine that accepts $S;$ an accepting computation $w$ of $M$ on input $x$ is called a ``witness'' that $x\in S.$ Informally, a program is an $\alpha$-{\em invulnerable generator\/} if, on input $1^n,$ it produces instance-witness pairs $\langle x,w\rangle,$ with $|x|=n,$ according to a distribution under which any polynomial-time adversary who is given $x$ fails to find a witness that $x\in S,$ with probability at least $\alpha,$ for finitely many lengths $n.$ The question of which sets have invulnerable generators is intrinsically appealing theoretically, and the results can be applied to the generation of test data for heuristic algorithms and to the theory of zero-knowledge proof systems. The existence of invulnerable generators is closely related to the existence of cryptographically secure one-way functions. We prove three theorems about invulnerability. The first addresses the question of which sets in NP have invulnerable generators, if indeed any NP sets do. The second addresses the question of how invulnerable these generators are. {\bf Theorem (Completeness):} If any set in NP has an $\alpha$-invulnerable generator, then SAT has one. {\bf Theorem (Amplification):} If $S\in$NP has a $\beta$-invulnerable generator, for some constant $\beta\in(0,1),$ then $S$ has an $\alpha$-invulnerable generator, for every constant $\alpha\in(0,1).$ Our third theorem on invulnerability shows that one cannot, using techniques that relativize, resolve the question of whether the assumption P$\ne$NP alone suffices to prove the existence of invulnerable generators. Clearly there are relativized worlds in which invulnerable generators exist; in all of these worlds, P$\ne$NP. The more subtle question, which we resolve in our third theorem, is whether there are also relativized worlds in which P$\ne$NP and invulnerability generators do exist. {\bf Theorem (Relativization):} There is an oracle relative to which P$\ne$NP but there are no invulnerable generators.}

\T {On Hardness of One-Way Functions}
\A {O. Watanabe}
\J {Info. Proc. Letters {\bf 27,} 3}
\D {1988}
\X {We investigate hardness of one-way functions (i.e., difficulty of computing
inverse of one-way functions). Here, the notion of polynomial lowness is used
to measure the difficulty of a given problem. We show that, for any one-way
function $f,$ the hardness of $f$ is similar to the complexity of $dom(f)$ and
$rang(f).$}

\T {On Hiding Information from an Oracle}
\A {Mart\'\i n Abadi}
\A {Joan Feigenbaum}
\A {Joe Kilian}
\J {Journal of Computer and System Sciences, {\bf 39,} pp. 21--50}
\D {1989}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {We consider the problem of {\em computing with encrypted data.} Player~A wishes to know the value $f(x)$ for some $x$ back lacks the power to compute it. Player~B has the power to compute $f$ and is willing to send $f(y)$ to A if she sends him $y,$ for any $y.$ Informally, an {\em encryption scheme\/} for the problem $f$ is a method by which A, using her inferior resources, can transform the {\em cleartext instance\/} $x$ into an {\em encrypted instance\/} $y,$ obtain $f(y)$ from B, and infer $f(x)$ from $f(y)$ in such a way that B cannot infer $x$ from $y.$ When such an encryption scheme exists, we say that $f$ is {\em encryptable.} The framework defined in this paper enables us to prove precise statements about what an encrypted instance hides and what it leaks, in an information-theoretic sense. Our definitions are cast in the language of probability theory and do not involve assumptions such as the intractability of factoring or the existence of one-way functions. We use our framework to describe encryption schemes for some well-known functions. We also consider the following generalization of encryption schemes. Player~A, who is limited to probabilistic polynomial time, wishes to guess the value $f(x)$ which probability at least ${1\over2} + 1/|x|^c$ of being correct, for some constant $c.$ Player~B can compute any function and generate arbitrary probability distributions. Players A and B can interact for a polynomial number of rounds by sending polynomial-sized messages. We prove a strong negative result: there is no such generalized encryption scheme for SAT that leaks at most $|x|$ (unless the polynomial hierarchy collapses at the third level).}

\T {On Key Distribution Systems}
\A {Y. Yacobi}
\A {Z. Shmuely}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Zero Knowledge (ZK) theory formed the basis for practical identification and signature cryptosystems (invented by Fiat and Shamir). It also was used to construct a key distribution scheme (invented by Bauspiess and Knobloch); however, it seems that the ZK concept is less appropriate for key distribution systems (KDS), where the main cost is the number of communications. We propose relaxed criteria for the security of KDS, which we assert are sufficient, and present a system which meets most of the criteria. Our system is not ZK (it leaks few bits), but in return it is very simple. It is a Diffie-Hellman variation. Its security is equivalent to RSA, but it runs faster. Our definition for the security of KDS is based on a new definition of security for one-way functions recently proposed by Goldreich and Levin. For a given system and given cracking-algorithm, $I,$ the cracking rate is roughly the average of the inverse of the running-time over all instances (if on some instance it fails, the inverse is zero). If there exists a functions $s:N\rightarrow N,$ s.t. for all $I,$ the cracking-rate for security parameter $n$ is $O(1)/s(n),$ then we say that the system has at least security $s.$ We use this concept to define the security of KDS for malicious adversary (the passive adversary is a special case). Our definition of a malicious adversary is relatively restricted, but we assert it is general enough for KDS. This restriction enables the proof of security results for simple and practical systems. We further modify the definition to allow past keys and their protocol messages in the input data to a cracking algorithm. The resulting usage of KDS, where the keys are often used with cryptosystems of moderate strength. We demonstrate, the above properties on some Diffie-Hellman KDS variants which also authenticate the parties. In particular, we give evidence that one of the variants has super-polynomial security against any malicious adversary, assuming RSA modulus is hard to factor. We also give evidence that is amortized security is super-polynomial. (The original DH scheme does not authenticate, and the version with public directory has a fixed key, i.e. zero amortized security.)}

\T {Online Cash Checks}
\A {David Chaum}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {On-line/Off-line Digital Signatures}
\A {Shimon Even}
\A {Oded Goldreich}
\A {Silvio Micali}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We introduce and exemplify the new concept of ON-LINE/OFF-LINE digital signature schemes. In these schemes the signing of a message is broken into two phases. The first phase is {\em off-line.} Though it requires a moderate amount of computation, it presents the advantage that it can be performed leisurely, before the message to be signed is even known. The second phase is {\em on-line.} It starts after the message becomes known, it utilizes the precomputation of the first phase and is much faster. A general construction which transforms {\em any\/} (ordinary) digital signature scheme to an on-line/off-line signature scheme is presented, entailing a small overhead. For each message to be signed, the time required for the off-line phase is essentially the same as in the underlying signature scheme; the time required for the on-line phase is essentially negligible. The time required for the verification is essentially the same as the underlying signature scheme. In a practical implementation of our general construction, we use a variant of Rabin's signature scheme (based on factoring) and DES. In the on-line phase, all we use is a moderate amount of DES computation. This implementation is ideally suited for electronic wallets or smart cards. On-line/Off-line digital schemes may also become useful in case substantial progress is made on, say, factoring. In this case, the length of the composite numbers used in signature schemes may need to be increased and signing may become impractical even for the legitimate user. In our scheme, all costly computations are performed in the off-line stage while the time for the on-line stage remains essentially unchanged. An additional advantage of our method is that in some cases the transformed signature scheme is invulnerable to chosen message attack even if the underlying (ordinary) digital signature scheme is not. In particular, it allows us to prove that the existence of signature schemes which are unforgeable by {\em known\/} message attack is a (necessary and) sufficient condition for the existence of signature schemes which are unforgeable by {\em chosen\/} message attack.}

\T {On Marsaglia Lattice Test for Pseudorandom Numbers}
\A {J. Eichenauer}
\A {H. Niederreiter}
\J {Manuscripta Mathematica {\bf 62,} 2, pp. 245--248}
\D {1988}

\T {On Optimal GFSR Pseudorandom Number Generators}
\A {S. Tezuka}
\J {Mathematics of Computation {\bf 50,} 182, pp. 531--533}
\D {1988}

\T {On Parallel Computation for the Knapsack Problem}
\A {Andrew Chi-Chih Yao}
\J {J ACM {\bf 29,} 3}
\D {1982}
\X {The complexity of solving the knapsack problem with $n$ input real numbers
on a parallel computer with real arithmetic and branching operations is
considered. A time-processor trade-off constraint is derived; in particular, it
is shown than an exponential number of processors have to be used if the
problem is to be solved in time $t\le\sqrt{n}/2.$}

\T {On Privacy Homomorphisms}
\A {Ernest F. Brickell}
\A {Yacov Yacobi}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {An additive privacy homomorphism is an encryption function in which the decryption of a sum (or possibly some other operation) of ciphers is the sum of the corresponding messages. Rivest, Adleman, and Dertouzos have proposed four different additive privacy homomorphisms. In this paper, we show that two of them are insecure under a ciphertext only attack and the other two can be broken by a known plaintext attack. We also introduce the notion of an $R$-additive privacy homomorphism, which is essentially an additive privacy homomorphism in which only at most $R$ messages need to be added together. We give an example of an $R$-additive privacy homomorphism that appears to be secure against a ciphertext only attack.}

\T {On Public-Key Cryptosystems Built Using Polynomial Rings}
\A {J\'ozef P/ Pieprzyk}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {In the paper, a public-key cryptosystem that is, as a matter of fact, a modification of the Merkle-Hellman system has been described. However, unlike the Merkle-Hellman system, it has been built using a polynomial ring. Finally, its quality has been given.}

\T {On Rotation Group and Encryption of Analog Signals}
\A {Su-shing Chen}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {On Secret Sharing Systems}
\A {Ehud D. Karnin}
\A {Jonathan W. Greene}
\A {Martin E. Hellman}
\J {IEEE Trans. on Info. Th. {\bf IT-29,} 1}
\D {1983}
\X {A ``secret sharing system'' permits a secret to be shared among $n$ trustees in such a way that any $k$ of them can recover the secret, but any $k-1$ have complete uncertainty about it. A linear coding scheme for secret sharing is exhibited which subsumes the polynomial interpolation method proposed by Shamir and can aslo be viewed as a deterministic version of Blakley's probabilistic method. Bounds on the maximum value of $n$ for a given $k$ and secret size are derived for any system, linear or nonlinear. The proposed scheme achieves the lower bound which, for practical purposes, differs insignificantly from the upper bound. The scheme may be extended to protect several secrets. Methods to protect against deliberate tampering by any of the trustees are also presented.}

\T {On Sharing Secrets and Reed-Solomon Code}
\A {R. J. McEliece}
\A {D. V. Sarwate}
\J {C ACM {\bf 24,} 9}
\D {1981}
\X {Shamir's scheme for sharing secrets is closely related to Reed-Solomon
coding schemes. Decoding algorithms for Reed-Solomon codes provide extensions
and generalizations of Shamir's method.}

\T {On Signatures and Authentication}
\A {S. Goldwasser}
\A {S. Micali}
\A {A. C. Yao}
\J {Advances in Cryptology---CRYPTO '82, Proceedings, Plenum Press, pp. 211-215}
\D {1983}

\T {On Struik-Tilburg Cryptanalysis of Rao-Nam Scheme}
\A {T. R. N. Rao}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {On the Classification of Ideal Secret Sharing Schemes}
\A {Ernest F. Brickell}
\A {Daniel M. Davenport}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In a secret sharing scheme, a dealer has a secret key. There is a finite set $P$ of participants and a set $\Gamma$ of subsets of $P.$ A secret sharing scheme with $\Gamma$ as the access structure is a method which the dealer can use to distribute shares to each participant so that a subset of participants can determine the key if and only if that subset is in $\Gamma.$ The share of a participant is the information sent by the dealer in private to the participant. A secret sharing scheme is ideal if any subset of participants who can use their shares to determine any information about the key can in fact actually determine the key, and if the set of possible shares is the same as the set of possible keys. In this paper, we show a relationship between ideal secret sharing schemes and matroids.}

\T {On the Complexity and Efficiency of a New Key Exchange System}
\A {Johannes A. Buchmann}
\A {Stephan D\"ullmann}
\A {Hugh C. Williams}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Buchmann and Williams presented a nre public key exchange system based on imaginery quadratic fields. While in that paper the system was described theoretically and its security was discussed in some detail nothing much was said about the practical implementation. In this paper we discuss the practical aspects of the new system, its efficiency and implementation. In particular we study the crucial point of the method: ideal reduction. We suggest a refinement of the well known reduction method which has been implemented on a computer. We present extensive running time statistics and a detailed complexity analysis of the methods involved. The implementation of the reduction procedure on chips is subject of future research.}

\T {On the Complexity of Pseudo-Random Sequences - or: If You Can Describe a Sequence It Can't be Random}
\A {Thomas Beth}
\A {Zong-Duo Dai}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We shall prove in this note that the Turing-Kolmogorov-Chaitin complexity and the Linear Complexity are the same for practically all 0-1-sequences of length $n,$ already for moderately large $n.$}

\T {On the Concrete Complexity of Zero-Knowledge Proofs}
\A {Joan Boyar}
\A {Ren\'e Peralta}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {The fact that there are zero-knowledge proofs for all languages in $NP$ has, potentially, enormous implications to cryptography. For cryptographers, the issue is no longer ``which languages in $NP$ have zero-knowledge proofs'' but rather ``which languages in $NP$ have practical zero-knowledge proofs''. Thus, the concrete complexity of zero-knowledge proofs for different languages must be established. In this paper, we study the concrete complexity of the known general methods for constructing zero-knowledge proofs. We establish that circuit-based methods have the potential of producing proofs which can be used in practice. Then we introduce several techniques which greatly reduce the concrete complexity of circuit-based proofs. In order to show that our protocols yield proofs of knowledge, we show how to extend the Feige-Fiat-Shamir definition for proofs of knowledge to the model of Brassard-Chaum-Cr\'epeau. Finally, we present techniques for improving the efficiency of protocols which involve arithmetic computations, such as modular addition, subtraction, and multiplication, and greatest common divisor.}

\T {On the Construction of Block Ciphers Provably Secure and Not Relying on Any Unproved Hypotheses}
\A {Yuliang Zheng}
\A {Tsutomu Matsumoto}
\A {Hideki Imai}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {One of the ultimate goals of cryptography researches is to construct a (secret-key) block cipher which has the following ideal properties: (1) The cipher is provably secure, (2) Security of the cipher foes not depend on any unproved hypotheses, (3) The cipher can be easily implemented with current technology, and (4) All design criteria for the cipher are made public. It is currently unclear whether or not there really exists such an ideal block cipher. So to meet the requirements of practical applications, the best thing we can do is to construct a block cipher such that it approximates the ideal one as closely as possible. In this paper, we make a significant step in this direction. In particular, we construct several block ciphers each of which has the above mentioned properties (2), (3) and (4) as well as the following one: ($1^\prime$) Security of the cipher is supported by convincing evidence. Our construction builds upon profound mathematical bases for information security recently established in a series of excellent papers.}

\T {On the Construction of Random Number Generators and Random Function Generators}
\A {C. P. Schnorr}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Blum, Micali, Yao, Goldreich, Goldwasser, Luby, and Rackoff has constructed random number generators, random function generators and random permutation generators that are perfect if certain complexity assumptions hold. We propose random number generators that pass all statistical tests that depend on a small fraction of the bitstring. This does not rely on any unproven hypothesis. We propose improved random function generators with short function names and which minimize the number of pseudo-random bits that are necessary for the evaluation of pseudo-random functions. We announce a new very efficient perfect random number generator.}

\T {On the Cryptanalysis of Rotor and Substitution-Permutation Networks}
\A {D. Andelman}
\A {J. Reeds}
\J {IEEE Trans. on Info. Th. {\bf IT-28,} 4, pp. 578--584}
\D {1982}
\X {A general cryptanalysis method is presented based on statistical estimation theory. It is applied to two systems of practical interest: rotor machines and substitution-permutation networks. To cryptanalyze these systems, the finite keyspace is imbedded in a continuous set and the key estimate is a proper quantization of the continuous maximum likelihood estimate. Promising cryptanalysis results of a rotor machine under a ciphertext only attack and a substitution-permutation network under a known plaintext attack are presented.}

\T {On the Cryptographic Applications of Random Functions}
\A {Oded Goldreich}
\A {Shafi Goldwasser}
\A {Silvio Micali}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {Now that ``random functions'' can be efficiently constructed, we discuss some of their possible applications to cryptography: 1) Distributing unforgeable ID numbers which can be locally verified by stations which contain only a small amount of storage. 2) Dynamic Hashing: even if the adversary can change the key-distribution depending on the values the hashing function has assigned to the previous keys, still he can not force collisions. 3) Constructing deterministic, memoryless authentication schemes which are provably secure against chosen message attack. 4) Construction Identity Friend or Foe systems.}

\T {On the Cryptographic Security of Single RSA Bits}
\A {Michael Ben-Or}
\A {Benny Chor}
\A {Adi Shamir}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {The ability to ``hide'' one bit in trapdoor functions has recently gained much interest in cryptography research, and is of great importance in many transactions protocols. In this paper we study the cryptographic security of RSA bits. In particular, we show that unless the cryptanalyst can completely break the RSA encryption, any heuristic he uses to determine the least significant bit of the cleartext must have an error probability greater than ${1\over4}-\epsilon.$ A similar result is shown for Rabin's encryption scheme.}

\T {On the Design of Permutation P in DES Type Cryptosystems}
\A {Lawrence Brown}
\A {Jennifer Seberry}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper reviews some possible design criteria for the permutation $P$ in a DES style cryptosystem. These permutations provide the diffusion component in a substitution-permutation network. Some empirical rules which seem to account for the derivation of the permutation used in the DES are first presented. Then it is noted that these permutations may be regarded as latin-squares which link the outputs of S-boxes to their inputs at the next stage. A subset of these with a regular structure, and which perform well in a dependency analysis are then presented. Some design rules are then derived, and it is suggested these be used to design permutations in future schemes for an extended version of the DES.}

\T {On the Design of S-Boxes}
\A {A. F. Webster}
\A {S. E. Tavares}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {On the Deterministic Complexity of Factoring Polynomials Over Finite Fields}
\A {Victor Shoup}
\J {Computer Science Technical Report, TR-782, University of Wisconsin}
\D {1988}
\X {We present some new deterministic algorithms for factoring polynomials over finite fields that are asymptotically faster than many commonly known deterministic factoring algorithms. Let $p$ be a prime number. Our main result is a deterministic algorithm that factors polynomials in $\Z_p(X)$ of degree $n$ using $O(p^{1/2+an^2+a})$ operations in $\Z_p$. This improves upon the running time, with respect to both $n$ and $p$, of many previously known  deterministic factoring algorithms.}

\T {On the Existence of Bit Commitment Schemes and Zero-Knowledge Proofs}
\A {Ivan Bjerre Damg{\aa}rd}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {It has been proved earlier that the existence of bit commitment schemes (blobs) implies the existence of zero-knowledge proofs of information possession, which are MA-protocols (i.e. the verifier sends only independent random bits). In this paper we prove the converse result is a slightly modified form: We define a concept called {\em weakly zero-knowledge,} which is like ordinary zero-knowledge, except that we only require that an {\em honest\/} verifier learns nothing from the protocol. We then show that if, using an MA-protocol, $P$ can prove to $V$ in weakly zero-knowledge that he possesses a solution to some hard problem, then this implies the existence of a bit commitment scheme. If the original protocol is (almost) perfect zero-knowledge, then the resulting commitments are secure against an infinitely powerful receiver. Finally, we also show a similar result for a restricted class of non-MA protocols.}

\T {On the Existence of Pseudorandom Generators}
\A {Oded Goldreich}
\A {Hugo Krawczyk}
\A {Michael Luby}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Pseudorandom generators (suggested and developed by Blum and Micali and Yao) are efficient deterministic programs that expand a randomly selected $k$-bit seed into a much longer pseudorandom sequence which is indistinguishable in polynomial time from an (equally long) sequence of unbiased coin tosses. Pseudorandom generators are known to exist assuming the existence of functions that cannot be efficiently inverted on the distributions induced by applying the function iteratively polynomially many times. This sufficient condition is also a necessary one, but is seems difficult to check whether particular functions, assumed to be one-way, are also one-way on their iterates. This raises the fundamental question whether the mere existence of one-way functions suffices for the construction of pseudorandom generators. In this paper we present progress towards resolving this question. We consider {\em regular\/} functions, in which every image of a $k$-bit string has the same number of preimages of length $k.$ We show that if a regular function is one-way then pseudorandom generators do exist. In particular, assuming the intractability of general factoring, we can now prove that pseudorandom generators do exist. Other applications are the construction of pseudorandom generators based on the conjectured intractability of decoding random linear codes, and on the assumed average case difficulty of combinatorial problems as subset-sum.}

\T {On the Feasibility of Computing Discrete Logarithms Using Adleman's Subexponential Algorithm}
\A {Tore Herlestam}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {Some public key distribution systems, based on the difficulties in computing logarithms modulo a large prime, have been alleged to be insecure because of a statement that any logarithm modulo a 200 bit prime can be computed within a reasonable time by means of a subexponential algorithm due to Adleman. In this commentary said algorithm is examined from an algebraic and number-theoretical point of view. The scrutiny shows that the algebraic model for the algorithm contains several traps which seem to be hard to circumvent, and also, not least, that the presupposed abundance of so called round numbers will not be at hand in the computationally interesting cases. Hence it is concluded that the algorithm cannot be a serious threat to the mentioned public key distribution systems.}

\T {On the $F$-Function of FEAL}
\A {Walter Fumy}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {The cryptographic strength of a Feistel Cipher depends strongly on the properties of its $F$-function. Certain characteristics of the $F$-function of the Fast Data Encipherment Algorithm (FEAL) are investigated and compared to characteristic of the $F$-function of the Data Encryption Standard (DES). The effects of several straight-forward modifications of FEAL's $F$-function are discussed.}

\T {On the Generation of Cryptographically Strong Pseudo-Random Sequences}
\A {A. Shamir}
\J {Computer Science Technical Report, CS82--01, Weizmann Institute of Science, Israel}
\D {1982}
\J {ACM Trans. of Computer Systems, {\bf 1,} pp. 38--44}
\D {1983}
\X {In this paper we show how to generate from a short random seed a long sequence of pseudo-random numbers which is cryptographically strong in the sense that knowledge of some sequence elements cannot possibly help the cryptanalyst in computing other sequence elements. The method is based on the RSA cryptosystem, and it is the first published example of a pseudo-random sequence generator for which such a property has been formally proved.}

\T {On the History of Cryptography During WW2, and Possible New Directions for Cryptographic Research}
\A {Tom Tedrick}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {On the Implementation of Elliptic Curve Cryptosystems}
\A {Andreas Bender}
\A {Guy Castagnoli}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A family of elliptic curves for cryptographic use is proposed for which the determination of the order of the corresponding algebraic group is much easier than in the general case. This makes it easier to meet the cryptographic requirement that this order have a large prime factor. Another advantage of this family is that the group operation simplifies slightly. Explicit numerical examples are given that are suitable for practical use.}

\T {On the Key Predistribution System: A Practical Solution to the Key Distribution Problem}
\A {Tsutomu Matsumoto}
\A {Hideki Imai}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {To utilize the common-key encryption for the efficient message protection in a large communication network, it is desired to settle the problem of how to distribute the common keys. This paper describes a practical solution called the {\em key predistribution systems\/} (KPS, for short), which has been proposed by the present authors. On request, the KPS quickly brings a common key to an arbitrary group of entities in a network. Using the KPS, it is quite easy to construct an enciphered one-way communication system, as well as an enciphered two-way (interactive) communication system. For example, even in a very large public network, the KPS can be applied to realize a practical enciphered electronic mailing service directed to individuals. This paper presents secure and efficient realization schemes for the KPS. This paper also discusses the security issues and the variety of applications of them.}

\T {On the Lagarias-Odlyzko Algorithm for the Subset Sum Problem}
\A {A. M. Frieze}
\J {SIAM J. Computing {\bf 15,} 2, pp. 536--539}
\D {1986}
\X {We give a simple analysis of an algorithm for solving subset-sum problems proposed by Lagarias and Odlyzko.}

\T {On the Linear Complexity of Cascaded Sequences}
\A {Rainer Vogel}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {On the Linear Complexity of Combined Shift Register Sequences}
\A {Lennart Brynielsson}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {On the Linear Complexity of Feedback Registers}
\A {A. H. Chan}
\A {M. Goresky}
\A {A. Klapper}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper, we study sequences generated by arbitrary feedback registers (not necessarily feedback shift registers) with arbitrary feedforward functions. We generalize the definition of linear complexity of a sequence to the notions of strong and weak linear complexity of feedback registers. A technique for finding upper bounds for the strong linear complexities of such registers is developed. This technique is applied to several classes of registers. We prove that a feedback shift register whose feedback function is of the form $x_1 + h(x_2,\ldots,x_n)$ can generate long periodic sequences with high linear complexities only if its linear and quadratic terms have certain forms.}

\T {On the Linear Consistency Test (LCT) in Cryptanalysis with Applications}
\A {Kencheng Zeng}
\A {C. H. Yang}
\A {T. R. N. Rao}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In this paper, we first give a precise estimation for the consistency probability of a system of linear algebraic equations $Ax=b$ with random $m\times n$ coefficient matrix $A,$ $m>n,$ and fixed non-zero right side $b.$ A new test in cryptanalysis is then formulated on the basis of the estimation and applied to attack the multiplexing generator of Jennings and the multiple-seed generator of Massey-Rueppel. Some security remarks concerning the perfect linear cipher of the latter authors are also made.}

