Secure Remote Password (SRP) protocol is an augmented Password-based Authenticated Key Exchange (PAKE) protocol based on discrete logarithm problem (DLP) with various attractive security features. Compared with basic PAKE protocols, SRP does not require server to store user’s password and user does not send password to server to authenticate. These features are desirable for secure client-server applications. SRP has gained extensive real-world deployment, including Apple iCloud, 1Password etc. However, with the advent of quantum computer and Shor’s algorithm, classic DLP-based public key cryptography algorithms are no longer secure, including SRP. Motivated by importance of SRP and threat from quantum attacks, we propose a RLWE-based SRP protocol (RLWE-SRP) which inherit advantages from SRP and elegant design from RLWE key exchange. We also present parameter choice and efficient portable C++ implementation of RLWE-SRP. Implementation of our 209-bit secure RLWE-SRP is more than 3x faster than 112-bit secure original SRP protocol, 5.5x faster than 80-bit secure J-PAKE and 14x faster than two 184-bit secure RLWE-based PAKE protocols with more desired properties.

In this paper, we first present a theoretical analysis model on the Proof-of-Work (PoW) for cryptocurrency blockchain. Based on this analysis, we present a new type of PoW, which relies on the hardness of solving a set of random quadratic equations over the finite field GF(2). We will present the advantages of such a PoW, in particular, in terms of its impact on decentralization and the incentives involved, and therefore demonstrate that this is a new good alternative as a new type for PoW in blockchain applications.

In this paper, we present and prove the first closed formula bounding the degree of regularity of an HFE system over an arbitrary finite field. Though these bounds are not necessarily optimal, they can be used to deduce 1. if D, the degree of the corresponding HFE polynomial, and q, the size of the corresponding finite field, are fixed, inverting HFE system is polynomial for all fields; 2. if D is of the scale O(n^α) where n is the number of variables in an HFE system, and q is fixed, inverting HFE systems is quasi-polynomial for all fields. We generalize and prove rigorously similar results by Granboulan, Joux and Stern in the case when q = 2 that were communicated at Crypto 2006.

Short integer solution (SIS) and learning with errors (LWE) are two hard lattice problems. These two problems are believed having huge potential in application of cryptography. In 2012, Ding et al. [5] introduced the first provably secure key exchange based on LWE problem. On the other hand, we believe that it is very difficult to do key exchange on SIS problem only. In 2014, Wang et al. [6] did an attempt, but it was not successful. Mao et al. [7] broke the protocol by an attack based on CBi-SIS problem in 2016. However, their attack is not efficient. In this paper, we present a extremely straightforward and simple attack to Wang’s key exchange and then we will construct a key exchange based on SIS and LWE problems.

No abstract uploaded!

Recent studies have shown that the entropy production rate for the master equation consists of two nonnegative terms: the adiabatic and non-adiabatic parts, where the non-adiabatic part is also known as the dissipation rate of a Boltzmann-Shannon relative entropy. In this paper, we provide some nonzero lower bounds for the relative entropy, the entropy production rate, and its adiabatic and non-adiabatic parts. These nonzero lower bounds not only reveal some novel dissipative properties for general nonequilibrium processes which are much stronger than the second law of thermodynamics, but also impose some new constraints on thermodynamic constitutive relations. Moreover, we also provide a mathematical application of these nonzero lower bounds by studying the long-time behavior of the master equation. Extensions to the Tsallis statistics are also discussed, including the nonzero lower bounds for the Tsallis-type relative entropy and its dissipation rate.

A sensor pixel integrates optical intensity across its extent, and we explore the role that this integration plays in phase space tomography. The literature is inconsistent in its treatment of this integration—some approaches model this integration explicitly, some approaches are ambiguous about whether this integration is taken into account, and still some approaches assume pixel values to be point samples of the optical intensity. We show that making a point-sample assumption results in apodization of and thus systematic error in the recovered ambiguity function, leading to underestimating the overall degree of coherence. We explore the severity of this effect using a Gaussian Schell-model source and discuss when this effect, as opposed to noise, is the dominant source of error in the retrieved state of coherence.

We show all the existing TTM implementation schemes have a defect that there exist linearization equations \sum_{i=1,j=1}^{n,m} a_{ij} x_i y_j(x_1,...,x_n) + \sum_{i=1}^n b_i x_i + \sum_{j=1}^m c_j y_j(x_1,...,x_n) + d = 0, which are satisfied by the components y_i(x_1,...,x_n) of the ciphers of the TTM schemes. We further demonstrate that, for the case of the most recent two implementation schemes in two versions of the paper \cite{CM}, where the inventor of TTM used them to refute a claim in \cite{CG}, if we do a linear substitution with the linear equations derived from the linearization equations for a given ciphertext, we can find the plaintext easily by an iteration of the procedure of first search for linear equations by linear combinations and then linear substitution. The computation complexity of the attack on these two schemes is less than 2^{35} over a finite field of size 2^8.

In this paper, we present a new algorithm, such that, for the learning with errors (LWE) problems, if the errors are bounded -- the errors do not span the whole prime finite field F_q but a fixed known subset of size D (D<q), which we call the learning with bounded errors (LWBE) problems, we can solve it with complexity O(n^D).

