In 2017, Ward Beullens et al. submitted Lifted Unbalanced Oil and Vinegar [3], which is a modification to the Unbalanced Oil and Vinegar Scheme by Patarin. Previously, Ding et al. proposed the Subfield Differential Attack [22] which prompted a change of parameters by the authors of LUOV for the second round of the NIST post quantum standardization competition [4]. In this paper we propose a modification to the Subfield Differential Attack called the Nested Subset Differential Attack which fully breaks half of the parameter sets put forward. We also show by experimentation that this attack is practically possible to do in under 210 min for the level I security parameters and not just a theoretical attack. The Nested Subset Differential attack is a large improvement of the Subfield differential attack which can be used in real world circumstances. Moreover, we will only use what is called the “lifted” structure of LUOV, and our attack can be thought as a development of solving “lifted” quadratic systems.

Some electromagnetic materials exhibit, in a given frequency range, effective dielectric permittivity and/or magnetic permeability which are negative. In the literature, they are called negative index materials, left-handed materials or meta-materials. We propose in this paper a numerical method to solve a wave transmission between a classical dielectric material and a meta-material. The method we investigate can be considered as an alternative method compared to the method presented by the second author and co-workers. In particular, we shall use the abstract framework they developed to prove well-posedness of the exact problem. We recast this problem to fit later discretization by the staggered discontinuous Galerkin method developed by the first author and co-worker, a method which relies on introducing an auxiliary unknown. Convergence of the numerical method is proven, with the help of explicit infsup

In this paper we show how to totally break the fully homomorphic encryption scheme of eprint 2017/458.

The SFLASH signature scheme stood for a decade as the most successful cryptosystem based on multivariate polynomials, before an efficient attack was finally found in 2007. In this paper, we review its recent cryptanalysis and we notice that its weaknesses can all be linked to the fact that the cryptosystem is built on the structure of a large field. As the attack demonstrates, this richer structure can be accessed by an attacker by using the specific symmetry of the core function being used. Then, we investigate the effect of restricting this large field to a purely linear subset and we find that the symmetries exploited by the attack are no longer present. At a purely defensive level, this defines a countermeasure which can be used at a moderate overhead. On the theoretical side, this informs us of limitations of the recent attack and raises interesting remarks about the design itself of multivariate schemes.

We give exact formulas for the growth of the ideal Aλ for λ a quadratic element of the algebra of Boolean functions over the Galois field GF(2). That is, we calculate dim A_k λ where A_k is the subspace of elements of degree less than or equal to k. These results clarify some of the assertions made in the article of Yang, Chen and Courtois [22,23] concerning the efficiency of the XL algorithm.

In this paper, we present and prove the first closed formula bounding the degree of regularity of an HFE system over an arbitrary finite field. Though these bounds are not necessarily optimal, they can be used to deduce 1. if D, the degree of the corresponding HFE polynomial, and q, the size of the corresponding finite field, are fixed, inverting HFE system is polynomial for all fields; 2. if D is of the scale O(n^α) where n is the number of variables in an HFE system, and q is fixed, inverting HFE systems is quasi-polynomial for all fields. We generalize and prove rigorously similar results by Granboulan, Joux and Stern in the case when q = 2 that were communicated at Crypto 2006.

We combine the method of searching for an invariant subspace of the unbalanced Oil and Vinegar signature scheme and the Minrank method to defeat the new TTS signature scheme, which was suggested for low-cost smart card applications at CHES 2004. We show that the attack complexity is less than 2^{50}.

Let X = (x_1,..,x_n) and Y = (y_1,...,y_m) be a pair of corresponding plaintext and ciphertext for a cryptosystem. We define an embedded surface of this cryptosystem as any polynomial equation: E(X,Y)=E(x_1,..,x_n,y_1,...,y_m)=0, which is satisfied by all such pairs. In this paper, we present a new attack on the multivariate public key cryptosystems from Diophantine equations developed by Gao and Heindl by using the embedded surfaces associated to this family of multivariate cryptosystems.