\T {On the Linear Span of Binary Sequences Obtained from Finite Geometries}
\A {Agnes Hui Chan}
\A {Richard A. Games}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A class of periodic binary sequences that are obtained from the incidence vectors of hyperplanes in finite geometries is defined, and a general method to determine their linear spans (the length of the shortest linear recursion over $GF(2)$ satisfied by the sequence) is described. In particular, we show that the projective and affine hyperplane sequences of odd order both have full linear span. Another application involves the parity sequences of order $n,$ which has period $p^n-1$ and linear span $vL(s)$ where $v=(p^n-1)/(p-1)$ and $L(s)$ is the linear span of a parity sequence of order 1. The determination of the linear span of the parity sequence of order 1 leads to an interesting open problem involving primes.}

\T {On the Linear Syndrome Method in Cryptanalysis}
\A {Kencheng Zeng}
\A {Minqiang Huang}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {On the McEliece Public-Key Cryptosystem}
\A {Johan {van Tilburg}}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Based on an idea by Hin, the method of obtaining the original message after selecting $k$ of $n$ coordinates at random in the McEliece public-key cryptosystem is improved. The attack, which is more efficient than the attacks previously proposed, is characterized by a systematic method of checking and by a random bit swapping procedure. An optimization procedure similar to the one proposed by Lee and Brickell is used to improve the attack. The attack is highly suitable for parallel and pipelined implementation. The work factor and the values, which yield `maximum' security for the system are given. It is shown that the public-key can be reduced to $k\times(n-k)$ bits.}

\T {On the Necessity of Cryptanalytic Exhaustive Search}
\A {Martin E. Hellman}
\A {Ehud D. Karnin}
\A {Justin Reyneri}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {It is shown that the amount of computation required for a general cryptanalytic method is equivalent to an exhaustive search over the key space. In particular, any general time-memory tradeoff must do an exhaustive search as a part of the pre- or post-computation.}

\T {On the Number of Close-and-Equal Pairs of Bits in a String (with Implications on the Security of RSA's L.S.B)}
\A {Oded Goldreich}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {We consider the following problem: Let $s$ be an $n$-bit string with $m$ ones and $n-m$ zeros. Denote by $CE_t(s)$ the number of pairs, of equal bits which are within distance $t$ apart, in the string $s.$ What is the minimum value of $CE_t(\cdot),$ when the minimum is taken over all $n$-bit string which consists of $m$ ones and $n-m$ zeros? We prove a (reasonably) tight lower bound for this combinatorial problem. Implications, on the cryptographic security of the least significant bit of a message encrypted by the RSA scheme, follow. E.g. under the assumption that the RSA is unbreakable; there exists no probabilistic polynomial-time algorithm which guesses the least significant bit of a message (correctly) with probability at least {\bf 0.725,} when given the encryption of the message using the RSA. {\bf This is the best result known concerning the security of RSA's least significant bit.}}

\T {On the Parallel Computation for the Knapsack Problem}
\A {Andrew Chi-Chih Yao}
\J {Proc. of the 13th ACM Symp. on the Theory of Computing}
\D {1981}
\X {We are interested in the complexity of solving the knapsack problem with
$n$ input real numbers on a parallel computer with real arithmetic and
branching operations. A processor-time tradeoff constraint is derived; in
particular, it is shown that an exponential number of processors have to be
used if the problem is to be solve in time $t\le\sqrt{n}/2.$}

\T {On the Power of 1-Way Functions}
\A {Stuart A. Kurtz}
\A {Stephen R. Mahaney}
\A {James S. Royer}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {On the Power of Commutativity in Cryptography}
\A {Adi Shamir}
\J {Automata, Languages and Programming, 7th Colloquium, Noordwijkerhout, Lecture Notes in Computer Science (85), Springer-Verlag}
\D {1980}
\X {Every field needs some unifying ideas which are applicable to a wide variety of situations. In cryptography, the notion of commutativity seems to play such a role. This paper surveys its potential applications, such as the generation of common keys, challenge-and-response identification, signature generation and verification, key-less communication and remote game playing.}

\T {On the Privacy Afforded by Adaptive Text Compression}
\A {Ian H. Witten}
\A {John G. Cleary}
\J {Computers and Security, {\bf 7,} pp. 397--408}
\D {1988}
\X {Ordinary techniques of text compression provide some degree of privacy for messages being stored or transmitted. First, by recoding messages compression protects them from the casual observer. Secondly, by removing redundancy it denies a cryptanalyst the leverage of normal statistical regularities in natural language. Thirdly, and most important, the best text compression systems use adaptive modeling so that they can take advantage if the characteristics of the text being transmitted. The model acts as a very large key, without which decryption is impossible. Adaptive modeling means that the key depends on the entire text that has been transmitted so far since the time the encoder/decoder system was initialized. This paper introduces the modern approach to text compression and describes a highly effective adaptive method, with particular emphasis on its potential for protecting messages from eavesdroppers. The technique is potentially fast and provides both encryption and data compression.}

\T {On the Quadratic Spans of Periodic Sequences}
\A {Agnes Hui Chan}
\A {Richard A. Games}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {On the Randomness of Legendre and Jacobi Sequences}
\A {Ivan Bjerre Damg{\aa}rd}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {On the Security of DES}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {On the Security of Multiple Encryption}
\A {Ralph C. Merkle}
\J {C ACM {\bf 24,} 7, pp. 465--467}
\D {1981}
\X {Double encryption has been suggested to strengthen the Federal Data
Encryption Standard (DES). A recent proposal suggests that using two 56-bit
keys but enciphering 3 times (encrypt with the first key, decrypt with a
second, then encrypt with the first key again) increases security over single
encryption. This paper shows that although either technique significantly
improves security over single encryption, the new technique does not
significantly increase security over simple double encryption. Cryptanalysis of
the 112-bit key requires about $2^{56}$ operations and words of memory, using a
chosen plaintext attack. While DES is used as an example, the technique is
applicable to any similar cipher.}

\T {On the Security of Ping-Pong Protocols when Implemented using the RSA}
\A {Shimon Even}
\A {Oded Goldreich}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {The Security of the RSA implementation of ping-pong protocols is considered. It is shown that the obvious RSA properties, such as ``multiplicativity'', do not endanger the security of ping-pong protocols. Namely, if a ping-pong protocol is secure in general then its implementation using an ``ideal RSA'' is also secure.}

\T {On the Security of $P$-Party Protocols}
\A {L. Q. Pan}
\J {Discrete Applied Maths. {\bf 20,} 2, pp. 127--144}
\D {1988}

\T {On the Security of Public Key Protocols}
\A {Danny Dolev}
\A {Andrew C. Yao}
\J {IEEE Trans. on Info. Th. {\bf IT-29,} 2}
\D {1983}
\X {Recently the use of public key encryption to provide secure network communication has received considerable attention. Such public key systems are usually effective against passive eavesdroppers, who merely tap the lines and try to decipher the message. It has been pointed out, however, that an improperly designed protocol could be vulnerable to an active saboteur, one who may impersonate another user or alter the message being transmitted. Several models are formulated in which the security of protocols can be discussed precisely. Algorithms and characterizations that cen be used to determine protocol security in these models are given.}

\T {On the Security of Schnorr's Pseudo Random Generator}
\A {Rainer A. Rueppel}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {At Eurocrypt 88 Schnorr proposed a pseudo random generator for which he claimed that it could not be distinguished from a truly random source with less than $2^{o(n)}$ output bits, even when unlimited computing power was available. We show that this generator can, in fact, be distinguished with only $4n$ bits of output. Moreover, we present an efficient (linear-time) algorithm which recovers the key from a substring only slightly larger than the generator's keysize. Consequently, the generator is insecure.}

\T {On the Security of the Merkle-Hellman Cryptographic Scheme}
\A {Adi Shamir}
\A {Richard E. Zippel}
\J {IEEE Trans. on Info. Th. {\bf IT-26,} 3}
\D {1980}
\X {A simplified version of the Merkle-Hellman public key cryptographic system is breakable. While their full-fledged system seems to be resistant to the cryptanalytic attack we propose, the result suggests some ways in which the security of their system can be enhanced.}

\T {On the Stability of the Internet}
\A {Jonathan Goodman}
\A {Albert G. Greenberg}
\A {Neal Madras}
\A {Peter March}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}
\X {We consider the stochastic behaviour of binary exponential backoff, a probabilistic algorithm for regulating transmissions on a multiple access channel. Ethernet, a local area network, is built upon this algorithm. The fundamental theoretical issue is stability: does the backlog of packets awaiting transmission remain bounded in time, provided the rates of new packet arrivals are small enough? We present a realistic model of $n\ge2$ stations communicating over the channel. Our main result is to establish that the algorithm is stable if the sum of the arrival rates is sufficiently small. We report detailed results on which rates lead to stability when $n=2$ stations share the channel. In passing we derive several other results bearing on the efficiency of the conflict resolution process. Lastly, we report results from a simulation study, which, in particular, indicate alternative retransmission strategies can significantly improve performance.}

\T {On the Structure of Secret Key Exchange Protocols}
\A {Mihir Bellare}
\A {Lenore Cowen}
\A {Shafi Goldwasser}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {On the Worst Case of Three Algorithms for Computing the Jacobi Symbol}
\A {J. Shallit}
\J {Dartmouth College Computer Science Technical Report PCS-TR89-140}
\D {1989}
\X {We study the worst-case behavior of three iterative algorithms-Eisenstein's algorithm, Lebesgue's algorithm, 
and the ``ordinary'' Jacobi symbol algorithm---for computing the Jacobi symbol.  Each algorithm is similar in format to the Euclidean algorithm for computing gcd $(u,v).$}

\T {On Using Prime Polynomials in Crypto Generators}
\A {Tore Herlestam}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {In this note a primality test for polynomials over a finite field is analyzed. It is particularly well suited to achieve fast computations in the binary case. Lots of prime polynomials which do not have to possess the maximum length property can be easily accessed by means of the test. Examples of binary prime polynomials generated through the use of the test are given for degrees from 35 up to 55. The computational requirements are compared with a related test for maximum length and also with some common factorization procedures. As main application the use of prime polynomials in certain crypto generators is considered.}

\T {On Using RSA with Low Exponent in a Public Key Network}
\A {Johan Hastad}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {We consider the problem of solving systems of equations $P_i(x)\equiv0(\mod n_i)$ $i=1\ldots k$ where $P_i$ are polynomials of degree $d$ and are $n_i$ are distinct relatively prime numbers and $x<\min n_i.$ We prove that if $k>{d(d+1)\over2}$ we can recover $x$ in polynomial time provided $n_i\gg2^k.$ This shows that RSA with low exponent is not a good alternative to use as a public key cryptosystem in a large network. It also shows that a protocol by Broder and Dolev is insecure if RSA with low exponent is used.}

\T {Optimal Algorithms for Byzantine Agreement}
\A {Paul Feldman}
\A {Silvio Micali}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {We exhibit radomized Byzantine agreement (BA) algorithms achieving optimal running time and fault tolerance against all types of adversaries ever considered in the literature. Our BA algorithms do not require trusted parties, preprocessing, or non-constructive arguments. Given private communication lines, we show that $n$ processors can reach $BA$ in expected constant time 1) in a {\em synchronous\/} network if any $<{n\over3}$ faults occur 2) in an {\em asynchronous\/} network if any $<{n\over4}$ faults occur. For both synchronous and asynchronous networks whose lines do not guarantee private communication, we may use cryptography to obtain algorithms optimal both in fault tolerance and running time against computationally bounded adversaries. (Thus, in this setting, we tolerate up to $n\over3$ faults even in an asynchronous network.)}

\T {An Optimal Class of Symmetric Key Generation System}
\A {Rolf Blom}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {It is sometimes required that user pairs in a network share secret information to be used for mutual identification or as a key in a cipher system. If the network is large it becomes impractical or even impossible to store all keys securely at the users. A natural solution then is to supply each user with a relatively small amount of secret data from which he can derive all his keys. A scheme for this purpose will be presented and we call such a scheme a symmetric key generation system (SKGS). However, as all keys will be generated from a small amount of data, dependencies between keys will exist. Therefore by cooperation, users in the system might be able to decrease their uncertainty about keys they should not have access to. The objective of this paper is to present a class of SKGS for which the amount of secret information needed by each user to generate his keys is the least possible while at the same time a certain minimum number of users have to cooperate to resolve the uncertainty of unknown keys.}

\T {An Optimally Secure Relativized Cryptosystem}
\A {Giles Brassard}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {Extended abstract of Crypto'81 presentation.}

\T {The Orange Book}
\X {See: {\em Trusted Computer System Evaluation Criteria.}}

\T {Out of the Inner Circle: A Hackers Guide to Computer Security}
\A {Bill Landreth}
\J {Microsoft Press}
\D {1984}
\X {Inside the inner circle, who hacks and why, how a hacker hacks, how much to
worry about security, external security devices, microcomputers and security,
what to do with the hacker you've caught.}

\T {An Overview of Computational Complexity}
\A {Stephen A. Cook}
\J {C ACM {\bf 26,} 6}
\D {1983}
\X {An historical survey of computational complexity, presented at ACM 82,
October 25--27, in Dalla, Texas.}

\T {A ``Paradoxical'' Identity-Based Signature Scheme Resulting from Zero-Knowledge}
\A {Louis Claude Guillou}
\A {Jean-Jacques Quisquater}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {At EUROCRYPT'88, we introduced an interactive zero-knowledge protocol fitted to the authentication of tamper-resistant devices ({\em e.g.} smart cards). Each security device stores its secret {\em authentication number,} an RSA-like signature computed by an authority from the device identity. Any transaction between a tamper-resistant security device and a verifier is limited to a unique interaction: the device sends its {\em identity\/} and a random {\em test number;\/} then the verifier tells a random large {\em question;\/} and finally the device answers by a {\em witness number.} The transaction is successful when the test number is reconstructed from the witness number, the question and the identity according to numbers published by the authority and rules of redundancy possibly standardized. This protocol allows a cooperation between users in such a way that a group of cooperative users looks like a new entity, having a shadowed identity the product of the individual shadowed identities, while each member reveals nothing about its secret. In another scenario, the secret is partitioned between distinct devices sharing the same identity. A group of cooperative users looks like a unique user having a larger public exponent which is the greater common multiple of each individual exponent. In this paper, additional features are introduced in order to provide: firstly, a mutual interactive authentication of both communicating entities and previously exchanged messages, and, secondly, a digital signature of messages, with a non-interactive zero-knowledge protocol. The problem of multiple signature is solved here in a very smart way due to the possibilities of cooperation between users. The only secret key is the factors of the composite number chosen by the authority delivering one authentication number to each smart card. This key is not known by the user. At the user level, such a scheme may be considered as a keyless identity-based integrity scheme. This integrity has a new and important property: it cannot be misused, {\em i.e.} derived into a confidentiality scheme.}

\T {A `Paradoxical' Solution to the Signature Problem}
\A {S. Goldwasser}
\A {S. Micali}
\A {R. L. Rivest}
\J {Proc. of the 25th IEEE Symp. on Foundations of Comp. Sc., pp. 441-448}
\D {1984}

\T {The Parallel Complexity of Exponentiating Polynomials over Finite Fields}
\A {Faith E. Fich}
\A {Martin Tompa}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}
\J {Technical Report: 85-03-01, Dept. of Computer Science, University of Washington}
\D {1985}

\T {Parallel Generation of Recurring Sequences}
\A {Christoph G. G\"unther}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In applications, such as radar ranging or test pattern generation, linear recurring sequences are needed at rates that require parallel generation of the sequences. Two parallelisation methods for the generation of these sequences are discussed and previous results are made applicable to arbitrary degrees of parallelisation and arbitrary sequences. In particular, a previously known technique (sometimes called windmill technique) is shown to be explainable in a very simple way and to be equally appropriate for the parallelisation of non-linear recursions. The method is, furthermore, shown to be suitable for VLSI-realisations and software implementations.}

\T {Partial Information in Public Key Cryptography}
\A {J. Vyskoc}
\J {Discrete Applied Mathematics {\bf 20,} 3, pp.~261--283}
\D {1988}

\T {Partitioned Encryption and Achieving Simultaneity by Partitioning}
\A {Z. Galil}
\A {M. Yung}
\J {Info. Proc. Letters {\bf 26,} 2}
\D {1987}
\X {We present a method called {\sl Partitioned Encryption\/} whose main
property is its simplicity. It is an extension of {\sl Probablisitic Public-Key
Encryption,} which can bse used in designing cryptographic protocols and can be
applied to distributed problem solving. We also give a modification of {\sl
Secret Sharing\/} called {\sl Partitioned Secret Sharing.} We demonstrate the
power of Partitioned Encryption: combining it with the partitioning of the user
set gives a solution scheme for `Verifiable Secret Sharing' and `Simultaneous
Broadcast in the Presence of Faults', which are important primitives of
fault-tolerant distributed computing introduced by Chor, Goldwasser, Micali and
Awerbuch. The scheme is fully polynomial, simple, and efficient in terms of
communication rounds. The basic partitioning methods are suggested as general
tools for distributed computing, which are easy to implement and analyze.}

\T {Pass-Algorithms: A User Validation Scheme Based on Knowledge of Secret
Algorithms}
\A {James A. Haskett}
\J {C ACM {\bf 27,} 8}
\D {1984}
\X {Pass-algorithms avoid many of the difficulties of secondary password and
offer a flexible, easy-to-implement alternative to costly security features and
equipment.}

\T {Passports and Visas Versus IDs}
\A {George I. Davida}
\A {Yvo G. Desmedt}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Most of the proposed cryptographic based electronic IDs are not adequate when used in international identification protocols. In this paper we extend the concept of a cryptographic electronic ID to a system of electronic {\em passports\/} and {\em visas\/} that surpass existing paper versions.}

\T {Password Authentication with Insecure Communication}
\A {Leslie Lamport}
\J {C ACM {\bf 24,} 11}
\D {1981}
\X {A method of user password authentication is described which is secure even
if an intruder can read the system's data, and can tamper with or eavesdrop on
the communication between the user and the system. The method assumes a secure
one-way encryption function and can be implemented with a microcomputer in the
user's terminal.}

\T {Password Cracking: A Game of Wits}
\A {Donn Seeley}
\J {Communications of the ACM, {\bf 32,} 6, pp. 678++}
\D {1989}
\X {The following report has been gleaned from ``A Tour of the Worm,'' an in-depth account of the November Internet infection. The author found the worm's crypt algorithm a frustrating, yet engaging, puzzle.}

\T {Password Generator Protocol}
\A {F. Wancho}
\J {RFC 972}
\D {1986}
\X {This RFC specifies a standard for the ARPA Internet community. Hosts on the ARPA Internet that choose to implement a Password Generator Protocol (PWDGEN) are expected to adopt and implement this standard.}

\T {Patterns of Entropy Drop of the Key in an S-Box of the DES}
\A {K. C. Zeng}
\A {J. H. Yang}
\A {Z. T. Dai}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Payment Systems and Credential Mechanisms with Provable Security Against Abuse by Individuals}
\A {Ivan Bjerre Damg{\aa}rd}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Payment systems and credential mechanisms are protocols allowing individuals to conduct a wide range of financial and social activities while preventing even infinitely powerful and cooperating organizations from monitoring these activities. These concepts were invented and first studied by David Chaum. Clearly, such systems must also be secure against abuse by individuals (prevent them from showing credentials that have not been issued to them, etc.). In this work, we present constructions for which we can prove, that no individual can cheat successfully, unless he possesses an algorithm that contradicts a single plausible intractability assumption. This can be done while maintaining the unconditional security against abuse by organizations. Our construction will work using any general two-party computation protocol with unconditional privacy for one party, and any signature scheme secure against adaptive chosen message attacks (these concepts are explained in more detail later). From the signature scheme of Bellare and Micali and the multiparty computations protocol by Chaum, Damg{\aa}~rd and van~de~Graaf, it will be clear that both requirements can be met if pairs of claw free functions and trapdoor one-way permutations exist. This, in turn, is satisfied, for example if factoring Blum integers is a hard problem. For credential mechanisms, we obtain an additional advantage over one earlier proposals, where a center trusted by the organizations (but not by individuals) was needed. This center possessed a ``master'' secret allowing it to issue all types of credentials supported by the system. Moreover, then center had to be on-line permanently. In our construction, only an off-line center is needed, which only has to be trusted as far as validating the identity of each individual is concerned. Only organizations authorized to issue a given type of credential have the ability to compute them.}

\T {Perfect and Essentially Perfect Authentication Schemes}
\A {Albrecht Beutelspacher}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Perfect Local Randomness in Pseudo-random Sequences}
\A {Ueli M. Maurer}
\A {James L. Massey}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {The concept of provable cryptographic security for pseudo-random number generators that was introduced by Schnorr is investigated and extended. The cryptanalyst is assumed to have infinite computational resources and hence the security of the generators does not rely on any unproved hypothesis about the difficulty of solving a certain problem, but rather relies on the assumption that the number of bits of the generated sequence the enemy can access is limited. The concept of perfect local randomness of a sequence generator is introduced and investigated using some results from coding theory. The theoretical and practical cryptographic implications of this concept are discussed. Possible extensions of the concept of local randomness as well as some applications are proposed.}

\T {A Perfect Zero-Knowledge Proof for a Problem Equivalent to Discrete Logarithm}
\A {Oded Goldreich}
\A {Eyal Kushilevitz}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {An interactive proof is called {\em perfect zero-knowledge\/} if the probability distribution generated by any probabilistic polynomial-time verifier interacting with the prover on input a theorem $\phi,$ can be generated by another probabilistic polynomial time machine which only gets $\phi$ as input (and interacts with nobody!). In this paper we present a {\em perfect\/} zero-knowledge proof system for a decision problem which is computationally equivalent to the Discrete Logarithm Problem. Doing so we provide additional evidence to the belief that {\em perfect\/} zero-knowledge proofs exist in a non-trivial manner (i.e. for languages not in BPP). Our results extend to the logarithm problem in any finite Abelian group.}

\T {Physical Protection of Cryptographic Devices}
\A {Andrew J. Clark}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {With the growth of user awareness for the need to protect sensitive computer data by cryptographic means, this paper explains the need to protect critical cryptographic variables (particularly keys, and in some cases algorithms) in a secure environment within cryptographic equipment, particularly those used in the area of high value funds transfer transactions. Design principles are outlined, leading to the concept of tamper resistance and not tamper proof devices to protect key data, whether the data can be retained within physically large devices or on small portable tokens. Criteria for the detection of {\em attempts\/} to gain access to sensitive data rather than attack {\em prevention\/} are outlined, together with two types of attack scenario---invasive and non-invasive. The risks of attack on cryptographic devices are surveyed and intruder attack objectives are outlined, together with some typical scenarios. The available counter-measures are discussed. Several discreet mechanism are described. Typical detection mechanisms and sensor systems are discussed plus the design trade-offs that must be made in implementation, in particular manufacturing and maintenance costs versus scope of attack protection. Once an attack is detected, various data destruction mechanisms may be employed. The desirability of active data destruction by ``intelligent'' means is proposed, together with a discussion of alternative techniques with particular reference to the data storage device characteristics. Some experiences of tamper resistant research and development highlight the potential manufacturing problems---particularly in respect of quality assurance, product fault analysis and life-testing. The desirability of tamper resistance standards and independent assessment facilities is expressed, the applicability of such standards and large scale production methods on intelligent tokens, in particular smart cards and personal authenticators, is discussed.}

\T {Pipeline Architecture for Factoring Large Integers with the Quadratic Sieve Algorithm}
\A {Carl Pomerance}
\A {J. W. Smith}
\A {Randy Tuler}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {We describe the quadratic sieve factoring algorithm and a pipeline architecture on which it could be efficiently implemented. Such a device would be of moderate cost to build and would be able to factor 100-digit numbers in less than a month. This represents an order of magnitude speed-up over current implementations on super-computers. Using a distributed network of many such devices, it is predicted much larger numbers could be practically factored.}

\T {Poker Protocols}
\A {Steven Fortune}
\A {Michael Merritt}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Polylog Depth Circuits for Integer Factoring and Discrete Logarithms}
\A {Jonathan Sorenson}
\J {Computer Science Technical Report TR 872, University of Wisconsin}
\D {1989}
\X {We discuss parallel algorithms for integer factoring and discrete logarithms.  In particular, we give polylog depth probabilistic circuits of subexponential size for both of these problems,  which solves an open problem
of Adleman and Kompella. A positive integer is {\em $B$-smooth\/} if all of its prime divisors are at most $B$.  We modify existing sequential algorithms for factoring and discrete logarithms which use such numbers. Analyzing the tradeoffs involved in choosing $B$, we show that for inputs of length $n$,
setting $B = n\log^d n$, with $d$ positive a constant, gives: 1.  Probabilistic boolean circuits of depth $O (\log^{2d+2}n)$ and size $E$ for finding a proper divisor of a positive composite integer with probability at least $1/2-o(1)$, and 2.  Probabilistic boolean circuits of depth $O (\log sup^{2d+4}n)$ and size $E$ for computing discrete logarithms in the finite field $Zp$ for $p$ a prime
with probability $1-o(1)$. These are the first results of this type for both problems.}