We consider a charged spinless quantum particle confined to a graph consisting of a loop to which a halfline lead is attached; this system is placed into a homogeneous magnetic field perpendicular to the loop plane. We derive the reflection amplitude and show that there is an infinite ladder of resonances; analyzing the resonance pole trajectories, we show that half of them turn into true embedded eigenvalues provided the flux through the loop is an integer or half-integer multiple of the flux unit hc/e. We also describe a general method to solve the scattering problem on graphs of which the present model is a simple particular case. Finally, we discuss ways in which a state localized initially at the loop decays.

A product formula is proved which involves the unitary group generated by a semibounded self-adjoint operator and an orthogonal projection P. It gives a partial answer to the question about existence of the limit which describes quantum Zeno dynamics in the subspace Ran P.

This paper proposes a two-level continuum transportation system approach to modeling a dynamic taxi traffic assignment (DTTA) problem in a dense network with real-time traffic information provision and three types of vehicles, including private cars, occupied taxis, and vacant taxis. The proposed approach treats the dense network as a continuum in the first level, in which private car and occupied taxi drivers are free to choose their paths in a two-dimensional continuous space. The proposed approach also divides the modeling region into many identical squares to form a cell-based network in the second level, in which the cells are classified into two categories: target cell with an acceptable expected rate of return (EROR) to vacant taxi drivers and non-target cell with an unacceptable EROR. The EROR associated with a cell is the ratio of the cumulative expected profit of a taxi driver who successfully picks up a customer during the customer search that starts from that cell to the sum of expected search time for this customer and expected occupied travel time to serve this customer. Based on the cell-based network, we develop a cell-based intervening opportunity model to capture the fact that vacant taxi drivers can meet a customer on the way to their destination zones and estimate the EROR. Each vacant taxi driver has a mixed strategy to determine his/her customer-search direction according to the EROR: Each vacant taxi driver in a target cell selects its neighbor cells with maximum EROR, and each vacant taxi driver in a non-target cell selects the travel time-based shortest path to his/her target cell. Meanwhile, each private car driver chooses the path that minimizes his/her own generalized travel cost, and each occupied taxi driver chooses the path that minimizes his/her customer's generalized in-vehicle travel cost. In our model, traffic density in the system is governed by the conservation law (CL), and the flow directions of different vehicles are determined by the path-choice strategies of their drivers, which are captured by Hamilton–Jacobi (HJ) equations. Both the proposed CL and HJ equations can be solved by the Lax–Friedrichs scheme, which forms the backbone of the developed solution algorithm. Finally, numerical examples and a case study are used to demonstrate the properties of the model, the performance of the solution algorithm, and the value of using our methodology for estimating network performance.

We use one photon to simulate an n-qubit quantum system for the first time. We propose a new scheme to realize universal quantum computation in polynomial time O(n^5). A generating set of gates can be realized with high accuracy in the lab. We conclude that photonic quantum computation is one of the promising approaches to universal quantum computation.

We combine the method of searching for an invariant subspace of the unbalanced Oil and Vinegar signature scheme and the Minrank method to defeat the new TTS signature scheme, which was suggested for low-cost smart card applications at CHES 2004. We show that the attack complexity is less than 2^{50}.

We prove that a random map drawn from any class \mathfrak{C} of polynomial maps from (F_q)^n to (F_q)^{n+r} that is (i) totally random in the affine terms, and (ii) has a negligible chance of being not strongly one-way, provides a secure PRNG (hence a secure stream cipher) for any q. Plausible choices for are semi-sparse (i.e., the affine terms are truly random) systems and other systems that are easy to evaluate from a small (compared to a generic map) number of parameters. To our knowledge, there are no other positive results for provable security of specialized polynomial systems, in particular sparse ones (which are natural candidates to investigate for speed). We can build a family of provably secure stream ciphers a rough implementation of which at the same security level can be more than twice faster than an optimized QUAD (and any other provably secure stream ciphers proposed so far), and uses much less storage. This may also help build faster provably secure hashes. We also examine the effects of recent results on specialization on security, e.g., Aumasson-Meier (ICISC 2007), which precludes Merkle-Damgaard compression using polynomials systems {uniformly very sparse in every degree} from being universally collision-free. We conclude that our ideas are consistent with and complements these new results. We think that we can build secure primitives based on specialized (versus generic) polynomial maps which are more efficient.

Let X = (x_1,..,x_n) and Y = (y_1,...,y_m) be a pair of corresponding plaintext and ciphertext for a cryptosystem. We define an embedded surface of this cryptosystem as any polynomial equation: E(X,Y)=E(x_1,..,x_n,y_1,...,y_m)=0, which is satisfied by all such pairs. In this paper, we present a new attack on the multivariate public key cryptosystems from Diophantine equations developed by Gao and Heindl by using the embedded surfaces associated to this family of multivariate cryptosystems.