A product formula is proved which involves the unitary group generated by a semibounded self-adjoint operator and an orthogonal projection P. It gives a partial answer to the question about existence of the limit which describes quantum Zeno dynamics in the subspace Ran P.

We prove that a random map drawn from any class \mathfrak{C} of polynomial maps from (F_q)^n to (F_q)^{n+r} that is (i) totally random in the affine terms, and (ii) has a negligible chance of being not strongly one-way, provides a secure PRNG (hence a secure stream cipher) for any q. Plausible choices for are semi-sparse (i.e., the affine terms are truly random) systems and other systems that are easy to evaluate from a small (compared to a generic map) number of parameters. To our knowledge, there are no other positive results for provable security of specialized polynomial systems, in particular sparse ones (which are natural candidates to investigate for speed). We can build a family of provably secure stream ciphers a rough implementation of which at the same security level can be more than twice faster than an optimized QUAD (and any other provably secure stream ciphers proposed so far), and uses much less storage. This may also help build faster provably secure hashes. We also examine the effects of recent results on specialization on security, e.g., Aumasson-Meier (ICISC 2007), which precludes Merkle-Damgaard compression using polynomials systems {uniformly very sparse in every degree} from being universally collision-free. We conclude that our ideas are consistent with and complements these new results. We think that we can build secure primitives based on specialized (versus generic) polynomial maps which are more efficient.

Recent studies have shown that the entropy production rate for the master equation consists of two nonnegative terms: the adiabatic and non-adiabatic parts, where the non-adiabatic part is also known as the dissipation rate of a Boltzmann-Shannon relative entropy. In this paper, we provide some nonzero lower bounds for the relative entropy, the entropy production rate, and its adiabatic and non-adiabatic parts. These nonzero lower bounds not only reveal some novel dissipative properties for general nonequilibrium processes which are much stronger than the second law of thermodynamics, but also impose some new constraints on thermodynamic constitutive relations. Moreover, we also provide a mathematical application of these nonzero lower bounds by studying the long-time behavior of the master equation. Extensions to the Tsallis statistics are also discussed, including the nonzero lower bounds for the Tsallis-type relative entropy and its dissipation rate.

No abstract uploaded!

We use one photon to simulate an n-qubit quantum system for the first time. We propose a new scheme to realize universal quantum computation in polynomial time O(n^5). A generating set of gates can be realized with high accuracy in the lab. We conclude that photonic quantum computation is one of the promising approaches to universal quantum computation.

A sensor pixel integrates optical intensity across its extent, and we explore the role that this integration plays in phase space tomography. The literature is inconsistent in its treatment of this integration—some approaches model this integration explicitly, some approaches are ambiguous about whether this integration is taken into account, and still some approaches assume pixel values to be point samples of the optical intensity. We show that making a point-sample assumption results in apodization of and thus systematic error in the recovered ambiguity function, leading to underestimating the overall degree of coherence. We explore the severity of this effect using a Gaussian Schell-model source and discuss when this effect, as opposed to noise, is the dominant source of error in the retrieved state of coherence.