\T {Polynomial Factorization and Nonrandomness of Bits of Algebraical and Some Transcendental Numbers}
\A {R. Kanna}
\A {A. K. Lenstra}
\A {L. Lov\'asz}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {Manuel Blum raised the following interesting question: suppose we are given an approximate root of an unknown polynomial with integer coefficients and a bound on the degree and magnitude of the coefficients of the polynomial. Is it possible to infer the polynomial? We answer this question in the affirmative. We are able to show that if a complex number $\alpha$ satisfies an irreducible primitive polynomial $p(x)$ of degree $d$ with integer coefficients each of magnitude at most $H$ then given $O(d^2+d\log H)$ bits of the binary expansion of the real and complex parts of $\alpha,$ we can find $p(x)$ in deterministic polynomial time (and then compute in polynomial time any further bit of $\alpha$). Using the concept of secure pseudo random sequences formulated by Blum, Micali and Yao we show then that the binary (or $p$-ary for any $p$) expansions of algebraic numbers do not form secure sequences in a certain well defined sense. The technique is based on the lattice basis reduction algorithm of Lenstra, Lenstra and Lov\'asz. Our answer to Blum's question enables us to devise a simple polynomial time algorithm to factor polynomials over then \underline {rationals:} we find an approximate root of the polynomial by Newton's method and use our algorithm to find the irreducible polynomial satisfied by the exact root which must then be a factor of the given polynomial. This is repeated until all the factors are found. The technique of the paper also provides a natural, efficient method to compute with algebraic numbers.}

\T {Polynomial Linear Search Algorithm for the $N$-Dimensional Knapsack Problem}
\A {Friedhelm Meyer auf der Heide}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {We present a Linear Search Algorithm which decides the $n$-dimensional knapsack problem in $n^4\log(n) + O(n^3)$ steps. This algorithm works for inputs consisting of $n$ numbers for some arbitrary but fixed integer $n.$ This result solves an open problem posed by Dobkin / Lipton and A.~C.~C.~Yao. It destroys the hope of proving large lower bounds for this $NP$-complete problem in the model of Linear Search Algorithms.}

\T {A Polynomial Linear Search Algorithm for the $n$-Dimensional Knapsack
Problem}
\A {Friedhelm Meyer Auf Der Heide}
\J {J ACM {\bf 31,} 3}
\D {1984}
\X {A linear search algorithm that recognizes the $n$-dimensional knapsack
problem in $2n^4\log n+O(n^3)$ steps is presented. This algorithm works for
inputs consisting of $n$ numbers for some arbitrary but fixed integer $n.$ This
result solves an open problem posed by Dobkin/Lipton and A.C.C. Yao, among
others, and it destroys the hope of proving nonpolynomial lower bounds for this
NP-complete problem in the model of linear search algorithms.}

\T {A Polynomial Time Algorithm For Breaking the Basic Merkle-Hellman Cryptosystem}
\A {A. Shamir}
\J {Proc. of the 23th IEEE Symposium on Foundations of Computer Science, pp. 145--152}
\D {1982}
\J {IEEE Trans. on Information Theory, {\bf IT-30,} pp. 699--704}
\D {1984}
\X {The Merkle-Hellman cryptosystem is one of the two major public-key cryptosystems proposed so far. It is shown that the basic variant of this cryptosystem, in which elements of the public key are modular multiples of a superincreasing sequence, is breakable in polynomial time.}

\T {Positive Alternatives: A Report on an ACM Panel on Hacking}
\A {John A. N. Lee}
\A {Gerald Segal}
\A {Rosalie Steier}
\J {C ACM {\bf 29,} 4}
\D {1986}
\X {Invited participants to a Panel on Hacking hosted by ACM present
recommendations for changing the potential of young hackers as well as for
addressing the problems of abuse.}

\T {``Practical IP'' $\subseteq$ MA}
\A {Gilles Brassard}
\A {Ivan Bjerre Damg{\aa}rd}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {Practical Problems with a Cryptographic Protection Scheme}
\A {Jonathan M. Smith}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {{\bf Z} is a software system designed to provide media-transparent network services on a collection of UNIX machines. These services are comprised of file transfer and command execution; {\bf Z} preserves file ownership on remote transfer, and more significantly, owner and group identity when executing commands remotely. In order to secure known vulnerabilities in the system, enhancements were made. In particular, a cryptographically-derived checksum was added to the messages. After the initial implementation of the checksumming scheme, several iterations of performance improvement occurred. The result was unsatisfactory to the user community, so the checksum was removed. Instead, vulnerabilities were reduced by improved monitoring and maintenance procedures.}

\T {A Practical Protocol for Large Group Orientated Networks}
\A {Yair Frankel}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {A Practical Sieve Algorithm For Finding Prime Numbers}
\A {Xuedong Luo}
\J {Communications of the ACM, {\bf 32}, 3, pp. 344--346}
\D {1989}
\X {Based on the sieve of Eratosthenes, a faster and more compact algorithm is presented for finding all primes between 2 and $N.$}

\T {Practical Zero-Knowledge Proofs: Giving Hints and Using Deficiencies}
\A {Joan Boyar}
\A {Katalin Friedl}
\A {Carsten Lund}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {New practical zero-knowledge proofs are given for some number-theoretic problems. All of the problems are in $NP,$ but the proofs given here are much more efficient than the previously known proofs. In addition, these proofs do not require the prover to be super-polynomial in power. A BPP prover with the appropriate trap-door knowledge is sufficient. The proofs are perfect or statistical zero-knowledge in all cases except one.}

\T {Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory}
\A {Loius C. Guillou}
\A {Jean-Jacques Quisquater}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Zero-knowledge interactive proofs are very promising for the problems related to the verification of identity. After their (mainly theoretical) introduction by S.~Goldwasser, S.~Micali and C.~Rackoff, A.~Fiat and A.~Shamir proposed the first practical solution: the scheme of Fiat-Shamir is a trade-off between the number of authentication numbers stored in each security microprocessor and the number of witness numbers to be checked at each verification. This paper proposes a new scheme which requires the storage of only one authentication number in each security microprocessor and the check of only one witness number. The needed computations are only 2 or 3 more than for the scheme of Fiat-Shamir.}

\T {The Practice of Authentication}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Prepositioned Shared Secret and/or Shared Control Schemes}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Secret sharing is simply a special form of key distribution.}

\T {Primality and Cryptography}
\A {E. Kranakis}
\J {Wiley-Teubner Series in Computer Science}
\D {1986}

\T {The Prisoners' Problem and the Subliminal Channel}
\A {G. J. Simmons}
\J {Advances in Cryptology---CRYPTO '83, Proceedings, Plenum Press, pp. 51--67}
\D {1984}

\T {Privacy Amplification by Public Discussion}
\A {Charles H. Bennett}
\A {Gilles Brassard}
\A {Jean-Marc Robert}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {In this paper, we investigate how the use of a channel with perfect authenticity but no privacy can be used to repair the defects of a channel with imperfect privacy but no authenticity. More precisely, let us assume that Alice and Bob wish to agree on a secret random bit string, and have at their disposal an imperfect private channel and a perfect public channel. The private channel is imperfect in various ways: transmission errors can occur, and partial information can leak to an eavesdropper, Eve, who also has the power to suppress, inject, and modify transmissions arbitrarily. On the other hand, the public channel transmits information accurately, and these transmissions cannot be modified or suppressed by Eve, but their entire contents becomes known to her. We consider the situation in which a random bit string $x$ has already been transmitted from Alice to Bob over the private channel, and we describe interactive public channel protocols that allow them, with high probability: (1) to asses the extent to which the private channel transmission has been corrupted by tampering and channel noise; and (2) if this corruption is not too severe, to repair Bob's partial ignorance of the transmitted string and Eve's partial knowledge of it by distilling from the transmitted and received versions of the string another string, in general shorter than $x,$ upon which Alice and Bob have perfect information, while Eve has nearly no information (or in some cases exactly non), except for its length. These protocols remain secure against unlimited computing power.}

\T {Privacy and Data Protection in Medicine}
\A {Lothar Horbach}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {Privacy Protected Payments - Realization of a Protocol That Guarantees Payer Anonymity}
\A {Svein J. Knapskog}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Privacy Protection and Transborder Data Flows}
\A {Rein Turn}
\J {AFIPS Conf. Proc. National Computer Conference, {\bf 49}}
\D {1980}

\T {Private Coins versus Public Coins in Interactive Proof Systems}
\A {Shafi Goldwasser}
\A {Michael Sipser}
\J {Proc. of the 18th Annual ACM Symp. of Theory of Computing}
\D {1986}
\X {An interactive proof system is a method by which one part of unlimited resources called the {\em prover,} can convince a party of limited resources, call the {\em verifier,} of the truth of a proposition. The verifier may toss coins ask repeated questions of the prover, and run efficient tests upon the prover's responses before deciding whether to be convinced. This extends the familiar proof system implicit in the notion of NP in that there the verifier may not toss coins or speak, but only listen and verify. Interactive proof systems may not yield proof in the strict mathematical sense: the ``proofs'' are probabilistic with an exponentially small, though non-zero chance of error. We consider two notions of interactive proof system. One defined by Goldwasser, Micali, and Rackoff permits the verifier a coin that can be tossed in {\em private,} i.e., a secret source of randomness. The second, due to Babai, requires that the outcome of the verifier's coin tosses be {\em public\/} and thus accessible to the prover. Our main result is that these two systems are equivalent in power with respect to language recognition. The notion of interactive proof system may be seen to yield a probabilistic analog to NP much as BPP is the probabilistic analog to P. We define the {\em probabilistic, nondeterministic, polynomial time Turing machine\/} and show that it is also equivalent in power to these systems.}

\T {A Private Interactive Test of a Boolean Predicate and Minimum-Knowledge Public-Key Cryptosystems}
\A {Z. Galil}
\A {S. Haber}
\A {M. Yung}
\J {Technical Report: CUCS-179-85, University of Columbia}
\D {1985}
\J {Proc. of the 26th IEEE Symp. on Foundations of Comp. Sc. pp. 360--371}
\D {1985}

\T {Private-Key Algebraic-Code Cryptosystems with High Information Rates}
\A {Tzonelih Hwang}
\A {T. R. N. Rao}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Private-Key Algebraic-Coded Cryptosystems}
\A {T. R. N. Rao}
\A {Kil-Hyun Nam}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Public-key cryptosystems using very large distance algebraic codes have been studied previously. Private-key cryptosystems using simpler codes have also been subject of some study recently. This paper proposes a new approach to the private-key cryptosystem which allows use of very simple codes such as distance 3 and 4 Hamming codes. This new approach gives not only very efficient encoding/decoding and very high performance but also appears to be secure even under chosen-plaintext attacks.}

\T {Private-Key Algebraic-Code Encryptions}
\A {T. R. N. Rao}
\A {Kil-Hyun Nam}
\J {IEEE Trans. on Info. Th. {\bf 35,} 4}
\D {1989}
\X {Public-key cryptosystems using very large distance algebraic codes were studied in the past. Private-key cryptosystems using simpler codes have also been subject of a recent study. A new approach to the private-key cryptosystem is proposed which allows use of very simple orders of distance $\le 6$ and length of 250 bits or less. This new scheme gives not only very efficient encoding/decoding and very high information rates but also appears to be secure even under chosen-plaintext attacks.}

\T {Probabilistic Algorithm for Testing Primality}
\A {Michael O. Rabin}
\J {J. of Number Theory {\bf 12,} pp. 128--138}
\D {1980}
\X {We present a practical probabilistic algorithm for testing large number of
arbitrary form for primality. The algorithm has the feature that when it
determines a number composite then the result is always true, but when it
asserts that a number is prime there is a provably small probability of error.
The algorithm was used to generate large numbers asserted to be primes of
arbitrary and special forms, including very large numbers asserted to be twin
primes. Theoretical foundations as well as details of implementation and
experimental results are given.}

\T {Probabilistic Encryption}
\A {S. Goldwasser}
\A {S. Micali}
\J {J. of Comp. and System Sciences, {\bf 28,} pp. 270--299}
\D {1984}

\T {Probabilistic Encryption and How to Play Mental Poker Keeping Secret All Partial Information}
\A {S. Goldwasser}
\A {S. Micali}
\J {Proc. of the 14th ACM Symp. on Theory of Computing, pp. 365--377}
\D {1982}

\T {A Probabilistic Primality Test Base On the Properties of Certain Generalized Lucas Numbers}
\A {Adina Di Porto}
\A {Piero Filipponi}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {After defining a class of generalized Fibonacci numbers and Lucas numbers, we characterize the {\em Fibonacci pseudoprimes of the $m$th kind.} In virtue of the apparent paucity of the composite numbers which are Fibonacci pseudoprimes of the $m$th kind for distinct values of the integral parameter $m,$ a methods, which we believe to be new, for finding large probable primes is proposed. An efficient computational algorithm is outlined.}

\T {The Probabilistic Theory of Linear Complexity}
\A {Harald Niederreiter}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}

\T {Problems with the Normal Use of Cryptography for Providing Security on Unclassified Networks}
\A {Russel L. Brand}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {The normal use of cryptography in unclassified computing systems often fails to provide the level of protection that the system designers and users would expect. This is partially caused by confusion of cryptographic keys and user passwords, and by underestimations of the power of known plaintext attacks. The situations is worsened by performance constraints and occasionally by the system builder's gross misunderstandings of the cryptographic algorithm and protocol.}

\T {Processing Encrypted Data}
\A {Niv Ahituv}
\A {Yeheskel Lapid}
\A {Seev Neumann}
\J {CACM {\bf 30,} 9}
\D {1987}
\X {A severe problem in the processing of encrypted data is that very often, in order to perform arithmetic operations on the data, one has to convert the data back to its nonencrypted origin before performing the required operations. This paper addresses the issue of processing data that have been encrypted while the data are in an encrypted mode. It develops a new approach for encryption models that can facilitate the processing of such data. The advantages of this approach are reviewed, and a basic algorithm is developed to prove the feasibility of the approach.}

\T {Products of Linear Recurring Sequences and Maximum Complexity}
\A {Rainer A. Rueppel}
\A {Othmar J. Staffelbach}
\J {IEEE Trans. on Info. Th. {\bf IT-33,} 1}
\D {1987}
\X {Conditions are derived which guarantee that products of linear recurring sequences attain maximum linear complexity. It is shown that the product of any number of maximum-length GF$(q)$ sequences has maximum linear complexity, provided only the degrees of the corresponding minimal polynomials are distinct and greater than two. It is also shown that if the roots of any number of (not necessarily irreducible) minimal polynomials are simple and lie in extension fields of pairwise relatively prime degrees, then the product of the corresponding GF$(q)$ sequences attains maximum linear complexity, provided only that no two roots of any minimal polynomial are linearly dependent over the groundfield GF$(q)$ (which is automatically satisfied when $q=2$). The results obtained for products are extended to arbitrary linear combinations of product sequences.}

\T {Progress in Data Security Standardisation}
\A {Wyn L. Price}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Proof of Massey's Conjectured Algorithm}
\A {Cunsheng Ding}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Massey's conjectured algorithm for multi-sequence shift register synthesis is proved, and its suitability for the minimal realization of any linear system is also verified.}

\T {Proofs that Yield Nothing but their Validity and a Methodology of Cryptographic Protocol Design}
\A {O. Goldreich}
\A {S. Micali}
\A {A. Wigderson}
\J {Proc. of the 27th IEEE Sym. on Foundations of Comp. Sc,. pp. 174--187}
\D {1986}

\T {Propagation Characteristics of the DES}
\A {Marc Davio}
\A {Yvo Desmedt}
\A {Jean-Jacques Quisquater}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {New general properties in the $S$-boxes were found. Techniques and theorems are presented which allow to evaluate the non-substitution effect in $f$ and the key clustering in DES. Examples are given. Its importance related to the security of DES is discussed.}

\T {Properties of Cryptosystem PGM}
\A {Spyros S. Magliveras}
\A {Nasir D. Memon}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A cryptographic system, called PGM, was invented in the late 1970's by S.~Magliveras. PGM is based on the prolific existence of certain kinds of factorization sets, called {\em logarithmic signatures,} for finite permutation groups. Logarithmic signatures were initially motivated by C.~Sims' bases and strong generators. Statistical properties of random number generators based on PGM have been investigated and show PGM to be statistically robust. In this paper we present recent results on the algebraic properties of PGM. PGM is an endomorphic cryptosystem in which the message space is $\Z_{|G|},$ for a given finite permutation group $G.$ We show that the set of PGM transformations $T_G$ is not closed under functional composition and hence not a group. This set is 2-transitive on $\Z_{|G|}$ if the underlying group $G$ is not hamiltonian. Moreover, if $|G|\ne2^a,$ then the set of transformations contains an odd permutation. An important consequence of the above results is that the group generated by the set of transformations is nearly always the full symmetric group.}

\T {Properties of the Euler Totient Function Modulo 24 and Some of its Cryptographic Implications}
\A {Raouf N. Gorgui-Naguib}
\A {Satnam S. Dlay}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {The work reported in this paper is directed towards the mathematical proof of the existence of a consistent structure for the Euler totient function $\phi(n)$ given $n.$ This structure is extremely simple and follows from the exploitation of some of very interesting properties relating to the integer 24 as demonstrated in the proofs. This result is of particular concern to cryptologists who are either attempting to break the RSA or ascertain its cryptographic viability. Furthermore, it is stipulated that the methods and properties relating to the integer 24, taken as a modulo, may have strong implications on the different attempts to solve the factorisation problem.}

\T {A Proposed Design for an Extended DES}
\A {L. Brown}
\J {Computer Security in the Computer Age, Elsevier Science Publishers, B.V. (North Holland), IFIP, W.J. Caelli (ed.), pp. 9--22}
\D {1989}

\T {Protocol Failures in Cryptosystems}
\A {Judy H. Moore}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {When a cryptoalgorithm is used to solve data security or authentication problems, it is implemented within the context of a protocol which specifies the appropriate procedures for data handling. The purpose of the protocol is to insure that when the cryptosystem is applied, the level of security or authentication required by the system is actually attained. In this paper, we survey a collection of protocols in which this goal has not been met, not because of a failure of the cryptoalgorithm used, but rather because of shortcomings in the design of the protocol. Guidelines for the development of sound protocols will also be extracted from the analysis of these failures.}

\T {A Protocol for Secure Communication in Large Distributed Systems}
\A {David P. Anderson}
\A {D. Ferrari}
\A {P. V. Rangan}
\A {B. Sartirana}
\J {Technical Report: 342, University of California, Berkeley}
\D {1987}

\T {A Protocol for Signing Contracts}
\A {Shimon Even}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}

\T {Protocols for Secure Computations}
\A {A. C.-C. Yao}
\J {Proc. of the 23rd IEEE Symp. on Foundations of Comp. Sc.}
\D {1982}

\T {A Prototype Encryption System Using Public Key}
\A {S. C. Serpell}
\A {C. B. Brookson}
\A {B. L. Clark}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Provable Security of Cryptosystems: a Survey}
\A {Dana Angluin}
\A {David Lichtenstein}
\J {Technical Report YALEU/DCS/TR-288, Dept. of Computer Science, Yale University}
\D {1983}
\X {This survey describes the recent explosion of results concerning rigorous proofs of security of encryption, signatures, pseudo-random number generators, coin flipping, the oblivious transfer, and other cryptographic protocols, relative to assumptions on the computational difficulty of certain problems. Background material is included for the relevant number theoretic problems.}

\T {Provably Fast Integer Factoring with Quasi-Uniform Small Quadratic Residues}
\A {Brigitte Vall\'ee}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {Finding small quadratic residues modulo $n,$ when $n$ is a large composite number of unknown factorisation is almost certainly a computationally hard problem. This problem arises in a natural way when factoring $n$ by the use of congruences of squares. We construct here a polynomial-time algorithms based on the use of lattices, which finds in a near uniform way quadratic residues mod $n$ that are smaller than $O(n^{2/3}).$ In this way, we derive a class of integer factorisation algorithms, the fastest of which provides the best rigorously established probabilistic complexity bound for integer factorisation algorithms.}

\T {A Provably Secure Oblivious Transfer Protocol}
\A {Richard Berger}
\A {Ren\'e Peralta}
\A {Tom Tedrick}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {The idea of the Oblivious Transfer, developed by Rabin, has been shown to have important applications in cryptography. M.~Fischer pointed out that Rabin's original implementation of the Oblivious Transfer was not shown to be secure. Since then it has been an open problem to find a provably secure implementation. We present an implementation which we believe will simplify the development of secure cryptographic protocols. Our protocol is provably secure under the assumption that factoring is hard and that the message is chosen at random from a large message space.}

\T {Proving Security Against Chosen Ciphertext Attacks}
\A {Manuel Blum}
\A {Paul Feldman}
\A {Silvio Micali}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {The relevance of zero knowledge to cryptography has become apparent in the recent years. In this paper we advance this theory by showing that interaction in {\em any\/} zero-knowledge proof can be replaced by sharing a common, short, random string. This advance finds immediate application in the construction of the {\em first\/} public-key cryptosystem secure against chosen ciphertext attack. Our solution, though not yet practical, is of theoretical significance, since the existence of cryptosystems secure against chosen ciphertext attack has been a famous long-standing open problem in the field.}

\T {A Pseudo-Random Bit Generator Based on Elliptic Logarithms}
\A {Burton S. {Kaliski Jr.}}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Recent research in cryptography has led to the construction of several {\em pseudo-random bit generators,} programs producing bits as hard to predict as solving a hard problem. In this paper, 1. We present a new pseudo-random bit generator based on {\em elliptic curves.} 2. To construct our generator, we also develop two techniques that are of independent interest: (a) an algorithm that computes the order of an element in an arbitrary Abelian group; and (b) a new oracle proof method for demonstrating the simultaneous security of multiple bits of a discrete logarithm in an arbitrary Abelian group. 3. We present a new candidate hard problem for future use in cryptography: the {\em elliptic logarithm problem.}}

\T {Pseudo-random Generation from One-way Functions}
\A {Russel Impagliazzo}
\A {Leonid A. Levin}
\A {Michael Luby}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {We show that the existence of one-way functions is necessary and sufficient for the existence of pseudo-random generators in the following sense. Let $f$ be an easily computable functions such that when $x$ is chosen randomly: (1) from $f(x)$ it is hard to recover an $x^\prime$ with $f(x^\prime)=f(x)$ by a small circuit, or; (2) $f$ has small degeneracy and from $f(x)$ it is hard to recover $x$ by a fast algorithm. From one-way functions of type (1) or (2) we show how to construct pseudo-random generators secure against small circuits or fast algorithms, respectively, and vice-versa. Previous results show how to construct pseudo-random generators from one-way functions that have special properties.}

\T {Pseudo-random Permutation Generators and Cryptographic Composition}
\A {Michael Luby}
\A {Charles Rackoff}
\J {Proc. of the 18th Annual ACM Symp. of Theory of Computing}
\D {1986}
\X {We prove here that if there is a pseudo-random function generator, then there is a pseudo-random {\em permutation\/} generator. We also prove that if two permutation generators which are ``slightly secure'' are cryptographically composed, the result is more secure than either one alone.}

\T {Pseudo Random Properties of Cascade Connections of Clock Controlled Shift Registers}
\A {Dieter Gollmann}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Shift registers are frequently used in generators of pseudo random sequences. We will examine how cascade connections of clock controlled shift registers perform when used as generators of pseudo random sequences. We will derive results for the period, for the linear recursion and for the pseudo-randomness of their output sequences.}

\T {A Public Key Analog Cryptosystem}
\A {George I. Davida}
\A {Gilbert G. Walter}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithm}
\A {Taher ElGamal}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\J {IEEE Trans. on Info. Theory {\bf IT-31,} pp. 469--472}
\D {1985}
\X {A new signature scheme is proposed together with an implementation of the Diffie-Hellman key distribution scheme that achieves a public key cryptosystem. The security of both systems relies on the difficulty of computing discrete logarithms over finite fields.}

\T {A Public-Key Cryptosystem Based On Shift Register Sequences}
\A {Harald Niederreiter}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {A Public-Key Cryptosystem Based on the Word Problem}
\A {Neal R. Wagner}
\A {Marianne R. Magyarik}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {The undecidable word problem for groups and semigroups is investigated as a basis for public-key cryptosystem. A specific approach is discussed along with the results of an experimental implementation. This approach does not give a provably secure or practical system, but shows the type of cryptosystem that could be constructed around the word problem. This cryptosystem is randomized, with infinitely many ciphertexts corresponding to each plaintext.}

\T {Public-Key Cryptosystem over Ring $\Z(\sqrt{3})/(2M)$}
\A {Z. H. Shao}
\J {Elec. Letters {\bf 24,} 2, pp. 90--92}
\D {1988}

\T {Public Key Registration}
\A {Stephen M. Matyas}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A procedure is described for securely initializing cryptographic variables in a large number of network terminals. Each terminal has a cryptographic facility which performs all necessary cryptographic functions, A key distribution center is established, and a public and secret key pair is generated for the key distribution center. Each terminal in the network is provided with a terminal identification known to the key distribution center. The terminal identification and the public key of the key distribution center are stored in the cryptographic facility of each terminal. A terminal initializer is designated for each terminal, and the terminal initializer is notified of two expiration times for the purposes of registering the terminal's cryptovariable with the key distribution center. The cryptovariable is generated by the terminal using its cryptographic facility. Prior to the first expiration time, a registration request is prepared and transmitted to the key distribution center. The registration request includes the terminal identification and the cryptovariable. When the key distribution center receives this request, the cryptovariable is temporarily registered and that fact is acknowledged to the requesting terminal. After the expiration of the second time, the registration is complete. Provisions are also made for invalidating a terminal identification if more than one registration is attempted for a given terminal identification or an intended registration was not made in time.}