A BDDC (Balancing Domain Decomposition by Constraints) algorithm is developed and analyzed for a staggered discontinuous Galerkin (DG) finite element approximation of second order scalar elliptic problems. On a quite irregular subdomain partition, an optimal condition number bound is proved for two-dimensional problems. In addition, a sub-optimal but scalable condition number bound is obtained for three-dimensional problems. These bounds are shown to be independent of coefficient jumps in the subdomain partition. Numerical results are also included to show the performance of the algorithm.

We show that Multivariate Public Key Cryptosystems (MPKCs) over fields of small odd prime characteristic, say 31, can be highly efficient. Indeed, at the same design security of 2^{80} under the best known attacks, odd-char MPKC is generally faster than prior MPKCs over \GF{2^k}, which are in turn faster than "traditional'' alternatives. This seemingly counter-intuitive feat is accomplished by exploiting the comparative over-abundance of small integer arithmetic resources in commodity hardware, here embodied by SSE2 or more advanced special multimedia instructions on modern x86-compatible CPUs. We explain our implementation techniques and design choices in implementing our chosen MPKC instances modulo small a odd prime. The same techniques are also applicable in modern FPGAs which often contains a large number of multipliers.

Key Exchange (KE) from RLWE (Ring-Learning with Errors) is a potential alternative to Diffie-Hellman (DH) in a post quantum setting. Key leakage with RLWE key exchange protocols in the context of key reuse has already been pointed out in previous work. The initial attack described by Fluhrer is designed in such a way that it only works on Peikert’s KE protocol and its variants that derives the shared secret from the most significant bits of the approximately equal keys computed by both parties. It does not work on Ding’s key exchange that uses the least significant bits to derive a shared key. The Signal leakage attack relies on changes in the signal sent by the responder reusing his key, in a sequence of key exchange sessions initiated by an attacker with a malformed key. A possible defense against this attack would be to require the initiator of a key exchange to send the signal, which is the one pass case of the KE protocol. In this work, we describe a new attack on Ding’s one pass case without relying on the signal function output but using only the information of whether the final key of both parties agree. We also use LLL reduction to create the adversary’s keys in such a way that the party being compromised cannot identify the attack in trivial ways. This completes the series of attacks on RLWE key exchange with key reuse for all variants in both cases of the initiator and responder sending the signal. Moreover, we show that the previous Signal leakage attack can be made more efficient with fewer queries and how it can be extended to Peikert’s key exchange, which was used in the BCNS implementation and integrated with TLS and a variant used in the New Hope implementation.

We consider a Schrdinger particle on a graph consisting of <i>N</i> links joined at a single point. Each link supports a real locally integrable potential <i>V</i> _<i>j</i>; the self-adjointness is ensured by the type boundary condition at the vertex. If all the links are semi-infinite and ideally coupled, the potential decays as <i>x</i> ¹ along each of them, is nonrepulsive in the mean and weak enough, the corresponding Schrdinger operator has a single negative eigenvalue; we find its asymptotic behavior. We also derive a bound on the number of bound states and explain how the coupling constant may be interpreted in terms of a family of squeezed potentials.

Multivariate Cryptography, as one of the main candidates for establishing post-quantum cryptosystems, provides strong, efficient and well-understood digital signature schemes such as UOV, Rainbow, and Gui. While Gui provides very short signatures, it is, for efficiency reasons, restricted to very small finite fields, which makes it hard to scale it to higher levels of security and leads to large key sizes. In this paper we propose a signature scheme called HMFEv (“Hidden Medium Field Equations”), which can be seen as a multivariate version of HFEv. We obtain our scheme by applying the Vinegar Variation to the MultiHFE encryption scheme of Chen et al. We show both theoretically and by experiments that our new scheme is secure against direct and Rank attacks. In contrast to other schemes of the HFE family such as Gui, HMFEv can be defined over arbitrary base fields and therefore is much more efficient in terms of both performance and memory requirements. Our scheme is therefore a good candidate for the upcoming standardization of post-quantum signature schemes.

Properties of the subset of polygonal paths in the Hilbert space of paths referring to a<i>d</i>-dimensional quantum-mechanical system are examined. The results are used to discuss various types of polygonal-path approximations appearing in the functional-integration theory. The uniform approximation is applied to extend the definition of the Feynman maps from our previous paper and to prove consistency of this extension. Relations of the extended<i>F</i> _<i>i</i> map to the Wiener integral are given.

We study a charged two-dimensional particle confined to a straight parabolic-potential channel and exposed to a homogeneous magnetic field under the influence of a potential perturbation W. If W is bounded and periodic along the channel, a perturbative argument yields the absolute continuity of the bottom of the spectrum. We show that it can have any finite number of open gaps provided that the confining potential is sufficiently strong. However, if W depends on the periodic variable only, we prove by the Thomas argument that the whole spectrum is absolutely continuous, irrespective of the size of the perturbation. On the other hand, if W is small and satisfies a weak localization condition in the the longitudinal direction, we prove by the Mourre method that a part of the absolutely continuous spectrum persists.

We sketch here two mathematical models intended to describe the point-contact spectroscopical experiments. A new item is added to the list of recently discovered applications of the self-adjoint extensions theory.

No abstract uploaded!