In CT-RSA 2019, Bauer et al. have analyzed the case when the public key is reused for the NewHope key encapsulation mechanism (KEM), a second-round candidate in the NIST Post-quantum Standard process. They proposed an elegant method to recover coefficients ranging from −6 to 4 in the secret key. We repeat their experiments but there are two fundamental problems. First, even for coefficients in [−6, 4] we cannot recover at least 262 of them in each secret key with 1024 coefficients. Second, for the coefficient outside [−6, 4], they suggested an exhaustive search. But for each secret key on average there are 10 coefficients that need to be exhaustively searched, and each of them has 6 possibilities. This makes Bauer et al.’s method highly inefficient. We propose an improved method, which with 99.22% probability recovers all the coefficients ranging from −6 to 4 in the secret key. Then, inspired by Ding et al.’s key mismatch attack, we propose an efficient strategy which with a probability of 96.88% succeeds in recovering all the coefficients in the secret key. Experiments show that our proposed method is very efficient, which completes the attack in about 137.56 ms using the NewHope parameters.

We consider the Laplacian in a strip R(0,d) with the boundary condition which is Dirichlet except at the segment of a length 2a of one of the boundaries where it is switched to Neumann. This operator is known to have a non-empty and simple discrete spectrum for any a>0. There is a sequence 0<a1<a2< of critical values at which new eigenvalues emerge from the continuum when the Neumann window expands. We find the asymptotic behavior of these eigenvalues around the thresholds showing that the gap is in the leading order proportional to (aan)2 with an explicit coefficient expressed in terms of the corresponding threshold-energy resonance eigenfunction.

Among approaches to defining the Feynman integral, various sequential methods are probably the most popular ones. Here we consider that one based on product formulae, the original idea of which belongs to Nelson71'. This method is powerful in the sense that it enables to prove the strict version of Feynman's basic dynamical formula for a wide class of poten tials^^/including time-dependent ones/4/in comparison with other known methods (see, eg, refs./5, 6/). 0n the other, hand, the method does not correspond exactly to Feynman's heuristic prescription because it replaces the exact action along poly gonal paths by its Riemannian approximation. Moreover, one can regard as an unsatisfactory feature that it employs the" equidistant" time-interval partitions only. In the present paper we show that the last mentioned sour ce of arbitrariness can be removed: the product formula for perturbations of propagators by

No abstract uploaded!

No abstract uploaded!