\T {Public-Key Systems Based On the Difficulty of Tampering}
\A {Yvo Desmedt}
\A {Jean-Jacques Quisquater}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {This paper proposes several public key systems which security is based on the tamperfreeness of a device instead of the computational complexity of a trapdoor one-way function. The first identity-based cryptosystem to protect privacy is presented.}

\T {Public-Key Techniques: Randomness and Redundancy}
\A {L. C. Guillou}
\A {M. Davio}
\A {J.-J. Quisquater}
\J {Cryptologia, {\bf XII}}
\D {1988}

\T {Public Protection of Software}
\A {Amir Herzberg}
\A {Shlomit S. Pinter}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {One of the overwhelming problems that software producers must contend with, is the unauthorized use and distribution of their products. Copyright laws concerning software are rarely enforced, thereby causing major losses to the software companies. Technicals means of protecting software from illegal duplication are required, but the available means are imperfect. We present protocols that enables software protection, without causing overhead in distribution and maintenance. The protocols may be implemented by a conventional cryptosystem, such as the DES, or by a public key cryptosystem, such as the RSA. Both implementations are proved to satisfy required security criterions.}

\T {Public Quadratic Polynomial-Tuples for Efficient Signature-Verification and Message-Encryption}
\A {Tsutomu Matsumoto}
\A {Hideki Imai}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {This paper discusses an asymmetric cryptosystem $C^*$ which consists of public transformations of complexity $O(m^2n^3)$ and secret transformations of complexity $O((mn)^2(m+\log n)),$ where each complexity is measured in the total number of bit-operations for processing a $mn$-bit message block. Each public key of $C^*$ is an $n$-tuple of quadratic $n$-variate polynomials over $GF(2^m)$ and can be used for both verifying signatures and encrypting plaintexts. This paper also shows that for $C^*$ it is practically infeasible to extract the $n$-tuple of $n$-variate polynomials representing the inverse of the corresponding public key.}

\T {The Puzzle Palace}
\A {J. Bamford}
\J {Houghton Mifflin, Boston}
\D {1982}

\T {The Quadratic Sieve Factoring Algorithm}
\A {Carl Pomerance}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {The quadratic sieve algorithm is currently the method of choice to factor very large composite numbers with no small factors. In the hands of the Sandia National Laboratories a team of James Davis and Diane Holdridge, it has held the record for the largest number factored since mid-1983. As of this writing, the largest number it has cracked is the 71 digit number $(10^{71}-1)/9,$ taking 9.5 hours on the Cray XMP computer as Los Alamos, New Mexico. In this paper I shall give some of the history of this algorithm and also describe some of the improvements that have been suggested for it.}

\T {Quantum Cryptography, and its Application to Provably Secure Key Expansion, Public-Key Distribution, and Coin Tossing}
\A {C. H. Bennett}
\A {G. Brassard}
\J {Abstracts of Papers from IEEE Int. Symp. on Information Theory, St.-Jovite, Qu\'ebec}
\D {1983}

\T {Quantum Cryptography II: How to Re-Use a One-Time Pad Safely Even if P=NP}
\A {C. H. Bennett}
\A {G. Brassard}
\A {S. Breidbart}
\J {unpublished manuscript}
\D {1982}

\T {Quantum Cryptography, or Unforgeable Subway Tokens}
\A {C. H. Bennett}
\A {G. Brassard}
\A {S. Breidbart}
\A {S. Wiesner}
\J {Advances in Cryptology---CRYPTO '82, Plenum Press}
\D {1983}

\T {Quantum Cryptography: Public-key Distribution and Coin Tossing}
\A {C. H. Bennett}
\A {G. Brassard}
\J {Proc. of the Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India}
\D {1984}

\T {Quantum Public Key Distribution Reinvented}
\A {Charles H. Bennett}
\A {Gilles Brassard}
\J {SIGACT News, {\bf 18,} 4}
\D {1987}

\T {Quantum Public Key Distribution System}
\A {C. H. Bennett}
\A {G. Brassard}
\J {IBM Technical Disclosure Bulletin, {\bf 28}}
\D {1985}

\T {Quest---A Security Auditing Tool}
\A {S. A. Kapilow}
\A {M. Cherepov}
\J {AT\&T Tech. J. {\bf 67,} 3, pp. 65--71}
\D {1988}

\T {Randomized Algorithms and Pseudorandom Numbers}
\A {Howard J. Karloff}
\A {Prabhakar Raghavan}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Randomized algorithms are analyzed as if unlimited amounts of perfect randomness were available, while pseudorandom number generation is usually studied from the perspective of cryptographic security. Back recently proposed studying the interaction between pseudorandom number generators and randomized algorithms. We follow Bach's lead; we assume that a (small) random seed is available to start up a simple pseudorandom number generator which is then used for the randomized algorithm. We study randomized algorithms for (1) sorting; (2) selection; and (3) oblivious routing in networks.}

\T {Randomized Encryption Techniques}
\A {R. L. Rivest}
\A {A. T. Sherman}
\J {Advances in Cryptology---CRYPTO '82, Proceedings, Plenum Press, pp. 145--163}
\D {1983}

\T {A Randomized Protocol for Signing Contracts}
\A {S. Even}
\A {O. Goldreich}
\A {A. Lempel}
\J {C ACM {\bf 28,} pp. 637--647}
\D {1985}
\X {A randomized contract-signing protocol uses a 1-out0of-2 oblivious transfer
subprotocol that is axiomatically defined.}

\T {Random Mapping Statistics}
\A {Philippe Flajolet}
\A {Andrew M. Odlyzko}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Random mappings from a finite set onto itself are either a heuristic or an exact model for a variety of applications in random number generation, computational number theory, cryptography, and the analysis of algorithms at large. This paper introduces a general framework in which the analysis of about twenty characteristic parameters of random mappings is carried out: These parameters are studied systematically through the use of generating functions and singularity analysis. In particular, an open problem of Knuth is solved, namely that of finding the expected diameter of a random mapping. The same approach is applicable to a larger class of discrete combinatorial models and possibilities of automated analysis using symbolic manipulation systems (``computer algebra'') are also briefly discussed.}

\T {Random Number Generators: Good Ones are Hard to Find}
\A {Stephen K. Park}
\A {Keith W. Miller}
\J {CACM {\bf 31,} 10}
\D {1988}
\X {Practical and theoretical issues are presented concerning the design, implementation, and use of a good, minimal standard random number generator that will port to virtually all systems.}

\T {Random Oracles Separate $PSPACE$ from the Polynomial-Time Hierarchy}
\A {L. Babai}
\J {Info. Proc. Letters {\bf 26,} 1}
\D {1987}
\X {By confirming a conjecture of Furst, Saxe, and Sipser on the size of
constant-depth parity circuits, Yao has completed the proof that $PSPACE$ is
separated from the polynomial-time hierarchy by some oracle. Cai modified Yao's
complex argument to prove that this separation occurs relative to almost every
oracle. We prove that this result actually follows immediately from Yao's
theorem, using a simple construction of Ajtai and Ben-Or to eliminate
randomization in bounded-depth Boolean circuits.}

\T {Random Self-Reducibility and Zero-Knowledge Interactive Proofs of Possession of Information}
\A {M. Tompa}
\A {H. Woll}
\J {Proc. of the 28th IEEE Symp. on Foundations of Comp. Sc. pp. 472--482}
\D {1987}

\T {Random Sources for Cryptographic Systems}
\A {G. B. Agnew}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {The Rao-Nam Scheme Is Insecure Against A Chosen-Plaintext Attack}
\A {Ren\'e Struik}
\A {Johan {van Tilburg}}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {The Rao-Nam scheme is discussed and generalized to $F_q.$ It is shown that the scheme is insecure against a chosen-plaintext attack for practical code lengths. Based on observations an improved scheme is given, which is not vulnerable to the chosen-plaintext attacks as described.}

\T {The Rate of Understanding in Secure Voice Communication Systems}
\A {Klaus-P. Timmann}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {A Realization Scheme for the Identity-Based Cryptosystem}
\A {Hatsukazu Tanaka}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {At the Crypto'84, Shamir has presented a new concept of the identity-based cryptosystem, but no idea is presented on the realization scheme. In this paper a new realization scheme of the modified identity-based cryptosystem has been proposed. The basic idea of the scheme is based on the discrete logarithm problem and the difficulty of factoring a large integer composed of two large primes. The scheme seems to be very secure if all members of the system keep their secret keys safe, but if a constant number of users conspire, the center secret will be disclosed. Then it has a close relation to the well-known ``threshold scheme''. To cope with the conspiracy, the basic system is extended to get a new scheme of which ``threshold'' becomes higher. Detail considerations on the scheme are also given.}

\T {The Real Reason for Rivest's Phenomenon}
\A {Don Coppersmith}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {Burt Kaliski, Ronald Rivest and Alan Sherman noticed a short cycle in their experiments with weak keys in DES. We explain this in terms of fixed points (messages which are left unchanged by encipherment). We predict similar short cycles using semi-weak keys. We indicate how Rivest {\em et al\/}'s experimental setup can be used to show that the group of permutations of message space, generated by DES encryptions, is a large group.}

\T {Reciprocal Hashing: A Method for Generating Minimal Perfect Hashing
Functions}
\A {G. Jaeschke}
\J {C ACM {\bf 24,} 12}
\D {1981}
\X {A method is presented for building minimal perfect hash functions, i.e.,
functions which allow single probe retrieval from minimally sized tables of
identifier sets. A proof of existence for minimal perfect hash functions of a
special type (reciprocal type) is given. Two algorithms for determining hash
functions of reciprocal type are presented and their practical limitations are
discussed. Further, some application results are given and compared with those
of earlier approaches for perfect hashing.}

\T {Recommendation X.509: The Directory---Authentication Framework}
\A {CCITT}
\D {1988}

\T {Recognizing Primes In Random Polynomial Time}
\A {Leonard M. Adleman}
\A {Ming-Deh A. Huang}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {This paper is the first in a sequence of papers which will prove the existence of a random polynomial time algorithm for the set of primes. The techniques used are from arithmetic algebraic geometry and to a lesser extend algebraic and analytic number theory. The result complements the well known result of Strassen and Solovay that there exists a random polynomial time algorithm for the set of composites.}

\T {Reconstructing Truncated Integer Variables Satisfying Linear Congruences}
\A {Alan N. Frieze}
\A {Johan Hastad}
\A {Ravi Kannan}
\A {Jeffrey C. Lagarias}
\A {Adi Shamir}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {We propose a general polynomial time algorithm to find small integer solutions to systems of linear congruences. We use this algorithm to obtain two polynomial time algorithms for reconstructing the values of variables $x_1,\ldots,x_k$ when we are given some linear congruences relating them together with some bits obtained by truncating the binary expansions of the variables. The first algorithm reconstructs the variables when either the high order bits or the low order bits of the $x_i$ are known. It is essentially optimal in its use of information in the sense that it will solve most problems almost as soon as the variables become uniquely determined by their constraints. The second algorithm reconstructs the variables when an arbitrary window of consecutive bits of the variables is known. This algorithm will solve most problems when twice as much information as that necessary to uniquely determine the variables is available. Two cryptanalytic applications of the algorithm are given: predicting linear congruential generators whose outputs are truncated and breaking the simplest version of Blum's protocol for exchanging secrets.}

\T {Reducibility Among Protocols}
\A {M. Blum}
\A {U. V. Vazirani}
\A {V. V. Vazirani}
\J {Advances in Cryptology---CRYPTO '83, Plenum Press}
\D {1984}

\T {Regulation of Electronic Funds Transfer: Impact and Legal Issues}
\A {Ahmed S. Zaki}
\J {C ACM {\bf 26,} 2}
\D {1983}
\X {This paper investigates the implications and impact of current legislation
on the future of the electronic funds transfer systems (EFT). The relevant
statutes are introduced and analyzed. Problem areas are discussed together with
examples of court rulings. The investigation reveals that the regulations do
not provide enough safeguards for the consumer and do not clear up the
ambiguities from a combination of competing laws, regulations, and conflicting
jurisdiction. Legislators, on both the national and state level, and federal
and state governments need to cooperate more closely to produce uniform
legislation that specifically addresses the current problems in an EFT
environment. Courts need to realize the legislature's intent and the benefits
that can be gained before ruling on the current issues.}

\T {Relativized Cryptography}
\A {G. Brassard}
\J {IEEE Trans. on Info. Theory, {\bf IT-29,} pp. 877-894}
\D {1983}
\X {It appears to be very difficult to give a formal definition of computational security for public-key cryptography. A slightly different notion, called transient-key cryptography, is defined for which a natural definition of security against chosen-plaintext attacks is given. The main result presented here is the existence of a relativized model of computation under which there does exist a secure transient-key cryptosystem. Indeed, there exists a computable oracle that can be used by cryptographers to efficiently encipher and decipher messages, yet it is of no help to the cryptanalyst tring to decode messages not intended for him. As a corollary, there also exists a length-preserving permutation, the inverse of which is hard to compute on most elements of its domain, even if arbitrary evaluations of the function itself are allowed for free.}

\T {Report of the Public Cryptography Study Group}
\A {{American Council on Education}}
\J {C ACM {\bf 24,} 7}
\D {1981}

\T {Reversible Generator of Pseudorandom Binary-Numbers}
\A {G. I. Nepeleva}
\A {S. V. Tyurin}
\J {Instruments and Experimental Techniques {\bf 31,} 1, pp. 140--142}
\D {1988}

\T {A Robust and Verifiable Cryptographically Secure Election Scheme}
\A {J. D. Cohen}
\A {M. Fisher}
\J {Proc. of the 26th IEEE Symp. on Foundations of Computer Science, pp. 372--382}
\D {1985}

\T {A Robust Noncryptographic Protocol for Collective Coin Flipping}
\A {Micahel Saks}
\J {SIAM J on Discrete Math. {\bf 2,} 2}
\D {1989}
\X {A new protocol for global coin flipping in the model of Ben-Or and Linial is
presented. In this model, global coin flipping is considered to be an
asynchronous perfect information game among $n$ players, some of whom are
dishonest. Each player possesses a fair coin and they wish to agree on the
value of a single bit, which the honest players want to be random. The protocol
is $\epsilon$-robust against $\theta(n/\log n)$ dishonest players for any fixed
$\epsilon,$ improving on the $\theta(n^{.63\cdots})$ robust protocol given by
Ben-Or and Linial.}

\T {The Role of Encipherment Services In Distributed Systems}
\A {R. W. Jones}
\A {M. S. J. Baxter}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {RSA and Rabin Functions: Certain Parts are as Hard as the Whole}
\A {Werner Alexi}
\A {Benny Chor}
\A {Oded Goldreich}
\A {Claus P. Schnorr}
\J {SIAM Journal of Computing, {\bf 17,} 2, pp. 194++}
\D {1988}
\J {Proc. of the 25th IEEE Symp. on the Foundations of Comp. Sc.}
\D {1984}
\X {The RSA and Rabin encryption functions $E_N(\cdot)$ are respectively defined by raising $x\in\Z_N$ to the power $e$ (where $e$ is relatively prime to $\varphi(N)$) and squaring modulo $N$ (i.e., $E_N(x) = x^e (\mod N),$ $E_N(x) = x^2(\mod N),$ respectively). We prove that for both functions, the following problems are computationally equivalent (each is probabilistic polynomial-time reducible to the other): (1) Given $E_N(x),$ find $x.$ (2) Given $E_N(x),$ guess the least-significant bit of $x$ with success probability ${1\over2} + 1/{\rm poly}(n)$ (where $n$ is the length of the modulus $N$). This equivalence implies that an adversary, given the RSA/Rabin ciphertext, cannot have a non-negligible advantage (over a random coin flip) in guessing the least-significant bit of the plaintext, unless he can invert RSA/factor $N.$ The proof techniques also yield the simultaneous security of the log $n$ least-significant bits. Our results improve the efficiency of pseudorandom number generation and probabilistic encryption schemes based on the intractability of factoring.}

\T {RSA-bits are $0.5+\epsilon$ Secure}
\A {C. P. Schnorr}
\A {W. Alexi}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {We prove by some novel sampling techniques that the least significant bits of RSA-messages are $0.5+\epsilon$-secure. Any oracle which correctly predicts the $k$-th least significant message bit for at least $0.5+\epsilon$-fraction of all messages can be used to decipher all RSA ciphertexts in random polynomial time (more precisely in time $(\log n)^{O(\epsilon^{-2}+k)}$).}

\T {RSA Chips (Past/Present/Future)}
\A {Ronald L. Rivest}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {We review the issues involved in building a special-purpose chip for performing RSA encryption/decryption, and review a few of the current implementation efforts.}

\T {RSA Cryptography Processor}
\A {Holger Sedlak}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {RSA/Rabin Least Significant Bits Are ${1\over2}+{1\over poly(\log N)}$ Secure}
\A {Benny Chor}
\A {Oded Goldreich}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {We prove that RSA least significant bit is ${1\over2} + {1\over\log^c N}$ secure, for any constant $c$ (where $N$ is the RSA modulus). This means that an adversary, given the ciphertext, cannot guess the least significant bit of the plaintext with probability better than ${1\over2} + {1\over\log^c N}$, unless he can break RSA. Our proof technique is strong enough to give, with slight modifications, the following related results: (1) The log log $N$ least significant bits are simultaneously ${1\over2} + {1\over\log^c N}$ secure. (2) The above also holds for Rabin's encryption function. Our results imply that Rabin/RSA encryption can be {\bf directly} used for pseudo random bits generation, provided that factoring/inverting RSA is hard.}

\T {Scanning Method for Absolute Pseudorandom Position Encoders}
\A {E. M. Petriu}
\J {Elec. Letters {\bf 24,} 19, pp. 1236--1237}
\D {1988}

\T {SDNS Architecture and End-to-end Encryption}
\A {Ruth Nelson}
\A {John Heimann}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {The Search for Prime Numbers}
\A {Carl Pomerance}
\J {Scientific American {\bf 247,} 6}
\D {1982}
\X {Until recently the testing of a 100-digit number to determine whether it is prime or composite could have taken a century even with a large computer. Now it can be done in a minute.}

\T {Secrecy and Privacy in a Local Area Network Environment}
\A {Gordon B. Agnew}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {In recent years, much effort has gone into the development of high bandwidth communications networks for use over relatively short (local) distances, e.g. an office, an industrial complex, a research laboratory, etc. The high bandwidth of these networks allows many of the services now requiring separate networks such as facsimile, digitized voice, file transfer and interactive terminal data, to be integrated into a common transmission facility. Manufacturers are currently developing products which conform to the recently established IEEE 802 standard for Local Area Networks (LANs). This standard is based on the concept of a layered, ``peer entity'' communication protocol put forth in the International Standards Organization's (ISO) seven layer model for Open Systems Interconnection (OSI). In this paper we define the notions of secrecy and privacy as they relate to a LAN environment and the various services a network is required to provide such as data integrity, authentication and digital signature services. We also describe the cost-benefit tradeoff involved in attaining various levels of privacy and secrecy.}

\T {Secret Distribution of Keys for Public-Key Systems}
\A {Jean-Jacques Quisquater}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {This paper proposes new public-key cryptosystems systems the security of which is based on the tamperfreeness of a device and the existence of secret key cryptosystems instead of the computational complexity of a {\em trapdoor\/} one-way function (RSA).}

\T {Secret Error-Correcting Codes (SECC)}
\A {Tzonelih Hwang}
\A {T. R. N. Rao}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {A {\em secret error-correcting coding\/} (SECC) scheme is one that provides both data secrecy and data reliability in one process to combat with problems in an insecure and unreliable channel. In as SECC scheme, only the authorized user having secretly held information can correct channel errors systematically. Two SECC schemes are proposed in this paper. The first is a block encryption using Preparata based nonlinear codes; the second one is based on block chaining technique. Along with each schemes can be secure.}

\T {Secret Sharing Homomorphisms: Keeping Shares of a Secret Secret}
\A {Josh Cohen Benaloh}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {In 1979, Blackley and Shamir independently proposed schemes by which a secret can be divided into many shares which can be distributed to mutually suspicious agents. This paper describes a homomorphism property attained by these and several other secret sharing schemes which allows multiple secrets to be combined by direct computation on shares. This property reduces the need for trust among agents and allows secret sharing to be applied to many new problems. One application described here gives a method of verifiable secret sharing which is much simpler and more efficient than previous schemes. A second application is described which gives a fault tolerant method of holding verifiable secret-ballot elections.}

\T {Secret Sharing Over Infinite Domains}
\A {Benny Chor}
\A {Eyal Kushilevitz}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A $(k,n)$ secret sharing scheme is a probabilistic mapping of a secret to $n$ shares, such that (1) The secret can be reconstructed from any $k$ shares. (2) No subset of $k-1$ shares reveals any partial information about the secret. Various secret sharing schemes have been proposed, and applications in diverse contexts were found. In all these cases, the set of secrets and the set of shares are finite. In this paper we study the possibility of secret sharing schemes over {\em infinite\/} domains. The major case of interest is when the secrets and the shares are taken from a {\em countable\/} set, for example all binary strings. We show that no $(k,n)$ secret sharing scheme over any countable domain exists (for any $2\le k\le n).$ Once consequence of this impossibility result is that no {\em perfect private-key encryption schemes,} over the set of all strings, exist. Stated informally, this means that there is no way to perfectly encrypt all strings without revealing information about their length. We contrast these results with the case where both the secrets and the shares are real numbers. Simple secret sharing schemes (and perfect private-key encryption schemes) are presented. Thus, infinity alone does not rule out the possibility of secret sharing.}

\T {A Secure and Privacy-Protecting Protocol for Transmitting Personal Information Between Organizations}
\A {David Chaum}
\A {Jan-Hendrik Evertse}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A multi-party cryptographic protocol and a proof of its security are presented. The protocol is based on RSA using a one-way function. Its participants are individuals and organizations, which are not assumed to trust each other. The protocol implements a ``credential mechanism'', which is used to transfer personal information about individuals from one organization to another, while allowing individuals to retain substantial control over such transfers. It is proved that the privacy of individuals is protected in a way that is optimal against cooperation of all organizations, even if the organizations have infinite computational resources. We introduce a ``formal credential mechanism'', based on an ``ideal RSA cryptosystem''. It allows individuals a chance of successful cheating that is proved to be exponentially small in the amount of computation required. The new proof techniques used are based on probability theory and number theory and may be of more general applicability.}

\T {A Secure and Useful ``Keyless Cryptosystem''}
\A {Mordechai M. Yung}
\J {Technical Report: CUCS-136-84, University of Columbia}
\D {1984}
\J {Information Processing Letters {\bf 21,} pp. 35--38}
\D {1985}
\X {Keyless cryptography is a technique in which the basis of security is the
anonymity of the sender. We describe a protocol that fits the technique to
realistic communication environments, and extend the security and range of
applications of the technique.}

\T {Secure Audio Teleconference}
\A {E. F. Brickell}
\A {P. J. Lee}
\A {Y. Yacobi}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {A number of alternative encryption techniques have been suggested for secure audio teleconferencing implementable on public switched network, in which the centralized facility, called {\em bridge,} does not hold any secret. The role of the bridge is to synchronously add simultaneous encrypted signals, modulo some known number, and then transmit the result to all the participants. Each terminal has a secret key, with which it can decrypt the above modular sum of encrypted signals to obtain the desired ordinary sum of cleartext signals. Secrecy of the systems is analyzed. Some of which are provably secure, assuming the existence of one way functions, and for the other we have partial cryptanalysis. We also present a $N$-party identification and signature systems, based on Fiat and Shamir's single party systems, and another $N$-party signature system based on the discrete-log problem. Our systems have communication complexity $2N$ times that of the basic Fiat-Shamir systems (as compared to a factor of $N^2$ in the direct application of the basic scheme to all pairs).}

\T {A Secure Audio Teleconference System}
\A {D. G. Steer}
\A {L. Strawczynski}
\A {W. Diffie}
\A {M. Wiener}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {Users of large communication networks often require a multi-party teleconferencing facility. The most common technique for providing secure audio teleconferencing requires the speech of each participant to be returned to clear form in a bridge circuit where it is combined with the speech of the other participants. In this paper we describe secure conferencing systems in which some of the bridge functions are distributed among the users so that no additional security weakness is introduced. The network conference bridge knows the addresses of the participants and receives and distributes the encrypted speech without modification. The conference system can be used with a number of encryption algorithms and the system is suitable for deployment on digital networks such as ISDN. High quality and robust secure voice communication can be provided with this technique.}

\T {A Secure Poker Protocol that Minimizes the Effect of Player Coalitions}
\A {Claude Cr\'epeau}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {A Secure Public-Key Authentication Scheme}
\A {Zvi Galil}
\A {Stuart Haber}
\A {Moti Yung}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {We propose interactive probabilistic public-key encryption schemes so that: (1) the sender and the receiver of a message, as well as the message itself, can be authenticated; (2) the scheme is secure against any feasible attack by a participant, including chosen-ciphertext attack. Our suggested protocols can use any one-way trapdoor functions. In order to formulate and prove the properties of our procedures, we propose several new complexity-theoretic definitions of different levels of cryptographic security for systems which allow interaction. Chosen-ciphertext security is achieved using the techniques of minimum-knowledge interactive proofs, and requires only a constant number of message exchanges at the system's initiation stage.}

\T {A Secure Public Key Protocol Based On Discrete Exponentiation}
\A {G. B. Agnew}
\A {R. C. Mullin}
\A {S. A. Vanstone}
\J {Advances in Cryptology---Eurocrypt '88, Springer-Verlag}
\D {1988}