This paper proposes a two-level continuum transportation system approach to modeling a dynamic taxi traffic assignment (DTTA) problem in a dense network with real-time traffic information provision and three types of vehicles, including private cars, occupied taxis, and vacant taxis. The proposed approach treats the dense network as a continuum in the first level, in which private car and occupied taxi drivers are free to choose their paths in a two-dimensional continuous space. The proposed approach also divides the modeling region into many identical squares to form a cell-based network in the second level, in which the cells are classified into two categories: target cell with an acceptable expected rate of return (EROR) to vacant taxi drivers and non-target cell with an unacceptable EROR. The EROR associated with a cell is the ratio of the cumulative expected profit of a taxi driver who successfully picks up a customer during the customer search that starts from that cell to the sum of expected search time for this customer and expected occupied travel time to serve this customer. Based on the cell-based network, we develop a cell-based intervening opportunity model to capture the fact that vacant taxi drivers can meet a customer on the way to their destination zones and estimate the EROR. Each vacant taxi driver has a mixed strategy to determine his/her customer-search direction according to the EROR: Each vacant taxi driver in a target cell selects its neighbor cells with maximum EROR, and each vacant taxi driver in a non-target cell selects the travel time-based shortest path to his/her target cell. Meanwhile, each private car driver chooses the path that minimizes his/her own generalized travel cost, and each occupied taxi driver chooses the path that minimizes his/her customer's generalized in-vehicle travel cost. In our model, traffic density in the system is governed by the conservation law (CL), and the flow directions of different vehicles are determined by the path-choice strategies of their drivers, which are captured by Hamilton–Jacobi (HJ) equations. Both the proposed CL and HJ equations can be solved by the Lax–Friedrichs scheme, which forms the backbone of the developed solution algorithm. Finally, numerical examples and a case study are used to demonstrate the properties of the model, the performance of the solution algorithm, and the value of using our methodology for estimating network performance.

We show that Multivariate Public Key Cryptosystems (MPKCs) over fields of small odd prime characteristic, say 31, can be highly efficient. Indeed, at the same design security of 2^{80} under the best known attacks, odd-char MPKC is generally faster than prior MPKCs over \GF{2^k}, which are in turn faster than "traditional'' alternatives. This seemingly counter-intuitive feat is accomplished by exploiting the comparative over-abundance of small integer arithmetic resources in commodity hardware, here embodied by SSE2 or more advanced special multimedia instructions on modern x86-compatible CPUs. We explain our implementation techniques and design choices in implementing our chosen MPKC instances modulo small a odd prime. The same techniques are also applicable in modern FPGAs which often contains a large number of multipliers.

We consider a charged spinless quantum particle confined to a graph consisting of a loop to which a halfline lead is attached; this system is placed into a homogeneous magnetic field perpendicular to the loop plane. We derive the reflection amplitude and show that there is an infinite ladder of resonances; analyzing the resonance pole trajectories, we show that half of them turn into true embedded eigenvalues provided the flux through the loop is an integer or half-integer multiple of the flux unit hc/e. We also describe a general method to solve the scattering problem on graphs of which the present model is a simple particular case. Finally, we discuss ways in which a state localized initially at the loop decays.

Key Exchange (KE) from RLWE (Ring-Learning with Errors) is a potential alternative to Diffie-Hellman (DH) in a post quantum setting. Key leakage with RLWE key exchange protocols in the context of key reuse has already been pointed out in previous work. The initial attack described by Fluhrer is designed in such a way that it only works on Peikert’s KE protocol and its variants that derives the shared secret from the most significant bits of the approximately equal keys computed by both parties. It does not work on Ding’s key exchange that uses the least significant bits to derive a shared key. The Signal leakage attack relies on changes in the signal sent by the responder reusing his key, in a sequence of key exchange sessions initiated by an attacker with a malformed key. A possible defense against this attack would be to require the initiator of a key exchange to send the signal, which is the one pass case of the KE protocol. In this work, we describe a new attack on Ding’s one pass case without relying on the signal function output but using only the information of whether the final key of both parties agree. We also use LLL reduction to create the adversary’s keys in such a way that the party being compromised cannot identify the attack in trivial ways. This completes the series of attacks on RLWE key exchange with key reuse for all variants in both cases of the initiator and responder sending the signal. Moreover, we show that the previous Signal leakage attack can be made more efficient with fewer queries and how it can be extended to Peikert’s key exchange, which was used in the BCNS implementation and integrated with TLS and a variant used in the New Hope implementation.

A BDDC (Balancing Domain Decomposition by Constraints) algorithm is developed and analyzed for a staggered discontinuous Galerkin (DG) finite element approximation of second order scalar elliptic problems. On a quite irregular subdomain partition, an optimal condition number bound is proved for two-dimensional problems. In addition, a sub-optimal but scalable condition number bound is obtained for three-dimensional problems. These bounds are shown to be independent of coefficient jumps in the subdomain partition. Numerical results are also included to show the performance of the algorithm.