\T {A Secure Subliminal Channel (?)}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Security Analysis and Optimization}
\A {B. Scott}
\A {O. Alsac}
\A {A. J. Monticelli}
\J {Proc. of the IEEE {\bf 75,} 12, pp. 1623--1644}
\D {1987}

\T {Security and Performance Optimization of a New Des Data Encryption Chip}
\A {I. Verbauwhede}
\A {J. Vandewalle}
\A {H. J. Deman}
\A {F. Hoornaert}
\J {IEEE J. of Solid-State Circuits {\bf 23,} 3, pp. 647--656}
\D {1988}

\T {Security Considerations in the Design and Implementation of a new DES chip}
\A {Ingrid Veberuwhede}
\A {Frank Hoornaert}
\A {Joos Vandewalle}
\A {Hugo {De Man}}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {Security-Control Methods for Statistical Databases: A Comparative Study}
\A {Nabil R. Adam}
\A {John C. Wortmann}
\J {ACM Computing Surveys {\bf 21,} 4}
\D {1989}
\X {This paper considers the problems of providing security to statistical
databases againsr disclosure of confidential information. Security-control
methods suggested in the literature are classified into four general
approaches: conceptual, query restriction, data perturbation, and output
perturbation. Criteria for evaluating the performance of the various
security-control methods are identified. Security-control methods that are
based on each of the four approaches are discussed, together with their
performance with respect to the identified evaluation criteria. A detailed
comparative analysis of the most promising methods for protecting
dynamic-online statistical databases is also presented. To date no single
security-control method prevents both exact and partial disclosures. There are,
however, a few perturbation-based methods that prevent exact disclosures and
enable the database administrator to exercise ``statistical disclosure
control.'' Some of these methods, however introduce bias into query responses
or suffer from the 0/1 query-set-size problem (i.e., partial disclosure is
possible in case of null query set or a query set of size 1). We recommend
directing future research efforts toward developing new methods that prevent
exact disclosure and provide statistical-disclosure control, while at the same
time do not suffer from the bias problem and tghe 0/1 query-set-size problem.
Furthermore, efforts directed toward developing a bias-correction mechanism and
solving the general problem of small query-set-size would help salvage a few of
the current perturbation based methods.}

\T {Security for Computer Networks: An Introduction to Data Security in Teleprocessing and Electronic Funds Transfer}
\A {D. W. Davies}
\A {W. L. Price}
\J {John Wiley \& Sons}
\D {1984}
\X {The need for data security, assessment of security, the effect of technology, the notation for encryption, uses of encipherment, substitution ciphers (Caesar, monoalphabetic, polyalphabetic, Vigen\`ere), transposition ciphers (simple transposition, Nihilist), product ciphers, cipher machines (Jefferson cylinder, Wheatstone discs, rotor machines, the Enigma, printing cipher machines, modern cipher machines, keyed substitution), classes of attack, the stream cipher, the Vernam cipher, the block cipher, Shannon's theory, limits of computation, active line taps, methods of protection, Data Encryption Standard (DES), NBS, IBM, Lucifer, the ladder diagram, known regularities in DES, weak keys, security of DES, implementation of DES, methods of block cipher use, cipher block chaining, cipher feedback, output feedback, authentication, problem of replay, problem of disputes, key management, key generation, terminal and session keys, tagged keys, identity verification, hand-written signatures, fingerprints, voice verification, retinal patterns, public key ciphers, one-way functions, the exponential function, the power function, RSA, trapdoor knapsack, appendix on finite arithmetic, digital signatures, electronic funds transfer, bank cheques, credit transfer, inter-bank payments, SWIFT (Society for Worldwide Inter-bank Financial Telecommunications), automatic teller machines (ATMs), PIN management, point-of-sale systems, data security standards.}

\T {Security for the DoD Transmission Control Protocol}
\A {Whitfield Diffie}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}

\T {Security Guards---Issues and Approaches}
\A {W. Neugent}
\J {IEEE Comm. Magazine {\bf 26,} 8, p. 25}
\D {1988}

\T {Security in Computing}
\A {C. Pfleeger}
\J {Prentice-Hall}
\D {1989}

\T {Security in Open Distributed Processing}
\A {Charles Siuda}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper describes two main aspects of security in open distributed processing: Embedment of security capabilities in reference to the OSI Reference Model and mapping of application layer components onto implementations in end-systems. The paper is based on a strategic commitment to the adoption of existing and evolving international standards. Therefore, the work is based on the security architecture (OSI 7498-2) and on the security concept described in ECMA TR/46 - Security in Open Systems - a Security Framework. This framework proposes a set of security facilities which are the building blocks for security services for use in the OSI application layer. One of the main targets of this paper is to show how security services can be embedded in the OSI communication environment. Two new types of common Application Service Element (ASE) are proposed to provide the security services in the application layer: the security information ASE and the security control ASE. The X.400 message handling system has been chosen as the example for securing a productive application.}

\T {Security Mechanisms in High-Level Network Protocols}
\A {Victor L. Voydock}
\A {Stephen T. Kent}
\J {ACM Computing Surveys {\bf 15,} 2, pp. 135--171}
\D {1983}
\X {The implications of adding security mechanisms to high-level netword
protocols operating in an open-system environment are analyzed. First the
threats to security that may arise in such an environment are described, and
then a set of goals for communications security measures is established. This
is followed by a brief description of the two basic approaches to
communications security, line-orientated measures and end-to-end measures,
which concludes that end-to-end measures are more appropriate in an open-system
environment. Next, relevant properties of data encryption---the fundamental
technique on which all communications security mechanisms are based---are
discussed. The reaminder of the paper describes how end-to-end measures can be
used to achieve each of the security goals previously established.}

\T {A Security Methodology for Computer-Networks}
\A {L. G. Pierson}
\A {E. L. Witzke}
\J {AT\&T Tech. J. {\bf 67,} 3, pp. 28--36}
\D {1988}

\T {Security of Improved Identity-based Conference Key Distribution Systems}
\A {Kenji Koyama}
\A {Kazuo Ohta}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {At Crypto-87 conference, we proposed identity-based key distribution systems for generating a common secret conference key for two or more users. Protocols were shown for three configurations: a ring, a complete graph, and a star. Yacobi has made an impersonation attack on the protocols for the complete graph and star networks. This paper proposes improved identity-based key distribution protocols to counter his attack.}

\T {Security of Ramp Schemes}
\A {G. R. Blakley}
\A {Catherine Meadows}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Security of Transportable Computerized Files}
\A {A. Bouckaert}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {A Security Policy for a Profile-Oriented Operating System}
\A {Charles R. Young}
\J {AFIPS Proceedings, {\bf 50,} National Computer Conference}
\D {1981}

\T {Security Problems on Inference Control for SUM, MAX, and MIN Queries}
\A {Francis Chin}
\J {J ACM {\bf 33,} 3}
\D {1986}
\X {The basic inference problem is defined as follows: For a finite set
$X=\{x_1,\ldots,x_n\},$ we wish to infer properties of elements of $X$ on the
basis of sets of ``queries'' regarding subsets of $X.$ By restricting these
queries to statistical queries, the statistical database (SDB) security problem
is obtained. The security problem for the SDB is to limit the use of the SDB so
that only statistical information is available and no sequence of queries is
sufficient to infer protected information about any individual. When such
information is obtained the SDB is said to be compromised. In this paper, two
applications concerning the security of the SDB are consi9dered: (1) {\em
On-line application.} The queries are answered one by one in sequence and it is
necessary to determine whether the SDB is compromised if a new query is
answered. (2) {\em Off-line application.} All querues are available at the same
time and it is necessary to determine the maximum subset of queries to be
answered without compromising the SDB. The complexity of these two
applications, when the set of queries consists of (a) a single type of SUM
query, (b) a single type of MAX/MIN query, (c) mixed types of MAX and MIN
queries, (d) mixed types of SUM and MAX/MIN queries, and (e) mixed types of
SUM, MAX, and MIN queries, is studied. Efficient algorithms are designed for
some of these situations while others are shown to be NP-hard.}

\T {Security-Related Comments Regarding McEliece's Public-Key Cryptosystem}
\A {Carlisle M. Adams}
\A {Henk Meijer}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\J {IEEE Trans. on Info. Th. {\bf 35,} 2}
\D {1989}
\X {The optimal values for the parameters of the McEliece public key cryptosystems are computed. Using these values improves the cryptographic complexity of the system and decreases its data expansion. Secondly it is shown that the likelihood of the existence of more than one trapdoor in the system is very small.}

\T {Security Standards---Government and Commercial}
\A {L. K. Barker}
\A {L. D. Nelson}
\J {AT\&T Tech. J. {\bf 67,} 3, pp. 9--18}
\D {1988}

\T {Security without Identification: Transaction Systems to Make Big Brother
Obsolete}
\A {David Chaum}
\J {C ACM {\bf 28,} 10}
\D {1985}
\X {By partitioning consumer information into separate unlinkable domains
through the use of user-created ``digital pseudonyms,'' the dangers inherent in
large-scale automated transaction systems, as currently structured, can be
avoided.}

\T {Self-Reducibility: The Effects of Structure on Complexity}
\A {Deborah Joseph}
\A {Paul Young}
\J {Computer Science Technical Report TR 798, University of Wisconsin}
\D {1988}
\X {In this column we will discuss the effect that various {\em self-reducibility} properties have on the analysis of complexity classes.  We will be primarily interested in reviewing some of the more elementary results for readers unfamiliar with the field and then discussing some recent results and directions where self-reducibilities have been useful.  Throughout, we will
focus on the question of when self-reducibilities can be used to force sets,
or classes of sets, to have lower complexity than might otherwise be expected.}

\T {Self-Synchronizing Cascaded Cipher System with Dynamic Control of Error Propagation}
\A {Norman Proctor}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {A cipher system used for secure communication over a noisy channel can automatically synchronize the sender and receiver by computing a stateless function of a key and a limited amount of the recent cipher-text. The more ciphertext feedback is used, the more the errors from the noisy channel are propagated. The less feedback is used, the easier ciphertext-only and chosen-plaintext attacks become. There is a trade-off between security and noise that must be made when a self-synchronizing system is built. This paper presents a self-synchronizing cascaded cipher system that permits most combinations of key and ciphertext feedback lengths and also allows adjustment of the trade-off between security and noise during system operation. At times when maximum security is not needed, the error propagation can be reduced temporarily. As implemented in hardware, the cascaded cipher has a storage register for each stage. The function computed would normally depend on the state of this storage, but different clocks are used at each stage to render the function stateless. The use of a cascade helps to keep the hardware cost down.}

\T {Sequence Complexity as a Test for Cryptographic Systems}
\A {A. K. Leung}
\A {S. E. Tavares}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {The complexity of a finite sequence as defined by Lempel and Ziv is advocated as the basis of a test for cryptographic algorithms. Assuming binary data and block enciphering, it is claimed that the difference (exclusive OR sum) between the plaintext vector and the corresponding ciphertext vector should have high complexity, with very high probability. We may refer to this as plaintext/ciphertext complexity. Similarly, we can estimate an ``avalanche'' or ciphertext/ciphertext complexity. This is determined by changing the plaintext by one bit and computing the complexity of the difference of the corresponding ciphertexts. These ciphertext vectors should appear to be statistically independent and thus their difference should have high complexity with very high probability. The distribution of complexity of randomly selected binary blocks of the same length is used as a reference. If the distribution of complexity generated by the cryptographic algorithm matches well with the reference distribution, the algorithm passes the complexity test. For demonstration, the test is applied to modulo multiplication and to successive rounds (iterations) of the DES encryption algorithm. For DES, the plaintext/ciphertext complexity test is satisfied by the second round, but the avalanche complexity test takes four to five rounds before a good fit is obtained.}

\T {Sequences with Almost Perfect Linear Complexity Profile}
\A {Harald Niederreiter}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}

\T {The Sharing of Rights and Information in a Capability-Based Protection System}
\A {Matt Bishop}
\J {Dartmouth College Computer Science Technical Report PCS-TR88-136}
\D {1988}
\X {The paper examines the question of sharing of rights and information in the Take-Grant Protection Model by concentrating on the similarities between the two; in order to do this, we state and prove new theorems for each that 
specifically show the similarities.  The proof for one of the original theorems is also provided.  These statements of necessary and sufficient conditions are contrasted to illustrate the proposition that transferring rights and transferring information are fundamentally the same, as one would expect in a capability-based system.  We then discuss directions for future research in light of these results.}

\T {Shift Register Sequences (revised edition)}
\A {S. Golomb}
\J {Aegean Park Press}
\D {1982 (original 1967)}

\T {The Shortest Feedback Shift Register that can Generate a Given Sequence}
\A {Cees J. A. Jansen}
\A {Dick E. Boekee}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In this paper the problem of finding the absolutely shortest (possibly nonlinear) feedback shift register, which can generate a given sequence with characters from some arbitrary alphabet, is considered. To this end, a new complexity measure is defined, called the maximum order complexity. A new theory of the nonlinear feedback shift register is developed, concerning elementary complexity properties of transposed and reciprocal sequences, and feedback functions of the maximum order feedback shift register equivalent. Moreover, Blumer's algorithm is identified as a powerful tool for determining the maximum order complexity profile of sequences, as well as their period, in linear time and memory. The typical behaviour of the maximum order complexity profile is shown and the consequences for the analysis of given sequences and the synthesis of feedback shift registers are discussed.}

\T {A Short Report on the RSA Chip}
\A {R. L. Rivest}
\J {Advances in Cryptology---CRYPTO '82, Proceedings, Plenum Press, p. 327}
\D {1983}

\T {Showing Credentials Without Identification: Signatures Transferred Between Unconditionally Unlinkable Pseudonyms}
\A {David Chaum}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {A Signature with Shared Verification Scheme}
\A {Marijke {De Soete}}
\A {Jean-Jacques Quisquater}
\A {Klaus Vedder}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {This paper presents a signature scheme for a single user or a group of users. The shared verification of such a signature uses the principle of threshold schemes. The constructions are based on a special class of finite incidence structures, so called generalized quadrangles.}

\T {A Simple and Secure Way to Show the Validity of Your Public Key}
\A {Jeroen {van de Graaf}}
\A {Ren\'e Peralta}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {We present a protocol for convincing an opponent that an integer $N$ is of the form $P^rQ^s,$ with $P$ and $Q$ primes congruent to 3 modulo 4 and with $r$ and $s$ odd. Our protocol is provably secure in the sense that it does not reveal the factors of $N.$ The protocol is very fast and therefore can be used in practice.}

\T {Simple Fibre-Optic Multiplexing System Using Pseudorandom Sequence}
\A {J. J. Mlodzianowski}
\A {D. Uttamchandani}
\A {B. Culshaw}
\J {Elec. Letters {\bf 24,} 23, pp. 1436--1438}
\D {1988}

\T {A Simple Guide to Five Normal Forms in Relation Database Theory}
\A {William Kent}
\J {C ACM {\bf 26,} 2}
\D {1983}
\X {The concepts behind the five principal normal forms in relational database
theory are presented in simple terms.}

\T {A Simple Protocol for Signing Contracts}
\A {O. Goldreich}
\J {Advances in Cryptology---CRYPTO '83, Proceedings, Plenum Press, pp. 133--136}
\D {1984}

\T {A Simple Technique for Diffusing Cryptoperiods}
\A {Stig F. Mj{\o}lsnes}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {The technique obtains diffuse cryptoperiods based on the stochastic properties of the cipher stream. The periods are randomized by scanning the pseudo-random bit sequence for occurrences of bit patterns. No explicit information about the change of key is necessary during transmission. The statistical model shows a deviation from the geometrical distribution die to overlapping between bit patterns. The technique can be generalized to randomize and synchronize any common event between sender and recipients without introducing extra signalling and with minimal computational overhead under the assumption of a reliable communication channel.}

\T {A Simple Unpredictable Pseudo-Random Number Generator}
\A {L. Blum}
\A {M. Blum}
\A {M. Shub}
\J {SIAM J. on Computing, {\bf 15,} 2}
\D {1986}
\X {Two closely-related pseudo-random sequence generators are presented: The $1/P$ {\em generator,} with input $P$ a prime, outputs the quotient digits obtained on dividing 1 by $P.$ The $x^2\mod N$ {\em generator\/} with inputs $N,$ $x_0$ (where $N=PQ$ is a product of distinct primes, each congruent to 3 mod 4, and $x_0$ is a quadratic residue mod $N$), outputs $b_0b_1b_2\cdots$ where $b_i=\mbox{parity}(x_i)$ and $X_{i+1}=x_i^2\mod N.$ From short seeds each generator efficiently produces long well-distributed sequences. Moreover, both generators have computationally hard problems at their core. The first generators's sequence, however, are {\em completely predictable\/} (from any small segment of $2|P|+1$ consecutive digits one can infer the ``seed,'' $P,$ and continue the sequence backwards and forwards), whereas the second, under a certain intractability assumption, is {\em unpredictable\/} in a precise sense. The second generator has additional interesting properties: from knowledge of $x_0$ and $N$ but {\em not\/} $P$ or $Q,$ one can generate the sequence forwards, but, under the above-mentioned intractability assumption, one can {\em not\/} generate the sequence backwards. From the additional knowledge of $P$ and $Q$, one {\em can\/} generate the sequence backwards; one can even ``jump'' about from any point in the sequence to any other. Because of these properties, the $x^2\mod N$ {\em generator\/} promises many interesting applications, e.g., to public-key cryptography. To use these generators in practice, an analysis is needed of various properties of these sequences such as the periods. This analysis is begun here.}

\T {Simplifying Key Management in Electronic Funds Transfer Points of Sale Systems}
\A {H. Beker}
\A {J. Friend}
\A {P. Halliden}
\J {Electronics Letters {\bf 19,} 12, pp. 442--444}
\D {1983}

\T {Simultaneous Security of Bits in the Discrete Log}
\A {Ren\'e Peralta}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {We show that $c\log\log P$ simultaneously secure bits can be extracted from the discrete log function. These bits satisfy the next-bit unpredictability condition of Blum and Micali. Therefore we can construct a cryptographically secure pseudo random number generator which produces $c\log\log P$ bits per modular exponentiation under the assumption that the discrete log is hard.}

\T {A Single Chip 1024 Bits RSA Processor}
\A {Andr\'e Vandemeulebroecke}
\A {Etienne Vanzieleghem}
\A {Tony Denayer}
\A {Paul G. A. Jespers}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {A new carry-free division algorithm will be described; it is based on the properties of RSD arithmetic to avoid carry propagation and uses the minimum hardware per bit i.e. one full-adder. Its application to a 1024 bits RSA cryptographic chip will be presented. Thanks to the features of this new algorithm, high performance (8 kbits/s for 1024 bit words) was obtained for relatively small area and power consumption (8 mm$^2$ in a 2 $\mu$m CMOS process and 500 mW at 25 MHz).}

\T {Single Chips Encrypts Data ar 14 Mb/s}
\A {Dave MacMillan}
\J {Electronics, 16~June}
\D {1981}
\X {Three on-board write-only registers ensure key security under standard microprocessor or bit-slice control.}

\T {A Single-Chip VLSI Implementation of the Discrete Exponential Public Key Distribution System}
\A {K. Yiu}
\A {K. Peterson}
\J {Proc. of IEEE Global Telecommunications Conf. {\bf 1,} pp. 173--179}
\D {1982}

\T {Smallest Possible Message Expansion in Threshold Schemes}
\A {G. R. Blakley}
\A {R. D. Dixon}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Smart Card 2000}
\E {D. Chaum}
\E {I. Schaum\"uller-Bichl}
\J {North-Holland, Amsterdam, The Netherlands}
\D {1988}

\T {Smart Card: A Highly Reliable and Portable Security Device}
\A {Louis C. Guillou}
\A {Michael Ugon}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {At first glance, the smart card looks like an improvement of the traditional credit card. But the smart card is a multi-purpose and tamper-free security device. And behind a standardized interface, the built-in electronics may evolve, in memory size and in processing power. This evolution, while resulting from economic considerations, is in tune with an enhancement of both physical and logical security. Some mechanism in key-carrier cards are described, thus giving a taste of the state of the art in card operating systems. The underlying reality is an invasion of our lifetime by cryptology and computers. This invasion will have a large influence on security in various fields of applications, not only banking operations, but also data processing, information systems, and communication networks.}

\T {Smart Card Applications in Security and Data Protection}
\A {Jean Goutay}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {A Smart Card Implementation of the Fiat-Shamir Identification Scheme}
\A {Hans-Joachim Knobloch}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {This paper describes results and experiences gained from the test implementation of an interactive identification scheme. It was intended to exploit the feasibility of an asymmetric crypto protocol for a state-of-the-art smart card environment. For that reason the identification scheme proposed by Fiat and Sgamir was implemented between an actual smart card microprocessor and an industry standard personal computer with a smart card interface. The limits of a current smart card processor in terms of volatile and nonvolatile memory capacity and instruction set turned out to be a rather strict limitation for the choice of the algorithms used. The most time consuming task during the protocol is modular multiplication and reduction, where reduction is led back to integer multiplication. The current implementation allows the authentication of a 120 byte identification string at a security level of $2^{-20}$ within an average time of about 6 seconds. The experiences gained during this implementation led to a set of requirements for a future specialised processor for asymmetric cryptographic protocols that will be needed to increase this performance by some orders of magnitude.}

\T {Smart Cards}
\A {Robert McIvor}
\J {Scientific American, {\bf 253,} 5}
\D {1985}
\X {Cards containing microcircuitry are more versatile and secure than conventional credit cards. A microelectronic chip must meet severe constraints to function in this unique environment.}

\T {Smart Cards and Conditional Access}
\A {Louis C. Guillou}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Smart cards are introduced through chip design, card interface, and card security. applications are divided in three classes: log books, certified records, key carriers. Conditional access is analyzed with a clear distinction between entitlement checking and entitlement management. The key carrier CP8 card is then described. Smart card technology is examined, and also the probable evolution towards digital signatures.}

\T {Smart Diskette, the: A Universal User Token and Personal Crypto-Engine}
\A {Paul Barrett}
\A {Raymund Eisele}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Societal Vulnerability to Computer System Failures}
\A {Lance J. Hoffman}
\A {Lucy M. Moran}
\J {Computers \& Security, {\bf 5,} 3}
\D {1986}
\X {The world has become more dependent on computers which are active elements in bigger systems in which humans lives depend --- such as critical care units in hospitals, defense systems or air traffic control systems. Hence, the need to assure correct, reliable and safe operation has become more critical. With this need has come an increase in the attention paid to computer systems vulnerabilities and to social vulnerability. While experts disagree over whether society is more vulnerable than resilient to failure of today's increasing interconnected computer and communication systems, the consensus seems to be that, at they very least, the problem bears watching. This paper presents directions for exploring these problems further: a societal risk analysis, a focus on one or more critical computer systems, and the formation of interdisciplinary discussion forums.}

\T {Society and Group Oriented Cryptography: A New Concept}
\A {Yvo Desmedt}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Software Complexity Measurement}
\A {Joseph K. Kearney}
\A {Robert L. Sedlmeyer}
\A {William B. Thompson}
\A {Michael A. Gray}
\A {Michael A. Adler}
\J {C ACM {\bf 29,} 11}
\D {1986}
\X {Arbitrary and inappropriate application of software metrics---in the
absence of a theory of programming behaviour---can be ineffective or even
counterproductive.}

\T {Software Protection: Myth or Reality?}
\A {James R. Gosler}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {Staggering amounts of commercial software are marketed to fulfill needs from the PC explosion. Unfortunately, such software is trivial to duplicate! From the vendors' viewpoint a way to protect profit is needed. Typically, they have resorted to various schemes that attempt to inhibit the duplication process. Although protection of future profit is important, so is protection against current loss. Commercial and business related software must be adequately protected lest data be stolen or manipulated. However, more important than any of these classes is protection of government computer resources, especially classified and operational software and data. Loss of control in this realm could be detrimental to national security. This paper addresses current technologies employed in protection schemes: signatures (magnetic and physical) on floppy disks, Software Analysis Denial (SAD), Hardware Security Devices (HSD), and Technology Denial Concepts (TDC) are presented, with an emphasis on SAD. Advantages and disadvantages of these schemes will be clarified.}

\T {The Solution of a General Equation for the Public Key System}
\A {Ernst Henze}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}

\T {The Solution of the General Equation for Public Key Distribution Systems}
\A {Ernst Henze}
\J {IEEE Trans. on Info. Th. {\bf IT-28,} 6}
\D {1982}
\X {A generalization of the public key distribution is derived. It is shown that the public key of any two members must obey a functional equation, which can be solved in a closed mathematical form.}

\T {A Solution of the Hebern Messages}
\A {Carl M. Ellison}
\J {Cryptologia {\bf XII,} 3, pp. 144--158}
\D {1988}

\T {Solving Low Density Knapsacks}
\A {E.F. Brickell}
\J {Advances in Cryptology---CRYPTO '83, Plenum Press, pp. 25--37}
\D {1984}

\T {Solving Low-Density Subset Sum Problems}
\A {J. C. Lagarias}
\A {A. M. Odlyzko}
\J {Proc. of the 24th IEEE Symp. on Foundations of Comp. Sc. pp. 1--10}
\D {1983}
\J {J ACM {\bf 32,} 1}
\D {1985}
\X {The subset sum problem is to decide whether or not the 0--1 integer
programming problem $\sum_{i=1}^n a_ix_i=M,$ $\forall i,$ $x_i=0$ or 1, has a
solution, where the $a_i$ and $M$ are given positive integers. This problem is
NP-complete, and the difficulty of solving it is the basis of public-key
cryptosystems of knapsack type. An algorithm is proposed that searches for a
solution when given an instance of the subset sum problem. This algorithm
always halts in polynomial time but does not always find a solution when one
exists. It converts the problem to one of finding a particular short vector
{\bf v} in a lattice, and then uses a lattice basis reduction algorithm due to
A.~K.~Lenstra, H.~W.~Lenstra,~Jr., and L.~Lov\'asz to attempt to find {\bf v.}
The performance of the proposed algorithm is analyzed. Let the {\em density\/}
$d$ of a subset sum problem be defined by $d=n/\log_2(\max_i a_i).$ Then for
``almost all'' problems of desnity $d<0.645,$ the vector {\bf v} we searched
for is the shortest nonzero vector in the lattice. For ``almost all'' problems
of density $d<1/n,$ it is proved that the lattice basis reduction algorithm
locates {\bf v.} Extensiver computational tests of the algorithm suggest that
is works for densities $d<d_c(n),$ where $d_c(n)$ is a cutoff value that is
substantially larher than $1/n.$ This method gives a polynomial time attack on
knapsack public-key cryptosystems that can be expected to break them if they
transmit information at rates below $d_c(n),$ as $n\rightarrow\infty.$}

\T {Solving Simultaneous Modular Equations of Low Degree}
\A {Johan Hastad}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {We consider the problem of solving systems of equations $P_i(x)\equiv0(\mod n_i)$ $i=1,\ldots,k$ where $P_i$ are polynomials of degree $d$ and the $n_i$ are distinct relatively prime numbers and $x<\min(n_i).$ We prove that if $k>d(d+1)/2$ we can recover $x$ in polynomial time provided $\min (n_i)>2^{d^2}.$ As a consequence the RSA cryptosystem used with a small exponent is not a good choice to use as a public-key cryptosystem in a large network. We also show that a protocol by Broder and Dolev is insecure if RSA with a small exponent is used.}

\T {Some Applications of Multiple Key Ciphers}
\A {Colin Boyd}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {This paper describes an implementation of a cipher system with any number of keys which is a generalisation of the RSA cryptosystem. Three applications of such a cipher system are given. The general properties required for possible alternative implementations are discussed.}

\T {Some Conditions on the Linear Complexity Profiles of Certain Binary Sequences}
\A {Glyn Carter}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In this paper we consider the binary sequences whose bits satisfy any set of linear equations from a wide class of sets, of which the equations in the perfect profile characterization theorem are typical. We show that the linear complexity profile any such sequence will be restricted in the sense that it will have no jumps of a certain parity above a certain height.}

\T {Some Consequences of the Existence of Pseudorandom Generators}
\A {Eric W. Allender}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {If secure pseudorandom generators exist, then probabilistic computation does not uniformly speed up deterministic computation. If sets in P must contain infinitely many noncomplex strings, then nondeterministic computation does not uniformly speed up deterministic computation. Connections are drawn between pseudorandom generation, generalized Kolmogorov complexity, and immunity properties of complexity classes.}

\T {Some Constructions and Bounds for Authentication Codes}
\A {D. R. Stinson}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Some Constructions For Authentication - Secrecy Codes}
\A {Marijke {De Soete}}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {We deal with authentication/secrecy code having unconditional security. Besides some new results for a ``spoofing attack of order $L$'', we give several constructions using finite incidence structures (designs, generalized quadrangles).}

\T {Some Cryptographic Aspects of Womcodes}
\A {Philippe Godlewski}
\A {G\'erard D. Cohen}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {We consider the following cryptographic and coding questions in relation with the use of ``write-once'' memories (or woms) (1) How to prevent anyone from reusing the wom (immutable codes). (2) How to fix the written information in the wom after a given number of generations (locking codes). (3) How to encode a ``credit'' in a way that guarantees the user $t$ generations of ``purchases'' in any possible way and makes it impossible to cheat: i.e. writing on the wom necessarily increases the spent amount of money. The coding will be called ``{\bf incremental locked}''.}

\T {Some Ideal Secret Sharing Schemes}
\A {Ernest F. Brickell}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {In a secret sharing scheme, a dealer has a secret. The dealer gives each participant in the scheme a share of the secret. There is a set $\Gamma$ of subsets of the participants with the property that any subset of participants that is in $\Gamma$ can determine the secret. In a perfect secret sharing scheme, any subset of participants that is not in $\Gamma$ cannot obtain any information about the secret. We will say that a perfect secret sharing scheme is ideal if all of the shares are from the same domain as the secret. Shamir and Blakley constructed ideal threshold schemes, and Benaloh has constructed other ideal secret sharing schemes. In this paper, we construct ideal secret sharing schemes for more general access structures which include the multilevel and compartmented access structures proposed by Simmons.}

\T {Some Negative Results Concerning Prime Number Generators}
\A {Paul Pritchard}
\J {Technical Report: TR83--542, Cornell University}
\D {1983}
\J {C ACM {\bf 27,} 1}
\D {1984}
\X {Programs written by Wirth and Misra for generating prime numbers are
challenged by new algorithms.}

\T {Some New Classes of Geometric Threshold Schemes}
\A {Marijke {De Soete}}
\A {Klaus Vedder}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {We construct and discuss new infinite classes of $t$-threshold schemes with $t=2$ and 3 which are based on generalized quadrangles. The paper also contains threshold schemes which deal with the case where the group of trustees is made up of mutually distrusting parties.}

\T {Some Public-Key Crypto-Functions As Intractable As Factorization}
\A {H. C. Williams}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Some Remarks on the Cross Correlation Analysis of Pseudo Random Generators}
\A {Sibylle Mund}
\A {Dieter Gollmann}
\A {Thomas Beth}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {Siegenthaler has shown how cross-correlation techniques can be applied to identify pseudo random generators consisting of linear feedback shift registers and a scrambling function. These techniques may allow to attack one registers in a such a generator at a time. The original algorithm needs $O(R2^rN)$ operations to identify one register. ($r$ denotes the length of the register examined, $R$ the number of primitive polynomials of degree $r,$ and $N$ the minimal number of bits one has to observe). Employing Walsh-Hadamard transform this analysis can be done in $O(R(r2^r+N))$ operations. We show that there exists a trade-off between the dimension of the Hadamard matrix and the number of bits required to compute the cross correlation coefficients. The complexity of this attack is $O(R(r2^{r-\delta}+2^\delta N)).$ The integer $\delta$ can be selected so that the cost of the attack is minimized. The MSR-generator will serve as an example to demonstrate our algorithm. Furthermore we examine the correlation immunity of the S-boxes used in the DES.}

\T {Some Results on Kolmogorov-Chaitin Complexity}
\A {David Lawrence Schweizer}
\J {Technical report, 5233:TR:86 (MSc Thesis), California Institute of Technology}
\D {1986}

\T {Some Variants of the Take-Grant Protection Model}
\A {J. Biskup}
\J {Info. Proc. Letters {\bf 19,} 3}
\D {1984}

\T {Some Variations on RSA Signature \& their Security}
\A {Wiebren {de Jonge}}
\A {David Chaum}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {The homomorphic structure of RSA signatures can impair security. Variations on a generalization of RSA signatures are considered with the aim of obviating such vulnerabilities. Of these variations, which involve a function of the message in the exponent, several are shown to have potential weaknesses similar to those of RSA. No attacks have been found for one of the variations. Its security does not depend on redundancy present in or artificially combined with messages. The same holds for a well-known use of RSA that relies on a one-way compression function. A comparison between the schemes is given.}

\T {Sorting Out Zero-Knowledge}
\A {Gilles Brassard}
\A {Claude Cr\'epeau}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {The Space Complexity of the Unique Decipherability Problem}
\A {W. Rytter}
\J {Info. Proc. Letters {\bf 23,} 1}
\D {1986}

\T {Sparse Pseudorandom Distributions}
\A {Oded Goldreich}
\A {Hugo Krawczyk}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Pseudorandom distributions on $n$-bit strings are ones which cannot be efficiently distinguished from the uniform distribution on strings of the same length. Namely, the expected behaviour of any polynomial-time algorithm on a pseudorandom input is (almost) the same as on a random (i.e. uniformly chosen) input. Clearly, the uniform distribution is a pseudorandom one. But do such trivial cases exhaust the notion of pseudorandomness? Under certain intractability assumptions the existences of pseudorandom generators was proven, which in turn implies the existences of non-trivial pseudorandom distributions. In this paper we investigate the existence of pseudorandom distributions, using no unproven assumptions. We show that {\em sparse\/} pseudorandom distributions do exist. A probability distribution is called {\em sparse\/} if it is concentrated on a negligible fraction of the set of all strings (of the same length). It is shown that sparse pseudorandom distributions can be generated by probabilistic (non-polynomial time) algorithms, and some of them are not statistically close to any distribution induced by probabilisitic polynomial-time algorithms. Finally, we show the existence of probabilistic algorithms which induce pseudorandom distributions with {\em polynomial-time evasive\/} support. Any polynomial-time algorithm trying to finds a string in their support will succeed with negligible probability. A consequence of this result is a proof that the original definition of zero-knowledge is not robust under sequential composition. (This was claimed before, leading to the introduction of more robust formulations of zero-knowledge.)}

\T {Special Uses and Abuses of the Fiat-Shamir Passport Protocol}
\A {Yvo Desmedt}
\A {Claude Goutier}
\A {Samy Bengio}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {{\em If\/} the physical description of a person would be unique and adequately used and tested, {\em then\/} the security of the Fiat-Shamir scheme is {\em not\/} based on {\em zero-knowledge. Otherwise\/} some new frauds exist. The Feige-Fiat-Shamir scheme always suffers from these frauds. Using an extended notion of subliminal channels, several other {\em undetectable\/} abuses of the Fiat-Shamir protocol, {\em which are not possible with ordinary passports,} are discussed. This technique can be used by a terrorist sponsoring country to communicate 500 new works of secret information each time a tourist passport is verified. A non-trivial solution to avoid these subliminal channel problems is presented. The notion of {\em relative\/} zero-knowledge is introduced.}

\T {Specification for Message Format for Computer Based Message Systems}
\A {NBS}
\J {RFC 841}
\D {1983}
\X {This RFC is FIPS 98. The purpose of distributing this document as an RFC is to make it easily accessible to the ARPA research community. This RFC does not specify a standard for the ARPA Internet. Explanation. This standard separates information so that a Computer Based Message System can locate and operate on that information (which is found in the fields of messages). This is the first of a family of standards which will ensure information interchange among Computer Based Message Systems.}

\T {Speeding Up Secret Computations with Insecure Auxiliary Devices}
\A {Tsutomu Matsumoto}
\A {Koki Kato}
\A {Hideki Imai}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {This paper deals with and gives some solutions to the problem of how a small device such as a smart card can efficiently execute secret computations using computing power of auxiliary devices like (banking-, telephone-, ...) terminals which are not necessarily trusted. One of the solutions shows that the RSA signatures can be practically generated by a smart card.}

\T {Spycatcher}
\A {Peter Wright}
\J {Viking}
\D {1987}
\X {The candid autobiography of a senior intelligence officer.}

\T {Spymasters Double-Agent Problem: Multiparty Computation Secure Unconditionally from Minorities and Cryptographically from Majorities}
\A {David Chaum}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {A multiparty-computation protocol allows each of a set of participants to provide secret input to a mutually agreed computation. Such protocols enforce two security properties: (1) secrecy of the inputs, apart from what is revealed by the output, and (2) correctness of the output, as defined by the agreed computation. All solutions, including those presented here, are based on two kinds of assumptions: (a) public-key cryptography; and (b) limited collusion in a setting where pairs of participants can exchange messages with secret and authenticated content. Some of the previous solutions relied totally on assumption (a), the others totally on (b). The main result presented here is a protocol that also provides both security properties, (1) and (2), but that does not rely on either assumption (a) or assumption (b) alone---security can be violated only by violating {\em both\/} assumptions. The second construction improves the previously published multiparty computation results based on assumption (b). Let the number of participants be $n,$ the largest tolerable number of disrupters be $d,$ and the largest tolerable number of participants in any collusion be $c.$ (Note that many collusions may exists, even to the extent that all participants are involved, but $c$ is the maximum number of participants in any single collusion.) The construction requires $n>2d+c$ and $n>2c.$ The first inequality gives a trade-off between the number of disrupters and the largest collusion size, which includes the previously achieved case of both less than a third. The second inequality, which means that all collusions of minorities can be tolerated, is argued to be optimal and makes the main result also optimal. A third construction, on which the second is based but which is interesting in its own right, is that of an ``all-honest world.'' This is a setting, relying only on assumption (b), in which any participant who has revealed secrets to any other can prove publicly that the secrets revealed are correct and receivable by the second participant---even if the second participant denies receipt or correctness.}

\T {Standards for Data Security---A Change  of Direction}
\A {Wyn L. Price}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {State of the Art in Public-Key Techniques---Randomness and Redundancy}
\A {L. C. Guillou}
\A {M. Davio}
\A {J.-J. Quisquater}
\J {Annales des Telecommunications {\bf 43,} 9--10, pp.~489--505}
\D {1988}
\X {Article is in French}

\T {Stating Security Requirements with Tolerable Sets}
\A {D. M. Johnson}
\A {F. J. Thayer}
\J {ACM Trans. on Comp. Sys. {\bf 6,} 3, pp. 284--295}
\D {1988}

\T {Statistical Security of a Statistical Data Base}
\A {J. F. Traub}
\A {H. Wozniakowski}
\A {Y. Yemini}
\J {Technical Report: CUCS-36-82, University of Columbia}
\D {1982}

\T {Status Report on Factoring (At the Sandia National Laboratories)}
\A {James A. Davis}
\A {Diane B. Holdridge}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {The Stop-and-Go Generator}
\A {T. Beth}
\A {F. C. Piper}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}

\T {Stream Ciphers}
\A {Fred Piper}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}

\T {The Strict Avalanche Criterion: Spectral Properties of Boolean Functions and an Extended Definition}
\A {R\'ejane Forr\'e}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {A necessary and sufficient condition on the Walsh-spectrum of a boolean function is given, which implies that this function fulfills the Strict Avalanche Criterion. This condition is shown to be fulfilled for a class of functions exhibiting simple spectral symmetries. Finally, an extended definition of the Strict Avalanche Criterion is proposed and the corresponding spectral characterization is derived.}

\T {Strong Practical Protocols}
\A {Judy H. Moore}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {Strong Primality Tests That Are Not Sufficient}
\A {W. Adams}
\A {D. Shanks}
\J {Mathematics of Computation {\bf 39,} pp. 255--300}
\D {1982}

\T {Strong Primes are Easy to Find}
\A {John Gordon}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {A simple method is given for finding {\em strong,} random, large primes of a given number of bits, for use in conjunction with RSA Public Key Cryptosystem. A {\em strong\/} prime $p$ is a prime satisfying: $p=1\mod r,$ $p=s-1\mod s,$ and $r=1\mod t,$ where $r, s$ and $t$ are all large, random primes of a given number of bits. It is shown that the problem of finding {\em strong,} random, large primes is only 19\% harder than finding random, large, primes.}

\T {Strong Signature Schemes}
\A {Shafi Goldwasser}
\A {Silvio Micali}
\A {Andy Yao}
\J {Proceedings of the 15th Annual ACM Symposium on Theory of Computing}
\D {1983}
\X {The notion of digital signature based on trapdoor functions has been introduced by Diffie and Hellman. Rivest, Shamir and Adleman gave the first number theoretic implementation of a signature scheme based on a trapdoor function. If $f$ is a trapdoor function and $m$ a message, $f^{-1}(m)$ is the signature of $m.$ The signature can be verified by computing $f(f^{-1}(m)) = m.$ This approach presents the following problems even when $f$ is hard to invert: (1) there may be special message spaces (or subsets of them) that are easy to sign without knowing the {\em trapdoor\/} information (2) it is possible to forge the signature of random numbers; this violates the requirements of many protocols (3) given a polynomial number of signed messages, it may be possible to sign a new one without knowing the trapdoor information. We solve the above problems by exhibiting two signature schemes for which any strategy of an adversary, who has seen all previously signed messages, that has a moderate success in forging even a single additional signature, is transformable to a fast algorithm for factoring or inverting the RSA function. This provably holds for all message spaces with all possible Probability distributions. This, in particular, given the signature of $m,$ forging the signature of $m+1$ of $2m$ of $2^sm$ is as hard as factoring.}

\T {Structure in the S-Boxes of the DES}
\A {E. F. Brickell}
\A {J. H. Moore}
\A {M. R. Purtill}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {The $S$-boxes used in the DES are the major cryptographic component of the system. Any structure which they possess can have far reaching implications for the security of the algorithm. Structure may exist as a result of design principles intended to strengthen security. Structure could also exist as a ``trapdoor'' for breaking the system. This paper examines some properties which the $S$-boxes satisfy and attempts to determine a reason for such structure to exist.}

\T {A Study of Password Security}
\A {Michael Luby}
\A {Charles Rackoff}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}

\T {The Subliminal Channel and Digital Signatures}
\A {Gustavus J. Simmons}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {In a paper entitled ``The Prisoners' Problem and the Subliminal Channel'', the present author showed that a message authentication without secrecy channel providing $m$ bits of overt communication and $r$ bits of message authentication could be perverted to allow an $l<r$ bit covert channel between the transmitter and a designated receiver at the expense of reducing the message authentication capability to $r-l$ bits, without affecting the overt channel. It was also shown that under quite reasonable conditions the detection of even the existence of this covert channel could be made as difficult as the underlying cryptoalgorithm was difficult to ``break.'' In view of this open---but indetectable---existence, the covert channel was called the ``subliminal'' channel. Examples although adequate to prove the existence of such channels, did not appear to be feasible to extend to interesting communications systems. Fortunately, two digital signature schemes have been proposed since Crypto~83---one by Ong-Schnorr-Shamir based on the difficulty of factoring sufficiently large composite numbers and one by Gamal based on the difficulty of taking discrete logarithms with respect to a primitive element in a finite field---that provide ideal bases for implementing practical subliminal channels. This paper reviews briefly the essential features of the subliminal channel and then discusses implementations in both the Ong-Schnorr-Shamir and Gamal digital signature channels.}

\T {Subliminal-Free Authentication and Signature}
\A {Yvo Desmedt}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {Simmons introduced the notion of subliminal channel in 1983, by demonstrating how to ``hide'' secret information inside an authenticated message. In this paper we propose a practical subliminal-free authentication system and extend our results to subliminal-free signatures. The subliminal-freeness of our systems can be proven. We discuss applications in the context of verification of treaty and international bank communications.}

\T {A Sublinear Additive for Finding Prime Numbers}
\A {Paul Pritchard}
\J {C ACM {\bf 24,} 1}
\D {1981}
\X {A new algorithm is presented for the problem of finding all primes between
2 and $N.$ It is based on Mairson's sieve algorithms which uses $\Theta(N)$
additions and multiplications. The new algorithm improves on this algorithm by
using a dynamic sieve technique that avoids most of the nonprimes in the range
2 to $N$, and by using tabulation method to simulate multiplications. It is
shown to require $\Theta(N/\log\log N)$ additions. A related algorithm is
outlined that has the same complexity but a storage requirement of only
$\Theta(N/\log\log N)$ bits.}

\T {Substantial Number of Cryptographic Keys and its Application to Encryption Designs}
\A {Eiji Okamoto}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {A new concept of the substantial number of cryptographic keys (SNK) in key spaces is proposed and is applied to encryption designs. SNK is defined as the number of keys which is far from each other. It must be greater than $2^{56},$ for instance, to have essentially the same number of keys in DES. This SNK condition restricts design parameters of encryption systems. In this paper, SNK is strictly defined in key spaces, followed by illustrations of SNK's in fundamental encryption systems to decide the design parameters. It is useful for designing product cipher in particular. SNK should be considered as one of the criteria of encipherment strength.}

\T {Subtractive Encryptors---Alternatives to the DES}
\A {D. R. Morrison}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}

\T {Subtransport Level: The Right Place for End-to-End Security Mechanisms}
\A {David P. Anderson}
\A {Domenico Ferrari}
\A {P. Venkat Rangan}
\J {Technical Report: 346, University of California, Berkeley}
\D {1987}

\T {Succinct Certificates for Almost All Subset Sum Problems}
\A {Merrick L. Furst}
\A {Ravi Kannan}
\J {SIAM J. Computing {\bf 18,} 3, pp.~550--558}
\D {1989}
\X {Given $n$ natural numbers $a_1,\ldots,a_n,$ and a target integer $b,$ the {\em SubsetSum\/} problem is to determine whether some subset of the $a_i$ sums to $b.$ That is, to recognize members of the following set $${\rm SubsetSum}=\{\langle a_1,\ldots, a_n;b\rangle|a_i\in\N,b\in\Z\land\exists x\in\{0,1\}^n|a\cdot x=b\}.$$ For a given vector $a=(a_1,\ldots,a_n)$ and integer $b,$ if a subset of the $a_i$ sums to $b,$ then listing which subset provides a short proof that $\langle a;b\rangle\in$SubsetSum. However, in general there are no short (polynomial-length) proofs of nonmembership unless NP equals coNP. The main result in this paper provides a proof system that contains polynomial-length nonmembership proofs for a vast majority of the problem instances that do not belong to SubsetSum.}

\T {Sums of Divisors, Perfect Numbers, and Factoring}
\A {Eric Bach}
\A {Gary Miller}
\A {Jeffrey Shallit}
\J {Proceedings of the 16th Annual ACM Symposium on Theory of Computing}
\D {1984}
\X {Let $N$ be a positive integer, and let $\sigma(N)$ denote the sum of the positive integral divisors of $N.$ We show computing $\sigma(N)$ is equivalent to factoring $N$ in the following sense: there is a random polynomial time algorithm that, given $\sigma(N),$ produces the prime factorization of $N,$ and $\sigma(N)$ can be easily computed given the factorization of $N.$ We show that the same sort of result holds for $\sigma_k(N),$ the sum of the $k$-th powers of divisors of $N.$ We give three new examples of problems that are in Gill's complexity class BPP: $\{${\em perfect numbers\/}$\},$ $\{${\em multiply perfect numbers\/}$\},$ and $\{${\em amicable pairs\/}$\}.$ These are the first ``natural'' candidates for BPP$-$RP.}

\T {A Survey of Data Insecurity Packages}
\A {Martin Kochanski}
\J {Cryptologia {\bf 11,} 1, pp. 1--15}
\D {1987}

\T {A Survey of Hardware Implementations of RSA}
\A {Ernest F. Brickell}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {A Survey of Information Authentication}
\A {Gustavus J. Simmons}
\J {Proc. IEEE, {\bf 76,} 5}
\D {1988}
\X {In both commercial and private transactions, authentication of information (messages) is of vital concern to all of the participants. For example, the party accepting a check usually insists on corroborating identification of the issuer---authentication of the originator, or as wi shall say throughout this paper, the transmitter---and the party issuing the check not only fills in the face amount in numerals, but also writes out the amount in script, and may even go so far as to emboss that part of the check to make it more difficult for anyone to subsequently alter the face amount appearing on an instrument bearing his valid signature, i.e., a primitive means of providing for the later authentication of the communication or message. This example, although it illustrates the two main concerns of the participants in the authentication of information, namely the verification that the communication was originated by the purported transmitter and that it has not subsequently been substituted or altered, fails to illustrate perhaps the most important feature in the current usage of authentication. The information conveyed on the check is inextricably linked to a physical instrument, the check itself, for which there exist legally accepted protocols to establish the authenticity of the signature and the integrity of what the issuer wrote in the event of a later dispute as to whether the check is valid or the signature genuine, independent of the information content (date, amount, etc.) recorded there.
The contemporary concern in authentication, though, is with situations in which the exchange involves only information, i.e., in which there is no physical instrument that can be used to corroborate the authenticity of either the transmitter or of the communication. In deference to the origins of the problem of authentication in a communications context we shall refer to the authenticated information as the message and, as mentioned earlier, to the originator (of a message) as the transmitter. The message, devoid of any meaningful physical embodiment, is presented for authentication by a means that we shall call the authentication channel. This channel is by definition insecure, i.e., all communications that pass through it are public and may even be intercepted and replaced or altered before being relayed on to the intended receiver. In the simplest possible authentication scheme the party receiving the message (the receiver) is also the one wishing to verify its authenticity; although, as we shall see, there are circumstances in which this is not the case.
Authentication, however, is much broader than this communication based terminology would suggest. The information to be authenticated may indeed be a message in a communications channel, but it can equally well be data in a computer file or resident software in a computer; it can be quite literally a fingerprint in the application of the authentication channel to the verification of the identity of an individual or figuratively a ``fingerprint'' in the verification of the identity of a physical object such as a document or a tamper sensing container. In the broadest sense, authentication is concerned with establishing the integrity of information purely on the basis of the internal structure of the information itself, irrespective of the source of that information.}

\T {A Survey of Information Based Complexity}
\A {H. Wozniakowski}
\J {Technical Report: CUCS-181-85, University of Columbia}
\D {1985}

\T {Symmetric Public-Key Encryption}
\A {Zvi Galil}
\A {Stuard Haber}
\A {Moti Yung}
\J {Technical Report: CUCS-191-85, University of Columbia}
\D {1985}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {Public-key encryption would seem to be inherently asymmetric, in that only messages sent to a user can be encrypted using his public key. We demonstrate that the use of interactive protocols for sending encrypted messages enables a {\bf symmetric} use of public keys; we give cryptographic protocols for the following tasks: 1. Probabilisitic encryption, using the same public key, both of messages that are sent to a particular user as well as of messages that the user send to others, without compromising the key. We propose a public-key cryptosystem based on these protocols which has only {\bf one} key, owned by a cryptographic server. 2. Authentication both of the sender and of the receiver of a probabilistically encrypted message. 3. Probabilistic encryption which is provably secure against both chosen-message and chosen-ciphertext attack.}