Consider an unstable quantum system that has been found undecayed at an instant s and denote by R(t,s) the rate of its regeneration into an original (undecayed) state at a later instant t+s. It is proved that the reduced evolution is a semigroup, i.e., there is no regeneration at all, provided R(t,s)1/2 can be estimated by a sufficiently regular function that is nondecreasing in s and has zero derivative with respect to t at t=0 for every s. This generalizes the theorem of Misra and Sinha [Helv. Phys. Acta 45, 619 (1972)] in a different direction than in a recent paper by Nishioka [J. Math. Phys. 29, 1860 (1988)].

We consider an open quantum dot modeled by a straight hard-wall channel with a potential well. If this potential depends on the longitudinal variable only, the system exhibits embedded eigenvalues. They turn into resonances if the symmetry is violated, either by a magnetic field or by deformation of the well. We construct a perturbation theory of these resonances in the case of a weak perturbation and discuss other properties of the model.

The Feynman maps introduced first by Truman are examined. The domain considered here consists of the Fresnel-integrable functions in the sense of Albeverio and Hoegh-Krohn; extensions to wider classes of functions will be studied in the following paper. The original definition of the F-maps is slightly modified: we start from the underlying measures on the Hilbert space of paths in order to avoid use of improper integrals. Some new properties of the F-maps are derived. In particular, the dominated convergence theorem is shown to be not valid for the F₁-map (or Feynman integral); this fact is of a certain importance for the classical limit of quantum mechanics.

Point interactions described by formal shaped potentials were used in quantum mechanics from the early thirties. It lasted several decades, however, until a proper way to handle the corresponding Schrdinger operators was found. Following the observation of Berezin and Faddeev [4], the problem was studied systematically in the eighties. The results are summarized in the monograph [1], references to some recent work are given, eg, in [2, 8]. In its present form the pointinteraction method represents a versatile tool for constructing solvable models whose power has not been yet, to our opinion, appreciated fully in the physical community. Within the standard quantum mechanical formalism point interactions can be constructed as long as the configuration space dimension does not exceed three, and they can be interpreted as limits of suitable families of squeezed potentials. In the onedimensional case the limiting argument admits a straightforward interpretation, because the pointinteraction coupling constant is just the integral of the approximating potential: a slow particle on the line with a wellspread wavefunction sees only the average value of a localized potential. In distinction to that the approximation by scaled potentials in dimension two and three requires existence of a zeroenergy resonance and a particular couplingconstant renormalization; a detailed discussion of the related mathematical problems can be found in [1, 9]. This gives these point interactions a flavour of something exceptional, for instance, one is led to believe that they cannot be used to model welllocalized repulsive potentials. That would have consequences

In this paper, we attempt to reconstruct one of the last and incomplete projects of Volodya Geyler. We study the motion of a quantum particle in the plane to which a halfline lead is attached, assuming that the particle has spin and the plane component of the Hamiltonian contains a spin-orbit interaction, of Rashba or Dresselhaus type. We construct a class of admissible Hamiltonians and derive an explicit expression for the Green function, which is applied to scattering in a system of this kind.

We study a charged two-dimensional particle confined to a straight parabolic-potential channel and exposed to a homogeneous magnetic field under the influence of a potential perturbation W. If W is bounded and periodic along the channel, a perturbative argument yields the absolute continuity of the bottom of the spectrum. We show that it can have any finite number of open gaps provided that the confining potential is sufficiently strong. However, if W depends on the periodic variable only, we prove by the Thomas argument that the whole spectrum is absolutely continuous, irrespective of the size of the perturbation. On the other hand, if W is small and satisfies a weak localization condition in the the longitudinal direction, we prove by the Mourre method that a part of the absolutely continuous spectrum persists.