\T {T7001 Random Number Generator}
\A {AT\&T}
\J {Data Sheet, AT\&T}
\D {1986}

\T {T7002/T7003 Bit Slice Multiplier}
\A {AT\&T}
\J {Product announcement, AT\&T}
\D {1987}

\T {The Tea-Leaf Reader Algorithm: An Efficient Implementation of CRC-16 and CRC-32}
\A {Georgia Griffiths}
\A {G. Carlyle Stones}
\J {CACM {\bf 30,} 7}
\D {1989}
\X {The tea-leaf reader CRC algorithms are error-detection algorithms that use a load-ahead table to increase execution speed.}

\T {Technical Security: The Starting Point}
\A {Jan {van Auseloos}}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Cryptographic security measures for encryption, authentication, non repudiation are important ... but not sufficient. My intention is to make the reader aware of non-technical security issues.}

\T {Theft of Information in the Take-Grant Protection Model}
\A {Matt Bishop}
\J {Darmouth College Computer Science Technical Report PCS-TR88-137}
\D {1988}
\X {Questions of information flow are in many ways more important than questions of access control, because the goal of many security policies is to thwart the unauthorized release of information, not merely the illicit obtaining of access rights to that information.  The Take-Grant Protection Model is an excellent theoretical tool for examining such issues because conditions necessary and sufficient for information to flow between  tow objects, and for rights to object to be obtained or stolen, are known.  In this paper we extend these results by examining the question of information flow from an object the owner of which is unwilling to release that information.  Necessary and sufficient conditions for such ``theft of information'' to occur are derived, and bounds on the number of subjects that 
must take action for the theft to occur are presented.  To emphasize the usefulness of these results, the security policies of complete isolation,transfer of rights with the cooperation of an owner, and transfer of information (but not rights) with the cooperation of the owner are presented; the last is used to model a simple reference monitor guarding a 
resource.}

\T {Theory and Applications of Trapdoor Functions}
\A {A. C.-C. Yao}
\J {Proc. of the 23rd IEEE Symp. on Foundations of Comp. Sc.}
\D {1982}

\T {Theory and Practice of Error Control Coding}
\A {R. Blahut}
\J {Addison-Wesley}
\D {1983}

\T {Thomas---A Complete Single Chip RSA Device}
\A {Gordon Rankine}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {This paper examines a novel implementation of a 512-bit modulus exponentiator for applications in RSA key management environments. The device, known by the internal project code THOMAS, is a complete single chip RSA implementation. No other device is necessary to compute the RSA components, other than the control elements associated with the crypto-system. The approach chosen is examined to establish the benefits from the implementation in comparison with potentially faster but less flexible techniques.}

\T {Three Applications of the Oblivious Transfer: Part~I: Coin Flipping By Telephone; Part~II: How to Exchange Secrets; Part~III: How to Send Certified Electronic Mail}
\A {M. Blum}
\J {Dept. of EECS, Univ. of California, Berkeley, CA}
\D {1981}

\T {Threshold Cryptosystems}
\A {Yvo Desmedt}
\A {Yair Frankel}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In a society orientated cryptography it is better to have a public key for the company (organization) than having one for each individual employee. Certainly in emergency situation, power is shared in many organizations. Solutions to this problem were presented but are completely impractical and interactive. In this paper practical non-interactive public key systems are proposed with allow the reuse of the shared secret key since the key is not revealed either to insiders or outsiders.}

\T {Time-Division Multiplexing Scramblers: Selecting Permutations and Testing the System}
\A {A. Ecker}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Selecting permutations for speech scrambling with t.d.m. means to define a suitable weight-function or metric on $S_n$ (the full symmetric group). This can be done in a lot of different ways. We study some of that weight-functions and point out which one should be preferred. An algorithm is given to generate permutations with a prescribed weight. Some hints are given how to compute approximately the distribution function of some weight-functions. Finally rank correlation methods are recommended for testing a t.d.m-system.}

\T {A Time-Luck Tradeoff in Relativized Cryptography}
\A {Gilles Brassard}
\J {J. of Computer and System Sciences, {\bf 22.}}
\D {1981}
\X {New definitions are proposed for the security of Transient-Key Cryptography (a variant on Public-Key Cryptography) that account for the possibility of super-polynomial-time Monte Carlo cryptanalytical attacks. Weaker definitions no longer appear to be satisfactory in the light of Adleman's recent algorithm capable of breaking the Diffie-Hellman scheme in RTIME$(O(2^{O(\sqrt{n\log n})})$ for keys of length $n.$ The basic question we address is: How can one relate the amount of time a cryptanalyst is willing to spend decoding cryptograms to his likelihood of success? What more can one say than the obvious ``The more time he uses, the less lucky he needs to be?'' These questions and others are partially answered in a relativized model of computation in which there exists a transient-key cryptosystem such that even a cryptanalyst willing to spend as much as (almost) $O(2^{n/\log n})$ steps on length $n$ cryptograms cannot hope to break but an exponentially small fraction of them, even if he is allowed to make use of a true random number generator. This is rather tight because the same cryptosystem falls immediately if the cryptanalyst is willing to spend $O(2^{cn})$ steps for any constant $c>0.$}

\T {Time-Memory-Processor Tradeoffs}
\A {Hamid R. Amirazizi}
\A {Martin E. Hellman}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {Extended abstract of Crypto'81 presentation.}

\T {A Time-Randomness Tradeoff For Oblivious Routing}
\A {Danny Krizanc}
\A {David Peleg}
\A {Eli Upfal}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Three parameters characterize the performance of a probabilistic algorithm: $T,$ the run-time of the algorithm; $Q,$ the probability that the algorithm fails to complete the computation in the first $T$ steps and $R,$ the amount of randomness used by the algorithm, measured by the entropy of its random source. We present a tight tradeoff between these three parameters for the problem of oblivious packet routing on $N$-vertex bounded-degree networks. We prove a $(1-Q)\log{N\over T}-\log Q - O(1)$ lower bound for the entropy of a random source of any oblivious packet routing algorithm that routes an arbitrary permutation in $T$ steps with probability $1-Q.$ We show that this lower bound is almost optimal by proving the existence, for every $e^3\log N\le T\le N^{1\over2},$ of an oblivious algorithm that terminates in $T$ steps with probability $1-Q$ and uses $(1-Q+o(1))\log{N\over T}-\log Q$ independent random bits. We complement this result with an explicit construction of a family of oblivious algorithms that use less than a factor of $\log N$ more random bits than the optimal algorithm achieving the same run-time.}

\T {Timestamps in Key Distribution Protocols}
\A {Dorothy E. Denning}
\A {Giovanni Maria Sacco}
\J {C ACM {\bf 24,} 8}
\D {1981}
\X {The distribution of keys in a computer network using single key or public
key encryption is discussed. We consider the possibility that communication
keys may be compromised, and show that key distribution protocols with
timestamps prevent replays of compromised keys. The timestamps have the
additional benefit of replacing a two-step handshake.}

\T {Towards a Strong Communication Complexity Theory or Generating Quasi-Random Sequences from Two Communicating Slightly-random Sources}
\A {Umesh V. Vazirani}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}

\T {Towards a Theory of Software Protection}
\A {Oded Goldreich}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {Software protection is one of the most important issues concerning computer practice. The problem is to sell programs that can be executed by the buyer, yet cannot be duplicated and/or distributed by him to other users. There exist many heuristic and ad-hoc methods for protection, but the problem as a whole did not receive the theoretical treatment it deserves. In this paper, we make the first steps towards a theoretic treatment of software protection: First, we distill and formulate the key problem of {\em learning about a program from its execution.} Second, we present an {\em efficient\/} way of executing programs (i.e. a interpreter) such that it is infeasible to learn anything about the program by monitoring its executions. A scheme that protects against duplication follows. How can one efficiently execute programs without allowing an adversary, monitoring the execution, to learn anything about the program? Current cryptographic techniques can be applied to keep the content of the memory unknown throughout the execution, but are {\em not applicable\/} to the problem of hiding the access pattern. Hiding the access pattern {\em efficiently\/} is the essence of our solution. We show how to implement (on-line and in an ``oblivious manner'') $t$ fetch instructions to a memory of size $m$ by making less than $tm^\epsilon$ actual accesses, for every fixed $\epsilon>0.$}

\T {Towards a Theory of Software Protection and Simulation by Oblivious RAMs}
\A {Oded Goldreich}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {Software protection is one of the most important issues concerning computer practice. The problem is to sell programs that can be executed by the buyer, yet cannot be duplicated and/or distributed by him to other users. There exist many heuristic and ad-hoc methods for protection, but the problem as a whole did not receive the theoretical treatment it deserves. In this paper, we make the first steps towards a theoretic treatment of software protection: First, we distill and formulate the key problem of {\em learning about a program from its execution.} Second, we present an {\em efficient\/} way of executing programs (i.e. a interpreter) such that it is infeasible to learn anything about the program by monitoring its executions. How can one efficiently execute programs without allowing an adversary, monitoring the execution, to learn anything about the program? Traditional cryptographic techniques cane be applied to keep the contents of content of the memory unknown throughout the execution, {\em but\/} are {\em not applicable\/} to the problem of hiding the access pattern. The problem of hiding the access pattern {\em efficiently\/} corresponds to {\em efficient\/} simulation of Random Access Machines (RAM) on an oblivious RAM. We define an {\em oblivious RAM\/} to be a (probabilistic) RAM for which (the distribution of) the memory access pattern is independent of the input. We present an (on-line) simulation of $t$ steps of an arbitrary RAM with $m$ memory cells, be less than $t\cdot m^\epsilon$ steps of an oblivious RAM with $2m$ memory cells, where $\epsilon>0$ is an arbitrary constant.}

\T {Trading Group Theory for Randomness}
\A {L\'aszl\'o Babai}
\J {Proceedings of the 17th Annual ACM Symposium on Theory of Computing}
\D {1985}
\X {In a previous paper we proved, using the elements of the theory of {\em nilpotent groups,} that some of the {\em fundamental computational problems in matrix groups\/} belong to $NP.$ These problems were also shown to belong to $coNP,$ assuming an {\em unproven hypothesis\/} concerning {\em finite simple groups.} The aim of this paper is to replace most of the (proven and unproven) group theory by elementary combinatorial arguments. The result we prove is that relative to a {\em random oracle\/} $B,$ the mentioned matrix group problems belong to ($NP\cap coNP)^B.$ The problems we consider are {\em membership\/} in and {\em order\/} of a matrix group given by a list of generators. These problems can be viewed as multidimensional versions of a close relative of the discrete logarithm problem. Hence $NP\cap coNP$ might be the lowest natural complexity class they may fit in. We remark that the results remain valid for {\em black box groups\/} where group operations are performed by an oracle. The tools we introduce seem interesting in their own right. We define a new hierarchy of complexity classes $AM(k)$ ``just above $NP$'', introducing {\em Arthur vs. Merlin games,} the bounded-away version of Papadimitriou's {\em Games against Nature.} We prove that in spite of their analogy with the polynomial time hierarchy, the finite levels of this hierarchy collapse to $AM=AM(2).$ Using a combinatorial lemma on finite groups, we construct a game by which the nondeterministic player (Merlin) is able to convince a random player (Arthur) about the relation $|G|=N$ provided Arthur trusts conclusions based on statistical evidence (such as a Solovay-Strassen type ``proof'' of primality). One can prove that $AM$ consists precisely of those languages which belong to $NP^B$ for almost every oracle $B.$ Our hierarchy has an interesting, still unclarified relation to another hierarchy, obtained by removing the central ingredient from {\em User vs. Expert games\/} of Goldwasser, Micali and Rackoff.}

\T {Transaction Protection by Beacons}
\A {Michael O. Rabin}
\J {J. of Computer and System Sciences {\bf 27,} pp. 256--267}
\D {1983}
\X {Protocols for implementing contract signing, confidential disclosures, and
certified mail in an electronic mail system are proposed. These transactions
are provably impossible without a trusted intermediary. However, they can be
implemented with just a small probability of a participant cheating his
partner, by use of a beacon emitting random integers. Applications include
privacy protection of personal information in data banks, as well as the
protection of business transactions.}

\T {Transborder Data Flow: A Corporate Concern}
\A {Janet Palmer}
\A {Andria Page Dukes}
\J {AFIPS Conference Proceedings {\bf 55,} National Computer Conference}
\D {1986}
\X {The growing worldwide trend for legislative control of transborder data
flow (TBDF) has serious implications for multinational corporations (MNCs). The
free flow of information is vital to MNCs for competing in the network
marketplace. Data legislation orginally enacted to protect individual privacy
has been extended to include national protectionism. This evolution occured as
nations began to perceive information as a national resource. Cultural and
political ideologies entwined to form a new communication ideology, justifying
a nation's right to information sovereignty. To counteract the rresulting
effects of restrictive data legislation, multinational corporations need to
develop strategies at the internation, national, and corporate levels before
the transborder data flow issue reaches the crisis stage. Without resolving the
transborder data flow conflict, the future of global communications is at stake
as well as the economic development of multinational corporations and nations.}

\T {Transborder Data Flow: Legal Persons In Privacy Protection Legislation}
\A {Susan H. Nycum}
\A {Susan Courtney-Saunders}
\J {AFIPS Conf. Proc. National Computer Conference, {\bf 49}}
\D {1980}

\T {Trapdoor Knapsacks Without Superincreasing Structure}
\A {M. Willett}
\J {Info. Proc. Letters {\bf 17,} 1}
\D {1983}
\X {Shamir has recently presented a polynomial-time algorithm for breaking
Merkle-Hellman public-key schemes. The flaw in such a scheme is not in the use
of knapsacks per se, but in the embedding of superincreasing structure as a
trapdoor technique. In this paper, several trapdoor techniques are outlined
that are not dependent on hiding superincreasing sequences.}

\T {A Trapdoor Multiple Mapping}
\A {Benjamin Arazi}
\J {IEEE Trans. on Info. Th. {\bf IT-26,} 1}
\D {1980}
\X {A public key cryptosystem is suggested in which a message is enciphered by adding its numerical value to a sum of elements selected randomly from a publicly known knapsack, thus enabling multiple mapping of the message. Data expansion is moderate while reasonable security is maintained. Since the selected knapsack elements are message-independent, the encryption is very fast.}

\T {Trapdoor Pseudo-random Number Generators With Applications to Protocol Design}
\A {U. V. Vazirani}
\A {V. V. Vazirani}
\J {Proc. of the 24th IEEE Sym. on the Foundations of Comp. Sc. pp. 23--30}
\D {1983}

\T {Trapdoor Rings and Their Use in Cryptography}
\A {V. Varadharajan}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {This paper examines possible trapdoor structures which can be used to design public key cryptosystems based on the factorization problem. Some examples of such finite trapdoor systems which might serve as a basis for an extended RSA cryptosystem are proposed.}

\T {Trapdoors in Knapsack Kryptosystems}
\A {R. Eier}
\A {H. Lagger}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {A way to attack public-key cryptosystems based on the knapsack problem is proposed. The basic idea of the approach described is to find pairs of natural numbers, namely values for a modulus $\overline{m}$ and a multiplier $\overline{w},$ which reduce the knapsack elements simultaneously by modular multiplication. The ratio $\overline{r} = \overline{w}/\overline{m}$ plays an overriding role.}

\T {Trusted Computer System Evaluation Criteria}
\A {{Department of Defense}}
\J {CSC--STD--001--83}
\D {1983}
\X {This publication, "Department of Defense Trusted Computer System Evaluation
Criteria," is being issued by the DoD Computer Security Center under the
authority of and in accordance with DoD Directive 5215.1, "Computer Security
Evaluation Center." The criteria defined in this document constitute a uniform
set of basic requirements and evaluation classes for assessing the
effectiveness of security controls built into Automatic Data Processing (ADP)
systems.  These criteria are intended for use in the evaluation and selection
of ADP systems being considered for the processing and/or storage and
retrieval of sensitive or classified information by the Department of Defense.
Point of contact concerning this publication is the Office of Standards and
Products, Attention: Chief, Computer Security Standards.}

\T {Trust Relationships: Naming and Secure Communication in Large Distributed Computer Systems}
\A {P. Venkat Rangan}
\J {Technical Report: 456, University of California, Berkeley}
\D {1989}

\T {Turing Machines}
\A {John E. Hopcroft}
\J {Scientific American, {\bf 250,} 5}
\D {1984}
\X {At is logical base every digital computer embodies one of these pencil-and-paper devices invented by the British mathematician A.M.~Turing. The machines mark off the limits of computation.}

\T {The Turing Omnibus: 61 Excursions in Computer Science}
\A {A. K. Dewdney}
\J {Computer Science Press}
\D {1989}

\T {Two Infinite Sets of Primes with Fast Primality Tests}
\A {Janos Pintz}
\A {William L. Steiger}
\A {Endre Szemer\'edi}
\J {Proceedings of the 20th Annual ACM Symposium on Theory of Computing}
\D {1988}
\X {Infinite sets $P$ and $Q$ of primes are described, $P\subset Q.$ For any natural number $n$ it can be decided if $n\in P$ in (deterministic) time $O((\log n)^9).$ This answers affirmative the question of whether there exists an infinite set of primes whose membership can be tested in polynomial time, and is the main result of the paper. Also, for every $n\in Q,$ we show how to produce at random, in expected time $O((\log n)^3),$ a certificate of length $O(\log n)$ which can be verified in (deterministic) time $O((\log n)^3);$ this is less than the time needed for two exponentiations and is much faster than existing methods. Finally it is important that $P$ is relatively dense (at least $cn^{2/3}/\log n$ elements less than $n$). Elements of $Q$ in a given range may be generated quickly, but it would be costly for an adversary to search $Q$ in this range; this could be useful in cryptography.}

\T {Two New Secret Key Cryptosystems}
\A {Henk Meijer}
\A {Selim Akl}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Two Observations on Probabilistic Primality Testing}
\A {Pierre Beauchemin}
\A {Gilles Brassard}
\A {Claude Cr\'epeau}
\A {Claude Goutier}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Two Remarks Concerning the Goldwasser-Micali-Rivest Signature Scheme}
\A {Oded Goldreich}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {The focus of this note is the {\bf G}oldwasser-{\bf M}icali-{\bf R}ivest Signature Scheme. The GMR scheme has the salient property that, unless factoring is easy, it is infeasible to forge any signature even through an adaptive chosen message attack. We present two technical contributions with respect to the GMR scheme: 1) {\em The GMR scheme can be made totally ``memoryless'':\/} That is, the signature generated by the signer on message $M$ does not depend on the previous signed messages. (In the original scheme, the signature to a message depends on the number of messages signed before.) 2. {\em The GMR scheme can be implemented almost as efficiently as the RSA:\/} The original implementation of the GMR scheme based on factoring, can be speeded-up by a factor of $|N|.$ Thus, both signing and verifying take time $O(|N|^3\log^2|N|).$ (Here $N$ is the moduli.)}

\T {Two Theorems on Time Bounded Kolmorogov-Chaitin Complexity}
\A {David Schweizer}
\J {Technical report, 5205:TR:85, California Institute of Technology}
\D {1985}

\T {Unbiased Bits from Sources of Weak Randomness and Probabilistic Communication Complexity}
\A {Benny Chor}
\A {Oded Goldreich}
\J {SIAM Journal of Computing, {\bf 17,} 2, pp. 194++}
\D {1988}
\X {A new model for weak random physical sources is presented. The new model strictly generalizes previous models (e.g., the Santha and Vazirani model). The sources considered output strings according to probability distributions in which {\em no single string is too probable.} The new model provides a fruitful viewpoint on problems studied previously such as: $\bullet$ {\em Extracting almost-perfect bits from sources of weak randomness.} The question of possibility as well as the question of efficiency of such extraction schemes is addressed. $\bullet$ {\em Probabilistic communication complexity.} It is shown that most functions have linear communication complexity in a very strong probabilistic sense. $\bullet$ {\em Robustness of BPP\/} with respect to sources of weak randomness (generalizing a result of Vazirani and Vazirani).}

\T {Unconditionally Secure Authentication Schemes and Practical and Theoretical Consequences}
\A {Yvo Desmedt}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {The Vernam scheme protects the privacy unconditionally, but is completely insecure to protect the authenticity of a message. Schemes will be discussed in this paper that protect the authenticity unconditionally. The definition of unconditional security is defined. Stream cipher authentication schemes are proposed. The consequences on information protection using RSA and DES are discussed.}

\T {Unconditional Sender and Recipient Untraceability in Spite of Active Attacks}
\A {Michael Waidner}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {A protocol is described which allows to send and receive messages anonymously using an arbitrary communication network, and it is proved to be unconditionally secure. This improves a result by Chaum: The DC-net guarantees the same, but on the assumption of a reliable broadcast network. Since unconditionally secure Byzantine Agreement cannot be achieved, such a reliable broadcast network cannot be realized by algorithmic means. The solution proposed here, the DC$^+$-net, uses the DC-net, but replaces the reliable broadcast network by a fail-stop one. By choosing the keys necessary for the DC-net dependently on the previously broadcast messages, the fail-stop broadcast can be achieved unconditionally secure and without increasing the complexity of the DC-net significantly, using an arbitrary communication network.}

\T {Undeniable Signatures}
\A {David Chaum}
\A {Hans {van Antwerpen}}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}

\T {Unique Extrapolation of Polynomial Recurrences}
\A {Jeffrey C. Lagarias}
\A {James A. Reeds}
\J {SIAM J. on Computing, {\bf 17-2.}}
\D {1988}
\X {Let a sequence of $k$-dimensional vectors ${\bf x}_0, {\bf x}_1,\ldots$ (over a ring $A$) be determined by a polynomial recurrence of form ${\bf x}_n = T({\bf x}_{n-1}),$ where $T:A^k\rightarrow A^k$ itself is known to be a polynomial map in $k$ variables of degree at most $d$ but is otherwise unknown. We show that there is a finite $N$ such that the entire sequence $\{{\bf x}_n:n\ge0\}$ can be deduced from the first $N+1$ terms ${\bf x}_0, {\bf x}_1, \ldots, {\bf x}_N$ alone. The number $N=\phi(d,k,A)$ depends on $d$ and $k$ and the ring $A$ but not on $T.$ Let $\phi^*(d,k)$ denote the maximum of $\phi(d,k,A)$ over all commutative rings with unit. Then we show that $\phi^*(d,k)<\infty.$ In particular, $\phi^*(d,1)=d+1$ and $\phi^*(1,k)=k+1.$ In the general case $\phi^*(d,k)\ge{k+d\choose k}$ and equality does not always hold because $\phi^*(2,2)\ge7.$ In addition, we show that for each $k$ that $\max\{\phi(d,k,{\bf F}):{\bf F}\ \mbox{a field}\}$ is bounded by a polynomial in $d.$ These results are applied to the problem of correctly extrapolating the values $\{{\bf x}_i:i\ge0\}$ of an unknown polynomial recurrence ($\mod M$) in $k$ variables of degree at most $d,$ where $d$ and $k$ are known and $M$ is not known. A polynomial-time algorithm is given which computes a value $\hat{\bf x}_{n+1}$ given the values $\{{\bf x}_i:0\le i\le n\}$ of such a recurrence as input, and it is shown that $\hat{\bf x}_{n+1}\ne{\bf x}_{n+1}$ for at most $1+\phi^*(d,k)+\log(M^{dN}N^{{1\over2}N})$ values of $n,$ where $N=1+k{k+d\choose k}.$}

\T {United-States Soviet Security Cooperation: Achievements, Failures, Lessons}
\A {A. L. George}
\A {P. J. Farley}
\A {A. Dallin}
\J {Science {\bf 241,} pp. 1517--1518}
\D {1988}

\T {A Universal Algorithm for Homophonic Coding}
\A {Christoph G. G\"unther}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {This contribution describes a coding technique which transforms a stream of message symbols with an arbitrary frequency distribution into a uniquely decodable stream of symbols which all have the same frequency.}

\T {Universal One-Way Hash Functions and their Cryptographic Applications}
\A {Moni Naor}
\A {Moti Yung}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {We define a {\em Universal One-Way Hash Function\/} family, a new primitive which enables the compression of elements in the function domain. The main property of this primitive is that given an element $x$ in the domain, it is computationally hard to find a different domain element which collides with $x.$ We prove constructively that universal one-way hash functions exist if any 1-1 one-way functions exist. Among the various applications of the primitive is a {\em One-Way based Secure Digital Signature\/} Scheme, a system which is based on the existence of any 1-1 One-way Functions and is secure against the most general attack known. Previously, all provably secure signature schemes were based on the stronger mathematical assumption that {\em trapdoor\/} one-way functions exist.}

\T {A Universal Problem in Secure and Verifiable Distributed Computation}
\A {Ming-Deh A. Huang}
\A {Shang-Hua Teng}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {A notion of {\bf reduction} among multi-party distributed computing problems is introduced and formally defined. Here the reduction from one multi-party distributed computing problem to another means, roughly speaking, a secure and verifiable protocol for the first problem can be constructed solely from a secure and verifiable protocol of the second. A {\bf universal} of {\bf complete} multi-party distributed computing problem is defined to be one to which the whole class of multiparty problems is reducible. One is interested in finding a simple and natural multi-party problem which is universal. The {\em distributed sum problem,} of summing secret inputs from $N$ parties, is shown to be such a universal problem. The reduction yields an efficient systematic method for the automatic generation of secure and verifiable protocols for all multi-party distributed computing problems. Incorporating other results, it also yields an alternative proof to the completeness theorem that assuming honest majority and the existence of a trap-door function, for all multi-party problems, there is a secure and verifiable protocol.}

\T {UNIX Password Security -- Ten Years Later}
\A {David C. Feldmeier}
\A {Philip R. Karn}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {Passwords in the UNIX operating system are encrypted with the {\em crypt\/} algorithm and kept in the publicly-readable file /etc/passwd. This paper examines the vulnerability of UNIX to attacks on its password system. Over the past 10 years, improvements in hardware and software have increased the crypts/second/dollar ratio by five orders of magnitude. We reexamine the UNIX password system in light of these advances and point out possible solutions to the problem of easily found passwords. The paper discusses how the authors built some high-speed tools for password cracking and what elements were necessary for their success. These elements are examined to determine if any of them can be removed from the hands of a possible system infiltrator, and thus increase the security of the system. We conclude that the single most important step that can be taken to improve password security is to increase password entropy.}

\T {Untraceable Electronic Cash}
\A {David Chaum}
\A {Amos Fiat}
\A {Moni Naor}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms}
\A {David L. Chaum}
\J {C ACM {\bf 24,} 2}
\D {1981}
\X {A technique based on public key cryptography is presented that allows an
electronic mail system to hide who a participant communicates with as well as
the content of the communication----in spite of an unsecured underlying
telecommunication system. The technique does not require a universally trusted
authority. One correspondent can remain anonymous to a second, while allowing
the second to respond via an untraceable return address. The technique can also
be used to form rosters of untraceable digital pseudonyms from selected
applications. Applicants retain the exclusive ability to form digital
signatures corresponding to their pseudonyms. Elections in which any interested
party can verify that the ballots are signed with pseudonyms from a roster of
registered voters. Another use allows an individual to correspond with a
record-keeping organization under a unique pseudonym which appears in a roster
of acceptable clients.}

\T {An Update on Quantum Cryptography}
\A {Charles H. Bennett}
\A {Gilles Brassard}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}

\T {Upper Bounds on the Complexity of Space Bounded Interactive Proofs}
\A {Anne Condon}
\A {Richard J. Lipton}
\J {Computer Science Technical Report TR 841, University of Wisconsin}
\D {1989}
\X {We show that the class $IP(2pfa)$ of languages accepted by interactive proof systems with finite state verifiers is contained in $ATIME2^{2^{O(n)}}$. We also show that 2-prover interactive proof systems with finite state verifiers accept exactly the recursive languages. Our results generalize to other space bounds. We also obtain some results of independent interest on the rate of convergence of time-varying Markov chains and of non-Markov chains, called feedback chains, to their halting states.}

\T {Use of Elliptic Curves in Cryptography}
\A {Victor S. Miller}
\J {Advances in Cryptology---CRYPTO '85, Proceedings, Lecture Notes in Computer Science (218), Springer-Verlag}
\D {1985}
\X {We discuss the use of elliptic curves in cryptography. In particular, we propose an analogue of the Diffie-Hellman key exchange protocol which appears to be immune from attacks of the style of Western, Miller, and Adleman. With the current bounds for infeasible attack, it appears to be about 20\% faster than the Diffie-Hellman scheme over $GF(p).$ As computational power grows this disparity should get rapidly bigger.}

\T {The Use of Encryption in Kerberos for Network Authentication}
\A {John T. Kohl}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {In a workstation environment, the user often has complete control over the workstation. Workstation operating systems therefore cannot be trusted to accurately identify their users. Some other method of authentication is needed, and this motivated the design and implementation of the Kerberos authentication service. Kerberos is based on the Needham and Schroeder trusted third-party authentication model, using private-key encryption. Each user and network server has a key (like a password) known only to it and the Kerberos database. A database server uses this knowledge to authenticate network entities to one another. The encryption used to achieve this authentication, the protocols currently in use and the protocols proposed for future use are described.}

\T {The Use of Fractions in Public-Key Cryptosystems}
\A {Hartmut Isselhorst}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {This paper discusses an asymmetric cryptosystem based on fractions, the $R^k$-system, which can be implemented fast using only additions and multiplications. Also it is very simple to initialize the system and to generate new keys. The $R^k$-system makes use of the difficulty to compute the numerator and the denumerator of a fraction only knowing the rounded floating point representation. It is also based on the difficulty of a simultaneous diophantine approximation with many parameters and only a little error bound.}

\T {The Use of Public-Key Cryptography for Signing Checks}
\A {L. Longpre\'e}
\J {Advances in Cryptology---CRYPTO '82, Proceedings, Plenum Press, pp. 187--197}
\D {1983}

T {A User Authentication Scheme for Shared Data Based on a Trap-door One-way
Function}
\A {I. Ingemarsson}
\A {C. K. Wong}
\J {Info. Proc. Letters {\bf 12,} 2}
\D {1981}

\T {User Functions for the Generation and Distribution of Encipherment Keys}
\A {R. W. Jones}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {It is generally accepted that data encipherment is needed for secure distributed data processing systems. It is accepted, moreover, that the enciphering algorithms are either published or must be assumed to be known to those who wish to break the security. Security then lies in the safe keeping of the encipherment keys, which must be generated and stored securely and distributed securely to the intending users. At an intermediate level of detail of a system it may be useful to have functions which manipulate keys explicitly but which hide some of the details of key generation and distribution, both for convenience of use and so that new underlying techniques can be developed. This papers offers a contribution to the discussion. It proposes key manipulation functions which are simple from the user's point of view. It seeks to justify them in terms of the final secure applications and discusses how they may be implemented by lower level techniques described elsewhere. The relationship of the functions to telecommunications standards is discussed and a standard form is proposed for encipherment key information.}

\T {Using Algorithms As Keys In Stream Ciphers}
\A {Neal R. Wagner}
\A {Paul S. Putter}
\A {Marianne R. Cain}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}
\X {This paper discusses the use of an arbitrary bit-sequence generating algorithm as the cryptographic key for a stream cipher. Emphasis is placed on methods for combining stream generators into more complex ones, with and without randomization. Threshold schemes give a generalization of many combination techniques.}

\T {A Variant of a Public Key Cryptosystem Based on Goppa Codes}
\A {John P. Jordan}
\J {SIGACT News, {\bf 15,} 1}
\D {1983}
\X {This paper suggests a way in which an interesting Public Key Cryptosystem based on Goppa Codes introduced by R. J. McEliece can be modified and used in a classical way to yield several advantages. The primary benefit is that the rate of the code (or data expansion reciprocal) can be increased by approximately 75\%. Secondly (for public key and classical versions), by using a polynomial with no linear or repeated factors instead of an irreducible one to generate the Goppa Code, the code parameters remain the same and the decoding apparatus can be used to test candidate generators. Lastly, a wider range of transformations is made possible. No degradation in security is incurred.}

\T {Varying Feedback Shift Registers}
\A {Yves Roggeman}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {The Verifiability of Two-Party Protocols}
\A {Ronald V. Book}
\A {Friedrich Otto}
\J {Advances in Cryptology---EUROCRYPT '85, Proceedings, Lecture Notes in Computer Science (219), Springer-Verlag}
\D {1985}

\T {Verifiable Disclosure of Secrets and Applications}
\A {Claude Cr\'epeau}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {A ${2\choose1}$-Oblivious Bit Transfer protocol is a way for a party Rachel to get one bit from a pair $b_0,b_1$ that another party Same offers her. The difficulty is that Sam should not find out which secret Rachel is getting while Rachel should not be able to get partial information about more than one of the bits. This paper shows a way to make ``verifiable'' this protocol (v-${2\choose1}$-Oblivious Bit Transfer) and shows that it can be used to directly achieve oblivious circuit evaluation and fair exchange of bits, assuming the existence of a non-verifiable version of the protocol.}

\T {Verifiable Secret-Ballot Elections}
\A {J. C. Benaloh}
\J {Ph.D. diss. Yale University, YALEU/DCS/TR-5?}
\D {1987}

\T {Verifiable Secret Sharing and Multiparty Protocols with Honest Majority}
\A {Tal Rabin}
\A {Michael Ben-Or}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {Under the assumption that each participant can broadcast a message to all other participants and that each pair of participants can communicate secretly, we present a verifiable secret sharing protocol, and show that any multiparty protocol, or game with incomplete information, can be achieved if a majority of the players are honest. The secrecy achieved is unconditional and does not rely on any assumption about computational intractability. Applications of these results to Byzantine Agreement are also presented. Underlying our results is a new tool of Information Checking which provides authentication without cryptographic assumptions and may have wide applications elsewhere.}

\T {Verification of Information in a File}
\A {Jainendra K. Navlakha}
\J {AFIPS Conf. Proc. National Computer Conference, {\bf 49}}
\D {1980}

\T {Verification of Treaty Compliance---Revisited}
\A {G. J. Simmons}
\J {Proc. of the 1983 IEEE Symp. on Security and Privacy, pp. 61--66}
\D {1983}

\T {Verifying Security}
\A {Maureen Harris Cheheyl}
\A {Morrie Gasser}
\A {George A. Huff}
\A {Jonathan K. Millen}
\J {ACM Computing Surveys {\bf 13,} 3}
\D {1981}
\X {Four automated specification and verification environments are surveyed and
compared: HDM, FDM, Gypsy, and AFFIRM. The emphasis of the comparison is on the
way these systems could be used to prove security properties of an operating
system design.}

\T {A Video Scrambling Technique Based On Space Filling Curves}
\A {Yossi Matias}
\A {Adi Shamir}
\J {Advances in Cryptology---CRYPTO '87, Proceedings, Lecture Notes in Computer Science (293), Springer-Verlag}
\D {1987}
\X {In this paper we propose a video scrambling technique which scans a picture stored in a frame buffer along a pseudo-random space filling curve. We describe several efficient methods for generating cryptographically strong curves, and show that they actually decrease the bandwidth required to transmit the picture.}

\T {VLSI Implementation of Public-Key Encryption Algorithms}
\A {G. A. Orton}
\A {M. P. Roy}
\A {P. A. Scott}
\A {L. E. Peppard}
\A {S. E. Tavares}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {This paper describes some recently successful results in the CMOS VLSI implementation of public-key data encryption algorithms. Architectural details, circuits, and prototype test results are presented for RSA encryption and multiplication in the finite field $GF(2^m).$ These designs emphasize high throughput and modularity. An asynchronous modulo multiplier is described which permits a significant improvement in RSA encryption throughput relative to previously described synchronous implementations.}

\T {A Voice Scrambling System for Testing and Demonstration}
\A {Peter Hess}
\A {Klaus Wirl}
\J {Cryptography, Proceedings, Burg Feuerstein 1982, Lecture Notes in Computer Science (149), Springer-Verlag}
\D {1983}
\X {The principle of time division multiplexing was known before World War~II. But time division multiplexing was not very important, as it was quite complicated to implement this method in analog technique. But since digital memories have become cheaper, more TDM-systems have been introduced. Our system, called Erlangen Voice Scrambling (EVS-) system was build for testing and demonstration.}

\T {Walsh-Spectral Test for GFSR Pseudorandom Numbers}
\A {Shu Tezuka}
\J {CACM {\bf 30,} 8}
\D {1987}
\X {By applying Weyl's criteria for $k$-distributivity to GFSR sequences we derive a new theoretical test for investigating the statistical property of GFSR sequences. This test provides a very useful measure for examining the $k$-distribution, that is, the statistical independence of the $k$-tuple successive terms of GFSR sequences. In the latter half of this paper, we describe an efficient procedure for performing this test and furnish experimental results obtained from applying it to several GFSR generators with prime period lengths.}

\T {Watch Out Hackers, Public Encryption Chips Are Coming}
\A {K. Smith}
\J {Electronic Week, May~20, pp. 30--31}
\D {1985}

\T {Weakening Security Assumptions and Oblivious Transfer}
\A {Claude Cr\'epeau}
\A {Joe Kilian}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}

\T {What to Do when You have Reason to Believe your Computer has been Compromised}
\A {Bernard P. {Zajac Jr.}}
\J {Computers \& Security, {\bf 5,} 1}
\D {1986}
\X {Many installations currently do not have any formal plans on what to do when they believe the system has been victimized by computer abuse. The concept of the Computer Abuse Response Team is proposed and ways of preserving evidence to make prosecution easier are presented.}

\T {When Shift Registers Clock Themselves}
\A {Rainer A. Rueppel}
\J {Advances in Cryptology---EUROCRYPT '87, Proceedings, Lecture Notes in Computer Science (304), Springer-Verlag}
\D {1987}
\X {A new class of sequences, which we term $[d,k]$ self-decimated sequences, is investigated. For appropriate choices of $[d,k]$ these sequences possess large periods, balanced $k$-distributions, large linear complexities, and moderate out-of-phase autocorrelation magnitudes. Furthermore, they are easy to generate. These properties suggest that $[d,k]$ self-decimated sequences may have some applications in cryptography and spread spectrum communication.}

\T {Why not DES?}
\A {Ted Goeltz}
\J {Computers \& Security, {\bf 5,} 1}
\D {1986}
\X {The controversy over the security of DES arose in the mind-1970s when Martin Hellman and Whitfield Diffie suggested that the 56 bit cipher key was too short to prevent solution by exhaustive research. Aside from the question of cryptographic security there is the problem of a large number of persons utilizing the same cryptographic algorithm which increases greatly the possible economic returns which might be realized in breaking the system. The idea of a ``standard'' is contrary to good cryptographic practice. The federal government uses DES only for non-classified information.}

\T {Windmill Generators: A Generalization and an Observation of How Many There Are}
\A {B. J. M. Smeets}
\A {W. G. Chambers}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {The windmill technique has several practical advantages over other techniques for high-speed generation or blockwise generation of pn-sequences. In this paper we generalize previous results by showing that if $f(t)=\alpha(t^v)-\beta(t^{-v})t^L$ is the minimal polynomial of a pn-sequence, then the sequence can be generated by a windmill generator. For $L=1,\ldots,127,$ and $v=4,8,16$ such that $L\equiv\pm3\mod8$ no irreducible polynomial $f(t)$ were found. When $L\equiv\pm1\mod8$ the number of primitive $f(t)$'s was found to be approximately twice the expected number.}

\T {Wire-Tap Channel II}
\A {L. H. Ozarow}
\A {A. D. Wyner}
\J {Advances in Cryptology---EUROCRYPT '84, Proceedings, Lecture Notes in Computer Science (209), Springer-Verlag}
\D {1984}
\X {Consider the following situation. $K$ data bits are to be encoded into $N>K$ bits and transmitted over a noiseless channel. An intruder can observe a subset of his choice of size $\mu<N.$ The encoder is to be designed to maximize the intruder's uncertainty about the data given his $N$ intercepted channel bits, subject to the condition that the intended receiver can recover the $K$ data bits perfectly from the $N$ channel bits. The optimal tradeoffs between the parameters $K, N, \mu$ and the intruder's uncertainty $H$ ($H$ is the ``conditional entropy'' of the data given the $\mu$ intercepted channel bits) were found. In particular, it was shown that for $\mu=N-K,$ a system exists with $H\approx K-1.$ Thus, for example, then $N=2K$ and $\mu=K,$ it is possible to encode the $K$ data bits into $2K$ channel bits, so that by looking at any $K$ channel bits, the intruder obtains {\bf essentially no information about the data.}}

\T {With Microscope and Tweezers: The Worm from MIT's Perspective}
\A {Jon A. Rochlis}
\A {Mark W. Eichin}
\J {Communications of the ACM, {\bf 32,} 6, pp. 678++}
\D {1989}
\X {The actions taken by a group of computer scientists at MIT during the worm invasion represents a study of human response to a crisis. The authors also relate the experiences and reactions of other groups throughout the country, especially in terms of how they interacted with the MIT team.}

\T {Workshop on Distributed Computing and Cryptography}
\A {Feigenbaum}
\J {Technical Report: 89--14, Centre for Discrete Mathemantics and Theoretical Computer Science (DIMACS) Computer Science (DIMACS) at Rutgers University, New Jersey}
\D {1989}

\T {Wyner's Analog Encryption Scheme: Results of a Simulation}
\A {Burt S. Kaliski}
\J {Advances in Cryptology---CRYPTO '84, Proceedings, Lecture Notes in Computer Science (196), Springer-Verlag}
\D {1984}
\X {This paper presents the results of a simulation of an analog encryption scheme. The scheme, introduced in 1979 by Aaron Wyner of Bell Telephone Laboratories, provides secure, accurate scrambling of speech waveforms, while conforming to the bandlimitedness of a telephone channel. The simulation confirms the scheme's theoretical properties, based on numerical measures and on listening to encrypted and decrypted waveforms.}

\T {Zero Knowledge and the Department of Defence}
\A {S. Landau}
\J {Notices of the American Mathematical Society {\bf 35,} pp. 5--12}
\D {1988}

\T {Zero-Knowledge Authentication Scheme with Secret Key Exchange}
\A {J\o rgen Brandt}
\A {Ivan Damg{\aa}rd}
\A {Peter Landrock}
\A {Torben Pedersen}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {In this note we first develop a new computationally zero-knowledge interactive proof system of knowledge, which then is modified into an authentication scheme with secret key exchange for subsequent conventional encryption. Implemented on a standard 32-bit chip or similar, the whole protocol, which involves mutual identification of two users, exchange of a random common secret key and verification of certificates for the public keys (RSA, 512 bits) takes less than 0.7 seconds.}

\T {Zero Knowledge Interactive Proof of Knowledge (a Digest)}
\A {M. Tompa}
\J {Research Report RC 13282 (\#59389), IBM Research Division, T.J. Watson Research Centre, Yorktown Heights, NY}
\D {1987}

\T {A Zero-Knowledge Poker Protocol That Achieves Confidentiality of the Players' Strategy {\em or\/} How to Achieve an Electronic Poker Face}
\A {Claude Cr\'epeau}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}

\T {Zero-Knowledge Procedures for Confidential Access to Medical Records}
\A {Jean-Jacques Quisquater}
\A {Andr\'e Bouckaert}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}

\T {Zero-Knowledge Proofs of Computational Power}
\A {Moti Yung}
\J {Advances in Cryptology---EUROCRYPT '89, Proceedings, Lecture Notes in Computer Science (434), Springer-Verlag}
\D {1989}
\X {Suppose that the NSA had announced the possession of an efficient factorization algorithm. The cryptology community, after recovering from the initial shock, would demand to see the algorithm and verify it. This request, however, could not be satisfied since the algorithm would probably be classified as top-secret information. In this note we give a procedure which will satisfy both sides of the above imaginery dispute. This is a way in which one party can prove possession of some ``computational power;; (e.g., a special-purpose efficient factorization machine) without revealing any algorithmic detail about this computation task (e.g., the factoring algorithm).}

\T {Zero Knowledge Proof of Identity}
\A {Uriel Feige}
\A {Amos Fiat}
\A {Adi Shamir}
\J {Proceedings of the 19th Annual ACM Symposium on Theory of Computing}
\D {1987}
\X {In this paper we extend the notion of zero knowledge proofs of membership (which reveal one bit of information) to zero knowledge proofs of knowledge (which reveal no information whatsoever). After formally defining this notion, we show its relevance to identification schemes, in which parties prove their identity by demonstrating their knowledge rather than by proving the validity of assertions. We describe a novel scheme which is provably secure if factoring is difficult and whose practical implementations are about two order of magnitude faster than RSA-based identification schemes. In the last part of the paper we consider the question of sequential versus parallel executions of zero knowledge protocols, define a new notion of ``transferable information'', and prove that the parallel version of our identification scheme (which is not known to be zero knowledge) is secure since it reveals no transferable information.}

\T {Zero-Knowledge Proofs of Identity and Veracity of Transaction Receipts}
\A {Gustavus J. Simmons}
\A {George B. Purdy}
\J {Advances in Cryptology---EUROCRYPT '88, Proceedings, Lecture Notes in Computer Science (330), Springer-Verlag}
\D {1988}
\X {There are two equally important, related, functions involved in the control of assets and resources. One of these is the verification of a potential user's identity and authority to use or have access so that in the event of a later dispute as to whether an illegitimate use was made of the assets, or of the extent of the liability incurred in a legitimate use, etc., the authenticity and specifics of the access can be demonstrated in a logically compelling (and hence eventually legally binding) manner to an impartial third party or arbiter. Elaborate, and legally accepted, document based protocols to accomplish these functions are central to all commercial and private transactions. When the resources are remotely accessible, however, as in the case of computer data files, electronic funds transfer (EFT), automated bank tellers, and even in many manned point-of-sale systems, no satisfactory counterpart to established document based protocols for verifying individual identity and/or authority to use a resource have been found, nor has a fully satisfactory means been devised to provide unforgeable transaction receipts. In this paper, we show how a public authentication channel can be used to verify private (user unique) authentication channels in a protocol that both ``proves'' a potential user's identity and authority and also provides certified receipts for transactions whose legitimacy can later be verified by impartial arbiters who did not have to be parties to the original transaction. We also introduce an authentication scheme to be used in this application based on the legitimate originator of information being able to extract square roots modulo $n=pq,$ where $p$ and $q$ are primes of a special form. We show that these protocols provide a zero-knowledge proof of identity and of veracity transaction receipts, and that they are therefore very secure. We also show how the legitimate owner of the authentication channel can give a zero-knowledge proof that the modulus $n$ has the correct form, thereby eliminating the possibility of the existence of several known subliminal channels.}

\T {Zero Knowledge Proofs of Knowledge in Two Rounds}
\A {U. Feige}
\A {A. Shamir}
\J {Advances in Cryptology---CRYPTO '89, Proceedings, Lecture Notes in Computer Science (435), Springer-Verlag}
\D {1989}
\X {We construct constant round ZKIPs for any $NP$ language, under the sole assumption that oneway functions exist. Under the stronger Certified Discrete Log assumption, our construction yields perfect zero knowledge protocols. Our protocols rely on two novel ideas: One for constructing commitment schemes, the other for constructing subprotocols which are not known to be zero knowledge, yet can be proven not to reveal useful information.}

\T {Zero-Knowledge Simulation of Boolean Circuits}
\A {Gilles Brassard}
\A {Claude Cr\'epeau}
\J {Advances in Cryptology---CRYPTO '86, Proceedings, Lecture Notes in Computer Science (263), Springer-Verlag}
\D {1987}
\X {A zero-knowledge interactive proof is a protocol by which Alice can convince polynomially-bounded Bob of the truth of some theorem without giving him any hint as to how the proof might proceed. Under cryptographic assumptions, we give a general technique for achieving this goal for {\em every\/} problem in {\bf NP.} This extends to a presumably larger class, which combines the powers of non-determinism and randomness. Our protocol is powerful enough to allow Alice to convince Bob of theorems for which she does not even have a proof: it is enough for Alice to convince herself probabilistically of a theorem, perhaps thanks to her knowledge of some trap-door information, in order for her to be able to convince Bob as well, without compromising the trap-door in any way.}

\T {Zero-Knowledge With Finite State Verifiers}
\A {Cynthia Dwork}
\A {Larry Stockmeyer}
\J {Advances in Cryptology---CRYPTO '88, Proceedings, Lecture Notes in Computer Science (403), Springer-Verlag}
\D {1988}
\X {We initiate an investigation of interactive proof systems (IPS's) and zero knowledge interactive proof systems where the verifier is a 2-way probabilistic finite state automaton (2pfa). Among other results, we show: 1. There is a class of 2pfa verifiers and a language $L$ such that $L$ has a zero knowledge IPS with respect to this class of verifiers, and $L$ cannot be recognized by any verifier in the class on its own; 2. There is a language $L$ such that $L$ has an IPS with 2pfa verifiers but $L$ has no zero knowledge IPS with 2pfa verifiers.}

\T {Zero-One Law for Boolean Privacy}
\A {Benny Chor}
\A {Eyal Kushilevitz}
\J {Proc. of the 21st Annual ACM Symposium on Theory of Computing}
\D {1989}
\X {A Boolean function $f:A_1\times A_2\times\cdots\times A_n\rightarrow\{0,1\}$ is $t$-private if there exists a protocol for computing $f$ so that no coalition of size $\le t$ can infer any additional information from the execution, other than the value of the function. We show that $f$ is $\lceil {n\over2}\rceil$-private if and only if it can be represented as $$f(x_1,x_2,\ldots,x_n)=f_1(x_1)\oplus f_2(x_2)\oplus\cdots\oplus f_n(x_n),$$ where the $f_i$ are arbitrary Boolean functions. It follows that if $f$ is $\lceil {n\over2}\rceil$-private, then it is also $n$-private. Combining this with a result of Ben-Or, Goldwasser, and Wigderson, we derive an interesting ``zero-one'' law for private distributed computation of Boolean functions: Every Boolean function defined over a finite domain is either $n$-private, or it is $\lfloor {n-1\over2}\rfloor$-private but not $\lceil {n\over2}\rceil$-private. We also investigate a weaker notion of privacy, where (a) coalitions are allowed to infer a limited amount of additional information, and (b) there is a probability of error in the final output of the protocol. We show that the same characterization of $\lceil {n\over2}\rceil$-private Boolean functions holds, even under these weaker requirements. In particular, this implies that for Boolean functions, the strong and weak notions of privacy are equivalent.}

\begin{theindex}
\input {a80.in}
\end{theindex}

Total number of entries is \arabic{entry}.
\end{document}
